fix(security): audit fixes across 9 custom pallets

- pez-rewards: checked arithmetic in parliamentary reward distribution
- tiki: saturating_add in get_tiki_score fold, benchmarking cleanup
- ping: saturating_add on PingCount
- staking-score: saturating_mul on 4 duration multipliers
- pez-treasury: proper error on TreasuryStartBlock None, saturating_add on NextReleaseMonth, doc fix 70->75%
- messaging: InboxOverflow event on FIFO eviction
- token-wrapper: reorder wrap/unwrap operations, add pallet balance pre-check
- welati: u64 cast for turnout percentage overflow prevention
- presale: fix refund calculation to use net_in_treasury (98%) instead of impossible 99%, update tests
This commit is contained in:
2026-03-22 18:56:37 +03:00
parent fe49037cbe
commit 896f94ca97
13 changed files with 148 additions and 54 deletions
@@ -400,7 +400,8 @@ pub mod pezpallet {
.saturating_add(perwerde_u128.saturating_mul(300))
.saturating_add(tiki_u128.saturating_mul(300));
let final_score_u128 = staking_u128
// Safe: both operands are derived from u32 scores, product fits in u128
let final_score_u128 = staking_u128
.saturating_mul(weighted_sum)
.checked_div(base)
.ok_or(Error::<T>::CalculationOverflow)?;