fix: validate hotkey registration on specific subnet in serve_axon and serve_prometheus#2545
Open
fix: validate hotkey registration on specific subnet in serve_axon and serve_prometheus#2545
Conversation
… in the share pool
…-for-ledger-support Enable `metadata-hash` feature in localnet builds
Add balances to validators on chainspec clone.
Fixes failing types generation for e2e tests
Revert pr 2445
Introduce eco-tests
…hip workflow Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…d serve_prometheus - serve_axon and serve_prometheus now check is_hotkey_registered_on_network(netuid, ...) instead of is_hotkey_registered_on_any_network, preventing hotkeys from setting axon info on subnets they are not registered on - Add migrate_remove_orphan_axon_prom_cert_v2 migration to clean up 243 orphaned entries found on mainnet (242 orphaned Axons + 1 orphaned NeuronCertificate across 41 subnets) - Add 3 new serving tests and 1 migration test
Replace saturating_add with + in migration test to comply with the custom lint that bans safe math in tests (to encourage panics on bugs).
ppolewicz
added
the
skip-cargo-audit
…tion check before IP validation in prometheus; fix migration test setup - Remove redundant `validate_axon_data` call in `do_serve_axon` (already called earlier) - Move registration check before IP validation in `do_serve_prometheus` - Add `target: "runtime"` to migration log in migrate_remove_orphan_axon_prom_cert_v2 - Fix migration test: update setup_for args and matching assert - Use saturating_add in migration test - Add test_serve_axon_with_cert_rejects_unregistered_hotkey test
…et; fix doc comments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
serve_axonandserve_prometheususedis_hotkey_registered_on_any_networkinstead ofis_hotkey_registered_on_network(netuid, ...), allowing a hotkey registered on any subnet to serve axon/prometheus info on a subnet it is not actually registered onnetuidmigrate_remove_orphan_axon_prom_cert_v2migration to clean up the 243 orphanedAxons/NeuronCertificatesentries that accumulated on mainnet due to this bug (confirmed via mainnet state inspection script)Details
Bug:
validate_serve_axonanddo_serve_prometheusboth calledis_hotkey_registered_on_any_network, so a hotkey registered on subnet 3 could callserve_axonfor subnet 7, writing garbage entries intoAxons,Prometheus, andNeuronCertificatesfor a subnet it had no uid on.Fix: Both checks now call
is_hotkey_registered_on_network(netuid, hotkey)which checksUids::contains_key(netuid, hotkey).Migration: A mainnet inspection script (
scripts/inspect_orphan_axons.py) found 243 orphaned entries across 41 subnets. This is well within migration safety limits (threshold: 1 000). The migrationmigrate_remove_orphan_axon_prom_cert_v2clears them identically to the earliermigrate_remove_unknown_neuron_axon_cert_prommigration but with a newHasMigrationRunkey so it runs again.Test plan
test_serve_axon_rejects_hotkey_registered_on_other_network— hotkey on subnet 1 cannot serve axon on subnet 2test_serve_axon_requires_registration_on_target_network— hotkey on correct subnet succeedstest_serve_prometheus_rejects_hotkey_registered_on_other_network— same guard for prometheustest_migrate_remove_orphan_axon_prom_cert_v2— migration cleans orphaned entries and is idempotent🤖 Generated with Claude Code