Issues · cube-btc/cube · GitHub

Labels Milestones

[flame_manager] Lock-ordering / TOCTOU hazard: CoinManager locked twice, Registry locked inside CoinManager hold

#21

· GideonBature opened

on Jun 18, 2026

[privileges_manager] Setter/getter asymmetry: setters ignore ephemeral registrations (cannot configure a just-registered account in one execution)

#20

· GideonBature opened

on Jun 18, 2026

[inscriptive] Inconsistent lifecycle contract (delta flush) and endianness across managers

#19

· GideonBature opened

on Jun 18, 2026

[registry] Call-counter update can overflow; rank lookups by key are O(n)

#18

· GideonBature opened

on Jun 18, 2026

[privileges_manager] `PeriodicResource` refill add can overflow (no checked arithmetic in fee-metering path)

#17

· GideonBature opened

on Jun 18, 2026

[params_manager] Uses `std::sync::Mutex` while every other manager uses `tokio::sync::Mutex` (deadlock risk across `.await`)

#16

· GideonBature opened

on Jun 18, 2026

[flame_manager] Blind overwrite of flame vec at a height in `apply_changes` (memory/disk divergence)

#15

· GideonBature opened

on Jun 18, 2026

[inscriptive] Several managers silently swallow sled iteration errors at construction (partial loads)

#14

· GideonBature opened

on Jun 17, 2026

[inscriptive] `apply_changes` is non-atomic and not rollback-safe across all managers

#13

· GideonBature opened

on Jun 17, 2026

[flame_manager] Greedy flame selector can emit an unbounded number of flames + sum-loop overflow

#12

· GideonBature opened

on Jun 17, 2026

[flame_manager] `FlameTier` variant names are mislabeled (off by 10x for tiers 3/4/5)

#11

· GideonBature opened

on Jun 17, 2026

[coin_manager] Missing overflow protection on `account_balance_up` / `contract_balance_up`

#10

· GideonBature opened

on Jun 16, 2026