fix(payment): prevent Int64 overflow panic in settle-timestamp arithmetic

UpdateStreamRecord and TryResumeStreamRecord computed settle timestamps by
calling Int.Int64() on an unbounded sdkmath.Int. When a stream account's
pay-duration exceeded MaxInt64 seconds (~2.9e11 years) the call panicked with
"Int64() out of bound". Because both functions run inside the storage
EndBlocker with no recover(), the panic was deterministic across every
validator and halted the chain.

Fix: perform the full settle-timestamp expression in sdkmath.Int, then handle
an out-of-range result by intent rather than by call site:

- A user-initiated deposit (positive static-balance change, no rate change)
  that would overflow is rejected with ErrSettleTimestampOverflow — the
  depositor is over-funding past what we can represent and can deposit less.
- Every other path saturates the settle timestamp to math.MaxInt64: forced
  EndBlocker updates (where an error would re-trigger the same halt via
  abci.go "should not happen"), rate decreases from object deletion or
  discontinue, and lazy re-pricing when the SP price falls. The settle
  timestamp is only a scheduling hint for the auto-settle queue and is
  recomputed on the next balance change or bucket touch, so capping it is
  loss-free and never blocks a legitimate object deletion.

Closes MOCA-385

Author: puneet2019

CHANGELOG.md

@@ -66,6 +66,7 @@ Ref: https://keepachangelog.com/en/1.0.0/
 - (app/upgrades) [#289](https://github.com/mocachain/moca/pull/289) Pin v2 feemarket `min_gas_price` to 20 gwei (moca's intended floor) so upgraded chains match genesis.
 - (evm) [#290](https://github.com/mocachain/moca/pull/290) Restore `CallEVM` error-context wrap (method + contract in error message), fix copy-pasted "evil token" comment in `erc721NonTransferable.go`, update stale geth v1.15→v1.16 comments, remove unreachable `AddBalance` blocks in distribution precompile, fix grammar in precompile Run() default cases, and drop dead test-helper expressions.
 - (evm) [#291](https://github.com/mocachain/moca/pull/291) Reject native value sent to precompiles to prevent a balance-reconciliation mint.
+- (x/payment) [MOCA-385] Prevent Int64 overflow panic in `UpdateStreamRecord` and `TryResumeStreamRecord`: settle-timestamp arithmetic is now performed in arbitrary-precision `sdkmath.Int` instead of native `int64`. Only a user-initiated deposit that would push the pay duration past `MaxInt64` is rejected (`ErrSettleTimestampOverflow`) — the depositor can simply deposit less. Every other path (rate decreases from object deletion/discontinue, lazy re-pricing when the SP price falls, and all forced EndBlocker updates) saturates the settle timestamp to `MaxInt64` instead, since it is only a scheduling hint that is recomputed on the next balance change or bucket touch. This keeps a legitimate object deletion from ever being rejected and prevents the EndBlocker from panicking (which would halt the chain).
 - (x/challenge) [#286](https://github.com/mocachain/moca/pull/286) Retire a challenge from the active set once it is attested, making attestation idempotent so duplicate submissions (e.g. redundant relayers or resubmissions by the in-turn submitter) are rejected instead of re-running heartbeat rewards and re-emitting attestation events.
 - (ci) [#65](https://github.com/mocachain/moca/pull/65) Resolve goreleaser CI failures for arm64 docker builds
 - (audit) [#63](https://github.com/mocachain/moca/pull/63) Apply audit fixes

x/payment/keeper/stream_record.go

@@ -2,6 +2,7 @@ package keeper
 
 import (
 	"fmt"
+	"math"
 
 	sdkmath "cosmossdk.io/math"
 	"cosmossdk.io/store/prefix"
@@ -214,7 +215,40 @@ func (k Keeper) UpdateStreamRecord(ctx sdk.Context, streamRecord *types.StreamRe
 				return fmt.Errorf("check and force settle failed, err: %w", err)
 			}
 		}
-		settleTimestamp = currentTimestamp - int64(params.ForcedSettleTime) + payDuration.Int64()
+		settleTimestampFull := sdkmath.NewInt(currentTimestamp).
+			Sub(sdkmath.NewIntFromUint64(params.ForcedSettleTime)).
+			Add(payDuration)
+		if settleTimestampFull.GT(sdkmath.NewInt(math.MaxInt64)) {
+			// The settle timestamp is stored as int64; a pay duration beyond
+			// MaxInt64 seconds (~2.9e11 years) cannot be represented.
+			//
+			// Reject only a user-initiated deposit — a positive static-balance
+			// change with no rate change. That depositor is over-funding past what
+			// we can represent and can simply deposit less. Every other path must
+			// NOT error here:
+			//   - forced EndBlocker updates: returning an error would panic the
+			//     chain in abci.go ("should not happen");
+			//   - rate decreases from object deletion/discontinue, and lazy
+			//     re-pricing when the SP price falls: rejecting a legitimate
+			//     delete/re-price would be wrong.
+			// Those saturate the settle timestamp to MaxInt64. It is only a
+			// scheduling hint for the auto-settle queue and is recomputed on the
+			// next balance change or bucket touch, so capping it is loss-free.
+			isUserDeposit := !forced && change.StaticBalanceChange.IsPositive() && change.RateChange.IsZero()
+			if isUserDeposit {
+				return types.ErrSettleTimestampOverflow.Wrapf(
+					"account %s pay duration %s exceeds int64 range; reduce deposit",
+					streamRecord.Account, payDuration.String())
+			}
+			ctx.Logger().Error("settle timestamp overflow, capping at MaxInt64",
+				"account", streamRecord.Account,
+				"payDuration", payDuration.String(),
+				"forced", forced,
+				"height", ctx.BlockHeight())
+			settleTimestamp = math.MaxInt64
+		} else {
+			settleTimestamp = settleTimestampFull.Int64()
+		}
 	}
 	k.UpdateAutoSettleRecord(ctx, sdk.MustAccAddressFromHex(streamRecord.Account), streamRecord.SettleTimestamp, settleTimestamp)
 	streamRecord.SettleTimestamp = settleTimestamp
@@ -401,7 +435,18 @@ func (k Keeper) TryResumeStreamRecord(ctx sdk.Context, streamRecord *types.Strea
 	}
 
 	prevSettleTime := streamRecord.SettleTimestamp
-	streamRecord.SettleTimestamp = now + streamRecord.StaticBalance.Quo(totalRate.Abs()).Int64() - int64(forcedSettleTime)
+	settleTimestampFull := sdkmath.NewInt(now).
+		Add(streamRecord.StaticBalance.Quo(totalRate.Abs())).
+		Sub(sdkmath.NewIntFromUint64(forcedSettleTime))
+	if settleTimestampFull.GT(sdkmath.NewInt(math.MaxInt64)) {
+		// TryResumeStreamRecord is only reachable from MsgDeposit, never from an
+		// EndBlocker path. Reject the deposit so the caller can choose a smaller
+		// amount rather than silently creating an unrepresentable settle timestamp.
+		return types.ErrSettleTimestampOverflow.Wrapf(
+			"account %s: deposit would fund account beyond the representable future; reduce deposit",
+			streamRecord.Account)
+	}
+	streamRecord.SettleTimestamp = settleTimestampFull.Int64()
 	streamRecord.BufferBalance = expectedBalanceToResume
 	streamRecord.StaticBalance = streamRecord.StaticBalance.Sub(expectedBalanceToResume)
 	streamRecord.CrudTimestamp = now

x/payment/keeper/stream_record_test.go

@@ -2,6 +2,7 @@ package keeper_test
 
 import (
 	"errors"
+	"math"
 	"testing"
 	"time"
 
@@ -826,6 +827,185 @@ func TestSettleStreamRecord(t *testing.T) {
 	require.Equal(t, userStreamRecord2.CrudTimestamp, streamRecord.CrudTimestamp+seconds)
 }
 
+// TestUpdateStreamRecord_SettleTimestampOverflow_ForcedSaturates reproduces the
+// original chain-halt: a forced EndBlocker update (ForceDeleteObject during
+// discontinue) decreases the netflow rate on a large-balance account, pushing
+// payDuration past MaxInt64. The EndBlocker cannot surface an error (abci.go
+// panics on any error from DeleteDiscontinueObjectsUntil), so the settle
+// timestamp must saturate to MaxInt64 instead of overflowing.
+func TestUpdateStreamRecord_SettleTimestampOverflow_ForcedSaturates(t *testing.T) {
+	k, ctx, _ := makePaymentKeeper(t)
+	ctx = ctx.WithBlockTime(time.Unix(1000, 0))
+	ctx = ctx.WithValue(types.ForceUpdateStreamRecordKey, true)
+
+	params := k.GetParams(ctx)
+	// Buffer reserved for the starting rate (-2); after the rate drops to -1 the
+	// buffer recomputes to 1×ReserveTime. payDuration overflows either way.
+	bufferBalance := sdkmath.NewIntFromUint64(params.VersionedParams.ReserveTime).MulRaw(2)
+
+	user := sample.RandAccAddress()
+	sr := &types.StreamRecord{
+		Account:           user.String(),
+		Status:            types.STREAM_ACCOUNT_STATUS_ACTIVE,
+		StaticBalance:     sdkmath.NewIntFromUint64(math.MaxUint64),
+		BufferBalance:     bufferBalance,
+		LockBalance:       sdkmath.ZeroInt(),
+		NetflowRate:       sdkmath.NewInt(-2),
+		FrozenNetflowRate: sdkmath.ZeroInt(),
+		CrudTimestamp:     ctx.BlockTime().Unix(),
+	}
+
+	// Forced rate decrease (-2 → -1), as when an object is force-deleted.
+	change := types.NewDefaultStreamRecordChangeWithAddr(user).WithRateChange(sdkmath.NewInt(1))
+	require.NotPanics(t, func() {
+		err := k.UpdateStreamRecord(ctx, sr, change)
+		require.NoError(t, err, "forced path must not return an error (would panic EndBlocker)")
+	})
+	require.Equal(t, int64(math.MaxInt64), sr.SettleTimestamp,
+		"forced overflow must saturate to MaxInt64, not panic")
+}
+
+// TestUpdateStreamRecord_SettleTimestampOverflow_UserDepositRejected covers the
+// user-initiated deposit path: a positive static-balance change with no rate
+// change that pushes payDuration past MaxInt64 is rejected with
+// ErrSettleTimestampOverflow, so the depositor can simply deposit less. This is
+// the one path where the degenerate state is genuinely user-created.
+func TestUpdateStreamRecord_SettleTimestampOverflow_UserDepositRejected(t *testing.T) {
+	k, ctx, _ := makePaymentKeeper(t)
+	ctx = ctx.WithBlockTime(time.Unix(1000, 0))
+	// No ForceUpdateStreamRecordKey → forced=false (user-initiated path).
+
+	params := k.GetParams(ctx)
+	bufferBalance := sdkmath.NewIntFromUint64(params.VersionedParams.ReserveTime)
+
+	user := sample.RandAccAddress()
+	sr := &types.StreamRecord{
+		Account:           user.String(),
+		Status:            types.STREAM_ACCOUNT_STATUS_ACTIVE,
+		StaticBalance:     sdkmath.NewIntFromUint64(math.MaxUint64),
+		BufferBalance:     bufferBalance,
+		LockBalance:       sdkmath.ZeroInt(),
+		NetflowRate:       sdkmath.NewInt(-1),
+		FrozenNetflowRate: sdkmath.ZeroInt(),
+		CrudTimestamp:     ctx.BlockTime().Unix(),
+	}
+
+	// A real deposit: positive static-balance change, no rate change.
+	change := types.NewDefaultStreamRecordChangeWithAddr(user).
+		WithStaticBalanceChange(sdkmath.NewInt(1_000))
+	err := k.UpdateStreamRecord(ctx, sr, change)
+	require.ErrorIs(t, err, types.ErrSettleTimestampOverflow,
+		"a deposit that overflows the settle timestamp must be rejected")
+}
+
+// TestUpdateStreamRecord_SettleTimestampOverflow_RateDecreaseSaturates covers a
+// non-forced rate decrease — a user MsgDeleteObject, or lazy re-pricing when the
+// SP price falls. Removing rate increases payDuration and can overflow int64, but
+// this is a legitimate action (not over-funding), so it must NOT be rejected: the
+// settle timestamp saturates to MaxInt64 and the operation succeeds. This is the
+// asymmetry B fixes — a user can always delete their own object.
+func TestUpdateStreamRecord_SettleTimestampOverflow_RateDecreaseSaturates(t *testing.T) {
+	k, ctx, _ := makePaymentKeeper(t)
+	ctx = ctx.WithBlockTime(time.Unix(1000, 0))
+	// No ForceUpdateStreamRecordKey → forced=false (user-initiated path).
+
+	params := k.GetParams(ctx)
+	bufferBalance := sdkmath.NewIntFromUint64(params.VersionedParams.ReserveTime).MulRaw(2)
+
+	user := sample.RandAccAddress()
+	sr := &types.StreamRecord{
+		Account:           user.String(),
+		Status:            types.STREAM_ACCOUNT_STATUS_ACTIVE,
+		StaticBalance:     sdkmath.NewIntFromUint64(math.MaxUint64),
+		BufferBalance:     bufferBalance,
+		LockBalance:       sdkmath.ZeroInt(),
+		NetflowRate:       sdkmath.NewInt(-2),
+		FrozenNetflowRate: sdkmath.ZeroInt(),
+		CrudTimestamp:     ctx.BlockTime().Unix(),
+	}
+
+	// Rate decrease (-2 → -1), as when a user deletes an object. No static-balance
+	// change, so this is not a user deposit and must not be rejected.
+	change := types.NewDefaultStreamRecordChangeWithAddr(user).WithRateChange(sdkmath.NewInt(1))
+	require.NotPanics(t, func() {
+		err := k.UpdateStreamRecord(ctx, sr, change)
+		require.NoError(t, err, "a legitimate rate decrease must not be rejected")
+	})
+	require.Equal(t, int64(math.MaxInt64), sr.SettleTimestamp,
+		"rate-decrease overflow must saturate to MaxInt64, not reject")
+}
+
+// TestTryResumeStreamRecord_SettleTimestampInt64Overflow covers the Deposit
+// path to a frozen account. TryResumeStreamRecord is only reachable from
+// MsgDeposit (never from an EndBlocker), so an overflow must be rejected with
+// ErrSettleTimestampOverflow; the user should reduce their deposit amount.
+func TestTryResumeStreamRecord_SettleTimestampInt64Overflow(t *testing.T) {
+	k, ctx, _ := makePaymentKeeper(t)
+	ctx = ctx.WithBlockTime(time.Unix(1000, 0))
+
+	user := sample.RandAccAddress()
+	sr := &types.StreamRecord{
+		Account:           user.String(),
+		Status:            types.STREAM_ACCOUNT_STATUS_FROZEN,
+		StaticBalance:     sdkmath.ZeroInt(),
+		BufferBalance:     sdkmath.ZeroInt(),
+		LockBalance:       sdkmath.ZeroInt(),
+		NetflowRate:       sdkmath.ZeroInt(),
+		FrozenNetflowRate: sdkmath.NewInt(-1),
+		OutFlowCount:      1,
+	}
+	k.SetStreamRecord(ctx, sr)
+
+	deposit := sdkmath.NewIntFromUint64(math.MaxUint64)
+	err := k.TryResumeStreamRecord(ctx, sr, deposit)
+	require.ErrorIs(t, err, types.ErrSettleTimestampOverflow,
+		"deposit that overflows settle timestamp must be rejected, not silently absorbed")
+}
+
+// TestUpdateStreamRecord_SettleTimestampSilentWrap catches the secondary overflow:
+// even when payDuration < MaxInt64 (so Int64() would not have panicked), the full
+// expression currentTimestamp - forcedSettleTime + payDuration can itself overflow
+// int64 and silently wrap to a large negative value. A negative settle timestamp
+// makes the account look overdue and drives repeated force-settle attempts.
+func TestUpdateStreamRecord_SettleTimestampSilentWrap(t *testing.T) {
+	k, ctx, _ := makePaymentKeeper(t)
+	params := k.GetParams(ctx)
+	reserveTime := sdkmath.NewIntFromUint64(params.VersionedParams.ReserveTime)
+
+	timestamp := int64(1_000_000_000)
+	ctx = ctx.WithBlockTime(time.Unix(timestamp, 0))
+	ctx = ctx.WithValue(types.ForceUpdateStreamRecordKey, true)
+
+	// payDuration = MaxInt64 - 500 fits in int64, so Int64() would not panic
+	// pre-fix. But timestamp + payDuration - forcedSettleTime overflows int64.
+	payDuration := sdkmath.NewInt(math.MaxInt64).SubRaw(500)
+	// With |rate|=1 and bufferBal=reserveTime: staticBal = payDuration - reserveTime.
+	staticBal := payDuration.Sub(reserveTime)
+	bufferBal := reserveTime
+
+	user := sample.RandAccAddress()
+	sr := &types.StreamRecord{
+		Account:           user.String(),
+		Status:            types.STREAM_ACCOUNT_STATUS_ACTIVE,
+		StaticBalance:     staticBal,
+		BufferBalance:     bufferBal,
+		LockBalance:       sdkmath.ZeroInt(),
+		NetflowRate:       sdkmath.NewInt(-1),
+		FrozenNetflowRate: sdkmath.ZeroInt(),
+		CrudTimestamp:     timestamp,
+	}
+
+	change := types.NewDefaultStreamRecordChangeWithAddr(user)
+	require.NotPanics(t, func() {
+		err := k.UpdateStreamRecord(ctx, sr, change)
+		require.NoError(t, err)
+	})
+	require.Equal(t, int64(math.MaxInt64), sr.SettleTimestamp,
+		"settle timestamp must saturate to MaxInt64 when full expression overflows int64")
+	require.Greater(t, sr.SettleTimestamp, int64(0),
+		"settle timestamp must not silently wrap to negative")
+}
+
 func TestAutoForceSettle(t *testing.T) {
 	keeper, ctx, depKeepers := makePaymentKeeper(t)
 	t.Logf("depKeepers: %+v", depKeepers)

x/payment/types/errors.go

@@ -20,4 +20,5 @@ var (
 	ErrIncorrectWithdrawAmount            = errorsmod.Register(ModuleName, 1211, "the withdrawal amount is not equal to the delayed one")
 	ErrNotReachTimeLockDuration           = errorsmod.Register(ModuleName, 1212, "the withdrawal does not reach to the delayed duration")
 	ErrExistsDelayedWithdrawal            = errorsmod.Register(ModuleName, 1213, "delayed withdrawal already exists")
+	ErrSettleTimestampOverflow            = errorsmod.Register(ModuleName, 1214, "settle timestamp overflow: deposit would fund the account beyond the representable future")
 )