fix(accounts): normalize address in raw-SQL balance operations by Alicepoltora · Pull Request #1773 · genlayerlabs/genlayer-studio

Alicepoltora · 2026-09-22T13:05:43Z

Problem

Account rows are keyed by the checksummed address: create_new_account_with_address() and get_account() run every address through to_checksum_address(). But the raw-SQL balance paths — debit_account_balance(), credit_account_balance(), credit_tx_value_once() — used the address verbatim.

Any caller passing a non-checksummed address (e.g. lowercase, as users commonly send in JSON-RPC — see _sandbox_debit_sender in endpoints.py):

credit_account_balance(lower_addr): INSERT ... ON CONFLICT (id) DO NOTHING does not conflict with the checksummed row → creates a duplicate account row keyed by the lowercase address, and the credit lands on that duplicate. Balance gets split across two rows for the same address.
debit_account_balance(lower_addr): WHERE id = lower_addr matches nothing → silently returns False (insufficient balance) even though the account has funds.
refund_tx_value(): credits the refund to the lowercase duplicate row instead of the sender's real account.

Fix

Added _normalize_address() (checksum with the same fallback-on-error semantics that get_account() already used) and applied it to every raw-SQL balance path.

Tests

New tests/unit/test_accounts_manager_normalization.py (mocked session, no DB needed):

test_credit_normalizes_address_before_insert_and_update and test_debit_normalizes_address and test_credit_tx_value_once_normalizes_target — fail on main, pass with the fix
test_credit_zero_or_negative_amount_is_noop — no-op behavior preserved
test_normalize_fallback_keeps_original — non-address values pass through unchanged (backwards compatibility)

Summary by CodeRabbit

Bug Fixes
- Improved account address handling so balance queries and updates consistently use checksummed addresses.
- Preserved the original address when checksum conversion is not possible.
- Prevented database updates for zero or negative credit amounts.

debit_account_balance(), credit_account_balance() and credit_tx_value_once() execute raw SQL keyed by the address, but unlike get_account()/create_new_account_with_address() they never passed the address through to_checksum_address(). Accounts are stored keyed by the checksummed id, so a caller passing a lowercase address (e.g. from a JSON-RPC 'from' field) would: - debit_account_balance(): match no row and silently return False even when the account has sufficient balance; - credit_account_balance(): hit ON CONFLICT DO NOTHING on the checksummed row's id and instead INSERT a new duplicate row keyed by the lowercase address, splitting the balance across two accounts; - refund_tx_value(): credit the refund onto the lowercase duplicate row, losing the funds from the sender's perspective. _normalize_address() centralizes the to_checksum_address() normalization with the same fallback-on-error semantics get_account() already used, and is applied to every raw-SQL balance path. Unit tests (no DB required) verify the SQL parameters are normalized and that non-address values are passed through unchanged.

github-actions · 2026-09-22T13:05:56Z

This PR targeted main, which is only the default/static branch.

I retargeted it to v0.123-dev, the active development branch. Pushes to v0.123-dev automatically fast-forward main.

coderabbitai · 2026-09-22T13:06:00Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 99ed3ec2-97e4-442f-a8f2-938fcaf570bd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

# Conflicts: # backend/database_handler/accounts_manager.py

danieljrc888 · 2026-10-21T15:36:05Z

Thanks! Since this was opened, #1748 added inline checksumming to debit_account_balance and credit_account_balance, which conflicted here. I merged current v0.123-dev into the branch (e6da79fe) and resolved it by keeping your _normalize_address helper for all three methods and dropping the duplicate inline try/except. The part still missing on dev was credit_tx_value_once (used by sim_fundAccount and the consensus activation credit), and your test proves it. tests/unit/: 1677 passed, 7 skipped.

danieljrc888

Reviewed for the v0.123 release candidate; unit suite and CI green.

danieljrc888 · 2026-10-21T20:40:50Z

/run-e2e all

Frozen landing cut: #1773 alone, head a91e6bbfedbdc74f8dca1cbcd489192959c6a662 over v0.123-dev@e59ddfbaa15f19a2d856f184e3e27a30c3007cb2; no cross-repository Depends-On. Full component and stack coverage (no stack selector). Native CI is green. Merge is authorized once this E2E is green.

Lands four reviewed fork PRs together after a full E2E run on this exact head: - #1765: redact validator private keys from call receipts and explorer payloads - #1715: bind postgres, redis and ollama host ports to loopback - #1773: normalize addresses in raw-SQL balance operations - #1789: normalize the address in sim_fundAccount Co-authored-by: Kanan <93033289+kriss39@users.noreply.github.com> Co-authored-by: Starling <82058629+Starling-spell@users.noreply.github.com> Co-authored-by: Alicepoltora <Alicepoltora@users.noreply.github.com>

danieljrc888 · 2026-10-21T22:48:19Z

Landed in v0.123-dev via #1797 (squash 9e907cd), which combined #1765, #1715, #1773 and #1789 at their reviewed heads and passed full E2E. Your commits are credited with Co-authored-by. Thanks for the fix!

github-actions Bot changed the base branch from main to v0.123-dev September 22, 2026 13:05

Merge remote-tracking branch 'origin/v0.123-dev' into prep/1773

e6da79f

# Conflicts: # backend/database_handler/accounts_manager.py

danieljrc888 mentioned this pull request Oct 21, 2026

fix: normalize address in sim_fundAccount #1789

Closed

style: apply black to accounts manager normalization test

a91e6bb

danieljrc888 approved these changes Oct 21, 2026

View reviewed changes

danieljrc888 mentioned this pull request Oct 21, 2026

chore(release): v0.123 RC fixes (#1765, #1715, #1773, #1789) #1797

Merged

This was referenced Oct 21, 2026

fix(rpc): redact validator private keys from call receipts and explorer payloads #1765

Closed

fix(security): bind postgres to loopback #1715

Closed

danieljrc888 closed this Oct 21, 2026

Navigation Menu

Repository navigation

fix(accounts): normalize address in raw-SQL balance operations - #1773

fix(accounts): normalize address in raw-SQL balance operations#1773
Alicepoltora wants to merge 3 commits into
genlayerlabs:v0.123-devfrom
Alicepoltora:fix/account-balance-address-normalization

Alicepoltora commented Sep 22, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

coderabbitai Bot commented Sep 22, 2026 •

edited

Loading

Review skipped

Uh oh!

danieljrc888 commented Oct 21, 2026

Uh oh!

danieljrc888 left a comment

Uh oh!

danieljrc888 commented Oct 21, 2026

Uh oh!

danieljrc888 commented Oct 21, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Alicepoltora commented Sep 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Fix

Tests

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Sep 22, 2026

Uh oh!

coderabbitai Bot commented Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

danieljrc888 commented Oct 21, 2026

Uh oh!

danieljrc888 left a comment

Choose a reason for hiding this comment

Uh oh!

danieljrc888 commented Oct 21, 2026

Uh oh!

danieljrc888 commented Oct 21, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Alicepoltora commented Sep 22, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Sep 22, 2026 •

edited

Loading