future proof multiplication overflow

x/concentrated-liquidity/export_test.go

@@ -349,3 +349,7 @@ func (k Keeper) GetPoolHookContract(ctx sdk.Context, poolId uint64, actionPrefix
 func ScaleUpTotalEmittedAmount(totalEmittedAmount osmomath.Dec) (scaledTotalEmittedAmount osmomath.Dec, err error) {
 	return scaleUpTotalEmittedAmount(totalEmittedAmount)
 }
+
+func ComputeTotalIncentivesToEmit(timeElapsedSeconds osmomath.Dec, emissionRate osmomath.Dec) (totalEmittedAmount osmomath.Dec, err error) {
+	return computeTotalIncentivesToEmit(timeElapsedSeconds, emissionRate)
+}

x/concentrated-liquidity/incentives.go

@@ -250,7 +250,13 @@ func calcAccruedIncentivesForAccum(ctx sdk.Context, accumUptime time.Duration, l
 		}
 
 		// Total amount emitted = time elapsed * emission
-		totalEmittedAmount := timeElapsed.MulTruncate(incentiveRecordBody.EmissionRate)
+		totalEmittedAmount, err := computeTotalIncentivesToEmit(timeElapsed, incentiveRecordBody.EmissionRate)
+		if err != nil {
+			ctx.Logger().Info(types.IncentiveOverflowPlaceholderName, "pool_id", poolID, "incentive_id", incentiveRecord.IncentiveId, "time_elapsed", timeElapsed, "emission_rate", incentiveRecordBody.EmissionRate, "error", err.Error())
+			// Silently ignore the truncated incentive record to avoid halting the entire accumulator update.
+			// Continue to the next incentive record.
+			continue
+		}
 
 		// We scale up the remaining rewards to avoid truncation to zero
 		// when dividing by the liquidity in the accumulator.
@@ -289,7 +295,13 @@ func calcAccruedIncentivesForAccum(ctx sdk.Context, accumUptime time.Duration, l
 
 			// We scale up the remaining rewards to avoid truncation to zero
 			// when dividing by the liquidity in the accumulator.
-			remainingRewardsScaled := remainingRewards.MulTruncate(perUnitLiqScalingFactor)
+			remainingRewardsScaled, err := scaleUpTotalEmittedAmount(remainingRewards)
+			if err != nil {
+				ctx.Logger().Info(types.IncentiveOverflowPlaceholderName, "pool_id", poolID, "incentive_id", incentiveRecord.IncentiveId, "time_elapsed", timeElapsed, "emission_rate", incentiveRecordBody.EmissionRate, "error", err.Error())
+				// Silently ignore the truncated incentive record to avoid halting the entire accumulator update.
+				// Continue to the next incentive record.
+				continue
+			}
 			remainingIncentivesPerLiquidity := remainingRewardsScaled.QuoTruncateMut(liquidityInAccum)
 
 			emittedIncentivesPerLiquidity = sdk.NewDecCoinFromDec(incentiveRecordBody.RemainingCoin.Denom, remainingIncentivesPerLiquidity)
@@ -314,7 +326,7 @@ func scaleUpTotalEmittedAmount(totalEmittedAmount osmomath.Dec) (scaledTotalEmit
 
 		if r != nil {
 			telemetry.IncrCounter(1, types.IncentiveOverflowPlaceholderName)
-			err = types.IncentiveOverflowError{
+			err = types.IncentiveScalingFactorOverflowError{
 				PanicMessage: fmt.Sprintf("%v", r),
 			}
 		}
@@ -323,6 +335,31 @@ func scaleUpTotalEmittedAmount(totalEmittedAmount osmomath.Dec) (scaledTotalEmit
 	return totalEmittedAmount.MulTruncate(perUnitLiqScalingFactor), nil
 }
 
+// computeTotalIncentivesToEmit computes the total incentives to emit based on the time elapsed and emission rate.
+// Returns error if timeElapsed or emissionRate are too high, causing overflow during multiplicaiton.
+func computeTotalIncentivesToEmit(timeElapsedSeconds osmomath.Dec, emissionRate osmomath.Dec) (totalEmittedAmount osmomath.Dec, err error) {
+	defer func() {
+		r := recover()
+
+		if r != nil {
+			telemetry.IncrCounter(1, types.IncentiveOverflowPlaceholderName)
+			err = types.IncentiveEmissionOvrflowError{
+				PanicMessage: fmt.Sprintf("%v", r),
+			}
+		}
+	}()
+
+	// This may panic if emissionRate is too high and causes overflow during multiplication
+	// We are unlikely to see an overflow due to too much time elapsing since
+	// 100 years in seconds is roughly
+	// 3.15576e9 * 100 = 3.15576e11
+	// 60 * 60 * 24 * 365 * 100 = 3153600000 seconds
+	// The bit decimal bit length is 2^256 which is arond 10^77
+	// However, it is possible for an attacker to try and create incentives with a very high emission rate
+	// consisting of cheap token in the USD denomination. This is why we have the panic recovery above.
+	return timeElapsedSeconds.MulTruncate(emissionRate), nil
+}
+
 // findUptimeIndex finds the uptime index for the passed in min uptime.
 // Returns error if uptime index cannot be found.
 func findUptimeIndex(uptime time.Duration) (int, error) {

x/concentrated-liquidity/incentives_test.go

@@ -3690,6 +3690,23 @@ func (s *KeeperTestSuite) TestScaledUpTotalIncentiveAmount() {
 	s.Require().ErrorContains(err, "overflow")
 }
 
+// This test shows that it is possible to compute the total incentives to emit without overflow.
+// An error is returned if overflow occurs but no panic.
+func (s *KeeperTestSuite) TestComputeTotalIncentivesToEmit() {
+
+	oneHundredYearsSecs := osmomath.NewDec(int64((time.Hour * 24 * 365 * 100).Seconds()))
+
+	totalIncentiveAmount, err := cl.ComputeTotalIncentivesToEmit(oneHundredYearsSecs, osmomath.NewDec(1))
+	s.Require().NoError(err)
+	s.Require().Equal(osmomath.NewDec(1).Mul(oneHundredYearsSecs), totalIncentiveAmount)
+
+	// The value of 1_000_000_000_000 is hand-picked to be close to the max of 2^256 so that
+	// when multiplied by 100 years, it overflows.
+	_, err = cl.ComputeTotalIncentivesToEmit(oneHundredYearsSecs, oneE60Dec.MulInt64(1_000_000_000_000))
+	s.Require().Error(err)
+	s.Require().ErrorContains(err, "overflow")
+}
+
 // scaleUptimeAccumulators scales the uptime accumulators by the scaling factor.
 // This is to avoid truncation to zero in core logic when the liquidity is large.
 func (s *KeeperTestSuite) scaleUptimeAccumulators(uptimeAccumulatorsToScale []sdk.DecCoins) []sdk.DecCoins {

x/concentrated-liquidity/types/errors.go

@@ -931,10 +931,18 @@ func (e InvalidActionPrefixError) Error() string {
 	return fmt.Sprintf("invalid action prefix (%s). Valid actions: %s", e.ActionPrefix, e.ValidActions)
 }
 
-type IncentiveOverflowError struct {
+type IncentiveScalingFactorOverflowError struct {
 	PanicMessage string
 }
 
-func (e IncentiveOverflowError) Error() string {
+func (e IncentiveScalingFactorOverflowError) Error() string {
 	return fmt.Sprintf("totalEmittedAmount is too high, causing overflow when applying scaling factor: %s", e.PanicMessage)
 }
+
+type IncentiveEmissionOvrflowError struct {
+	PanicMessage string
+}
+
+func (e IncentiveEmissionOvrflowError) Error() string {
+	return fmt.Sprintf("either too much time has passed since last pool update or the emission rate is too high, causing overflow: %s", e.PanicMessage)
+}