Subnet sale offer#2745
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
🛡️ AI Review — Skeptic (security review)VERDICT: VULNERABLE BASELINE scrutiny: l0r1s has write permission, an established account, substantial prior contribution history, and no trusted Gittensor allowlist match. Branch subnet-sale-offer -> devnet-ready. No Findings
Prior-comment reconciliation
ConclusionThe diff does not look malicious, but the sale guard can still strand a seller whose coldkey is also the subnet owner hotkey by blocking the only non-root cancellation path. 📜 Previous run (superseded)
# 🔍 AI Review — Auditor (domain review) has not yet run on this PR. |
|
🔄 AI review updated — Skeptic: VULNERABLE |
| return Err(Error::<T>::ColdkeyLockedDuringSale.into()); | ||
| } | ||
|
|
||
| if is_sale_frozen_owner_hotkey && !is_mev_protected { |
There was a problem hiding this comment.
[MEDIUM] Seller cannot cancel when coldkey is also owner hotkey
Creating an offer freezes both the seller coldkey and the current owner hotkey. If those are the same account, the earlier coldkey branch allows cancel_sale_offer, but this owner-hotkey branch immediately rejects the same cancellation with HotkeyLockedDuringSale. The existing owner-hotkey setter only rejects system accounts, so this state is reachable and leaves the seller unable to cancel without root intervention. Let cancel_sale_offer pass this branch too; do_cancel_sale_offer still enforces that a signed caller must be the offer seller.
| if is_sale_frozen_owner_hotkey && !is_mev_protected { | |
| if is_sale_frozen_owner_hotkey && !is_sale_cancel && !is_mev_protected { |
|
🔄 AI review updated — Skeptic: VULNERABLE |
l0r1s
requested review from
JohnReedV,
evgeny-s,
gztensor,
open-junius and
sam0x17
| return Err(Error::<T>::ColdkeyLockedDuringSale.into()); | ||
| } | ||
|
|
||
| if is_sale_frozen_owner_hotkey && !is_mev_protected { |
There was a problem hiding this comment.
[MEDIUM] Seller cannot cancel when coldkey is also owner hotkey
do_create_sale_offer allows seller == owner_hotkey, then freezes the same account in both maps. For that account, cancel_sale_offer passes the coldkey check but is rejected here as a frozen owner hotkey, leaving the seller unable to use the only non-root cancellation path while both keys remain frozen. Let sale cancellation pass this guard too; do_cancel_sale_offer already enforces that only the seller or root can actually cancel.
| if is_sale_frozen_owner_hotkey && !is_mev_protected { | |
| if is_sale_frozen_owner_hotkey && !is_sale_cancel && !is_mev_protected { |
|
🔄 AI review updated — Skeptic: VULNERABLE |
1 participant
Summary
This PR adds subnet sale offers to the Subtensor pallet.
The goal is to let a subnet owner announce that a subnet is for sale, optionally restricted to a specific buyer coldkey. Once an offer exists, a later crowdloan lease flow can target that offer, pay the seller, and transform the subnet into a lease atomically.
Creating an offer stores the sale terms by
netuidand freezes the seller coldkey and current subnet owner hotkey while the offer is active. This prevents the seller from mutating the relevant accounts during the sale process. The seller or root can cancel the offer, and sale-offer state is also cleaned up if the subnet is removed.The PR also adds a
CheckSubnetSaledispatch extension so frozen sale accounts are rejected at dispatch time. Seller coldkeys may still cancel their sale offer, owner hotkeys are blocked unless the call is MEV-protected, and root bypasses the guard.