Skip to content

fix(zetatool): refuse incomplete staking and distribution input in snapshot - #4647

Merged
kingpinXD merged 5 commits into
feat/snapshot-exportfrom
fix/snapshot-staking-completeness
Oct 15, 2026
Merged

kingpinXD merged 5 commits into
feat/snapshot-exportfrom
fix/snapshot-staking-completeness

Conversation

@kingpinXD

@kingpinXD kingpinXD commented Oct 15, 2026 •

Copy link
Copy Markdown
Member

Summary

  • zetatool snapshot now refuses an export it can't fully account for. Delegation shares must add up per validator, both staking pools must match exactly (the same rule the SDK applies on genesis import), and distribution must be in zero-height state, with the module holding only the community pool. These are hard errors, so --supply-check=false doesn't turn them off.
  • The summary now splits the remainder by category. The H17619782 mainnet export still passes, and its snapshot_db.csv comes out byte-identical (sha256 bd62b8bd…ecb93).

Part of #4646 (SNAP-01). Targets feat/snapshot-export (#4613), not main.

RetriggerView in GreptileConfidence Score: 4/5

The PR appears safe to merge, with a non-blocking correction needed in the flag documentation.

Findings

  1. P2 The flag promises too much ▶
Fix with agent prompt
### Issue 1
contrib/snapshot/README.md:138-139
`--supply-check=false` no longer downgrades all four checks listed here. `finalize` now rejects a bank-balance/supply mismatch before the command writes output or reaches `runChecks`. Operators following this paragraph will get an error instead of diagnostic files. Update this paragraph and the acceptance list to name that hard error.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This PR adds hard checks before building the migration snapshot.

  • Snapshot exports stop when staking or reward records do not add up.
  • The snapshot shows what makes up its migration remainder.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Read bank, staking, and distribution] --> B[Check distribution rewards and balance]
  B --> C[Check delegation totals and staking pools]
  C --> D[Attribute balances and classify remainder]
  D --> E[Check supply and remainder categories]
  E --> F[Write CSV files]
  F --> G[Run optional output checks]
  G --> H[Print summary]
Loading

Reviews (1) · Last reviewed commit: "fix(zetatool): name a supply mismatch an..." · Reviewed by Greptile

kingpinXD and others added 3 commits October 15, 2026 00:53
…apshot

The snapshot now reads distribution and refuses, as hard errors that
--supply-check=false cannot skip:
- unpaid rewards or commission, or a distribution module balance other
  than the community pool
- staking records that do not add up: share sums, duplicates, unknown
  validators, invalid status, negative values, excess share dust
- staking pools that do not exactly match validator tokens and
  unbonding entries
- a pin on a staking pool, or a remainder its categories do not explain

The summary prints the remainder by category and the 18->9 conversion
dust. Attribution and the CSV output are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
--for-zero-height and the distribution module are now required by
zetatool snapshot, so the README and the export script say so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…precedence

- Compute refuses a bank supply that differs from the sum of bank
  balances with its own message. The remainder identity check is now a
  backstop, tested through finalize directly.
- A test pins the zero address and a module account, and checks the pin
  wins over both categories.
- The summary's non-std line says its amount is liquid only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@kingpinXD
kingpinXD requested a review from a team as a code owner October 15, 2026 05:08
Comment thread contrib/snapshot/README.md Resolved

@usmaneth usmaneth left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

solid. the pool checks match what the sdk enforces on genesis import, and i walked the remainder categories against supply by hand - pools cancel against validator tokens + unbonding entries, so the backstop really is a backstop. lint red is just golangci timing out on the schema fetch, not the code.

@morde08 morde08 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One documentation issue remains, also flagged by Greptile. I found no additional correctness issues in the changed code. Validated the pool accounting against the pinned Cosmos SDK implementation and ran go test ./cmd/zetatool/snapshot ./cmd/zetatool/cli successfully. CI still has a missing-changelog failure and a lint schema-download timeout.

Comment thread contrib/snapshot/README.md Resolved
kingpinXD and others added 2 commits October 15, 2026 11:13
--supply-check=false now downgrades only three output checks. The bank
sum vs supply check fails in Compute before anything is written, so the
README, the command help and the flag help say so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@kingpinXD
kingpinXD merged commit b9b0ea5 into feat/snapshot-export Oct 15, 2026
45 checks passed
@kingpinXD
kingpinXD deleted the fix/snapshot-staking-completeness branch October 15, 2026 17:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants