Skip to content

Conversation

@fnando
Copy link
Member

@fnando fnando commented Jan 16, 2026

What

Adds a warning during stellar contract build when overflow-checks is not enabled in the Cargo.toml profile.

$ stellar contract build
⚠️ `overflow-checks` is not enabled for profile `release`. To prevent silent integer overflow, add `overflow-checks = true` to [profile.release] in your Cargo.toml.
ℹ️ CARGO_BUILD_RUSTFLAGS=--remap-path-prefix=/Users/fnando/.cargo/registry/src= cargo rustc --manifest-path=contracts/hello-world/Cargo.toml --crate-type=cdylib --target=wasm32v1-none --release
   Compiling proc-macro2 v1.0.101
   Compiling unicode-ident v1.0.19
   ...

Why

Close #2281

Known limitations

N/A

@fnando fnando requested a review from a team as a code owner January 16, 2026 21:17
Copilot AI review requested due to automatic review settings January 16, 2026 21:17
@github-project-automation github-project-automation bot moved this to Backlog (Not Ready) in DevX Jan 16, 2026
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds a build-time warning when overflow-checks is not enabled in the Cargo.toml profile, helping developers avoid silent integer overflow vulnerabilities in smart contracts. The warning is displayed during stellar contract build and provides clear guidance on how to fix the configuration.

Changes:

  • Added overflow-checks validation logic that inspects Cargo.toml and follows profile inheritance chains
  • Integrated warning display into the build process (only when actually building, not with --print-commands-only)
  • Added comprehensive test coverage for various scenarios including missing checks, enabled checks, profile inheritance, and edge cases

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
cmd/soroban-cli/src/commands/contract/build.rs Implements overflow-checks validation with run_checks() and check_overflow_checks() functions that parse Cargo.toml, follow profile inheritance, and emit warnings when overflow-checks is not enabled
cmd/crates/soroban-test/tests/it/build.rs Adds 5 comprehensive test cases covering warning presence/absence scenarios, profile inheritance behavior, and --print-commands-only flag behavior

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Backlog (Not Ready)

Development

Successfully merging this pull request may close these issues.

Warn during build if overflow-checks are off in Cargo.toml

2 participants