Harden FRAME primitives against audit findings#616

Merged

illuzen merged 21 commits into

mainfrom

illuzen/frame-fixes

Jul 3, 2026

Commits on Jul 2, 2026

check zk root on import
illuzen
committed
Only inject the outer arguments if the inner attribute does not specify its own
illuzen
committed
max dev accounts
illuzen
committed
Bound RemovePallet/RemoveStorage deletion to prevent upgrade-time chain halt

illuzen
and
cursoragent
committed
Add bounded move_prefix_bounded to stage attacker-growable prefix moves

illuzen
and
cursoragent
committed
Check issuance headroom in Balanced::deposit before crediting account

illuzen
and
cursoragent
committed
Reject nonce increments that overflow instead of wrapping to zero

illuzen
and
cursoragent
committed
Allow ensure_frozen/decrease_frozen on permitted over-freezes without balance check

illuzen
and
cursoragent
committed
Use decode_all for Callback::curry and typed NFT attribute reads

illuzen
and
cursoragent
committed
Fix ration denominator overflow and reject invalid SplitTwoWays configs at compile time

illuzen
and
cursoragent
committed
Propagate actual transfer debit and burn approved-transfer reaping dust

illuzen
and
cursoragent
committed
fix tests
illuzen
committed
fmt
illuzen
committed
Tolerate bounded key remainder in RemovePallet/RemoveStorage try-runtime checks

illuzen
and
cursoragent
committed

Commits on Jul 3, 2026