crates/minibf/src/routes/epochs/mod.rs (2)

35-38: Avoid silently defaulting protocol params; prefer explicit error or a deliberate fallback.

Using unwrap_or_default() can emit a zeroed/default parameter set, which may misrepresent the network. Consider returning 404/500 when no live params exist, or use a documented fallback (e.g., current effective params) with an explicit comment.
Also, params use live() while nonce still reads active; please confirm this mismatch is intentional for epoch timing.

---

60-66: Same defaulting concern for historical parameters.

by_number_parameters now also defaults to an empty param set when live() is None. Prefer explicit error or a documented fallback to avoid serving incorrect values. Verify if nonce should also be based on live() here for consistency.

crates/minibf/src/lib.rs (1)

123-126: Semantics check: is prior_epoch.live() the correct source for “effective in epoch E”?

If logs capture both “live” and “scheduled next,” retrieving effective params for epoch E via prior_epoch.live() may be off by one depending on model semantics. Please confirm whether prior.next (or equivalent) is the intended source. Also, avoid unwrap_or_default() here to prevent silently returning bogus params; prefer an explicit error or well-documented fallback.

crates/minibf/src/routes/pools.rs (2)

69-94: Default numeric strings to "0" instead of empty string.

declared_pledge and fixed_cost currently default to "". Prefer "0" to match typical Blockfrost numeric-as-string conventions and avoid surprising clients.

Apply this diff:

-            declared_pledge: params
-                .as_ref()
-                .map(|x| x.pledge.to_string())
-                .unwrap_or_default(),
+            declared_pledge: params
+                .as_ref()
+                .map(|x| x.pledge.to_string())
+                .unwrap_or_else(|| "0".to_string()),

-            fixed_cost: params
-                .as_ref()
-                .map(|x| x.cost.to_string())
-                .unwrap_or_default(),
+            fixed_cost: params
+                .as_ref()
+                .map(|x| x.cost.to_string())
+                .unwrap_or_else(|| "0".to_string()),

---

120-136: Retired filter may include pools with missing snapshots.

state.snapshot.live().map(|x| x.is_retired).unwrap_or(false) treats “no snapshot” as “not retired,” potentially surfacing pools lacking a live snapshot. If that state is possible, consider excluding entries without a snapshot or making the default explicit in a comment.

crates/cardano/src/roll/accounts.rs (1)

100-100: Remove unused field.

The prev_deposit field is declared but never assigned in the apply method and is not used in undo. This appears to be dead code left over from the refactoring.

Apply this diff to remove the unused field:

-    prev_deposit: Option<u64>,

Also remove it from the constructor at line 112:

         prev_registered_at: None,
         prev_deregistered_at: None,
-        prev_deposit: None,

crates/cardano/src/model.rs (1)

456-469: Defensive arithmetic to avoid underflow in Stake.

total() and withdrawable() subtract on u64; if invariants are violated (e.g., withdrawals_sum > rewards_sum), values wrap. Add saturating math or debug assertions.

 impl Stake {
-    pub fn total(&self) -> u64 {
-        let mut out = self.utxo_sum;
-        out += self.rewards_sum;
-        out -= self.withdrawals_sum;
-        out
-    }
+    pub fn total(&self) -> u64 {
+        self.utxo_sum
+            .saturating_add(self.rewards_sum)
+            .saturating_sub(self.withdrawals_sum)
+    }
 
-    pub fn withdrawable(&self) -> u64 {
-        let mut out = self.rewards_sum;
-        out -= self.withdrawals_sum;
-        out
-    }
+    pub fn withdrawable(&self) -> u64 {
+        self.rewards_sum.saturating_sub(self.withdrawals_sum)
+    }
 }

crates/cardano/src/genesis/mod.rs (1)

47-48: Guard against underflow when computing reserves.

Plain subtraction can wrap if utxos > max_supply in malformed genesis. Prefer checked or saturating subtraction.

-    let reserves = max_supply - utxos;
+    let reserves = max_supply.saturating_sub(utxos);
+    // Alternatively, use checked_sub to error out:
+    // let reserves = max_supply
+    //     .checked_sub(utxos)
+    //     .ok_or_else(|| ChainError::GenesisFieldMissing("inconsistent supply: utxos > max".into()))?;

Please confirm desired behavior (clamp vs. error) for invalid genesis.

crates/cardano/src/ewrap/commit.rs (1)

33-47: Small invariant check for new EraSummary

Optionally assert previous.end is set after define_end to catch regressions early.

-        let new = EraSummary {
+        debug_assert!(previous.end.is_some(), "EraSummary end not defined");
+        let new = EraSummary {
             start: previous.end.clone().unwrap(),

crates/cardano/src/rupd/mod.rs (1)

177-178: Commented debug print—fine to keep

No functional impact. Consider a trace! with feature-gate if you plan to re-enable.

crates/cardano/src/ewrap/loading.rs (1)

32-35: Improve retire log context

Log which pool/operator is being retired to aid debugging.

-                info!("retiring pool");
+                info!(operator = %pool.operator, "retiring pool");

crates/cardano/src/rewards/mocking.rs (2)

320-324: Make missing params error explicit (avoid bare unwrap)

unwrap() will panic without context if a pool hash is absent. Prefer expect with key context, or return Option and let callers decide.

-    fn pool_params(&self, pool: PoolHash) -> &PoolParams {
-        self.pool_params_converted
-            .get(&hex::encode(pool.as_ref()))
-            .unwrap()
-    }
+    fn pool_params(&self, pool: PoolHash) -> &PoolParams {
+        self.pool_params_converted
+            .get(&hex::encode(pool.as_ref()))
+            .expect("missing mock pool_params for given PoolHash")
+    }

Alternatively, change the trait to return Option<&PoolParams> if broader callers can handle absence.

---

65-113: Mock reward account uses mainnet stake tag (0xe1)

Just noting: hardcoded to mainnet stake address semantics; fine for tests. If test vectors intend preview/preprod, consider parameterizing.

crates/cardano/src/estart/rewards.rs (1)

44-46: Undo path should be safe from underflow

Use saturating_sub (or checked_sub with debug_assert) to avoid accidental underflow if deltas are replayed out of order.

-        let stake = entity.stake.unwrap_live_mut();
-        stake.rewards_sum -= self.reward;
+        if let Some(stake) = entity.stake.live_mut() {
+            stake.rewards_sum = stake.rewards_sum.saturating_sub(self.reward);
+        } else {
+            warn!("missing live stake when undoing rewards");
+        }

crates/cardano/src/rewards/mod.rs (3)

155-164: Display for RewardMap is minimal—consider adding account context

Currently prints only amounts; adding the stake credential (or pool split) would improve diagnostics, but fine if intentionally terse.

---

327-415: Avoid O(n) owner lookups per delegator

owners.contains(&delegator) is linear; convert owners to a HashSet once to reduce complexity in large pools.

-        let owners = pool_params
-            .pool_owners
-            .iter()
-            .map(|owner| pallas_extras::keyhash_to_stake_cred(*owner))
-            .collect::<Vec<_>>();
+        let owners: std::collections::HashSet<_> = pool_params
+            .pool_owners
+            .iter()
+            .map(|owner| pallas_extras::keyhash_to_stake_cred(*owner))
+            .collect();
...
-        for delegator in ctx.pool_delegators(pool) {
-            if owners.contains(&delegator) {
+        for delegator in ctx.pool_delegators(pool) {
+            if owners.contains(&delegator) {
                 continue;
             }

---

350-366: Parameter fetches: consolidate to avoid repeated pparams() calls

Minor: cache pparams once per loop to avoid repeated virtual calls.

-        let k = ctx.pparams().ensure_k()?;
-        let a0 = ctx.pparams().ensure_a0()?;
-        let d = ctx.pparams().ensure_d()?;
+        let pparams = ctx.pparams();
+        let k = pparams.ensure_k()?;
+        let a0 = pparams.ensure_a0()?;
+        let d = pparams.ensure_d()?;

crates/cardano/src/roll/pools.rs (1)

107-111: Fix comment typo and grammar.

“udpate its live snapshot” → “update its live snapshot”.

-// please note that new pools will udpate its live snapshot directly. This differs
+// please note that new pools will update their live snapshot directly. This differs

crates/cardano/src/pots.rs (1)

46-52: Guard against u64 overflow in obligations().

Multiplying deposit_per_* by *_count and summing as u64 can overflow on large inputs.

Use u128 intermediates and clamp on conversion:

-    pub fn obligations(&self) -> Lovelace {
-        let pool_deposits = self.deposit_per_pool * self.pool_count;
-        let account_deposits = self.deposit_per_account * self.account_count;
-
-        Lovelace::from(self.nominal_deposits + pool_deposits + account_deposits)
-    }
+    pub fn obligations(&self) -> Lovelace {
+        let pool_deposits = (self.deposit_per_pool as u128) * (self.pool_count as u128);
+        let account_deposits = (self.deposit_per_account as u128) * (self.account_count as u128);
+        let nominal = self.nominal_deposits as u128;
+        let sum = nominal
+            .saturating_add(pool_deposits)
+            .saturating_add(account_deposits);
+        Lovelace::from(sum as u64)
+    }

crates/cardano/src/ewrap/wrapup.rs (2)

1-5: Remove unused imports to satisfy warnings.

Strip unused AccountId, AccountState, PoolSnapshot, and Epoch.

-use crate::{
-    ewrap::{AccountId, PoolId},
-    AccountState, CardanoDelta, EndStats, EpochState, FixedNamespace as _, PParamsSet,
-    PoolSnapshot, PoolState, CURRENT_EPOCH_KEY,
-};
+use crate::{
+    ewrap::PoolId, CardanoDelta, EndStats, EpochState, FixedNamespace as _, PParamsSet, PoolState,
+    CURRENT_EPOCH_KEY,
+};
-use pallas::ledger::primitives::Epoch;

---

28-35: Be defensive on missing pool state (prefer warn-and-return).

Using expect("existing pool") will panic; consider logging and returning to keep boundary processing resilient.

-        let entity = entity.as_mut().expect("existing pool");
+        let Some(entity) = entity.as_mut() else {
+            tracing::warn!("missing pool during wrap-up; skipping");
+            return;
+        };

crates/cardano/src/ewrap/retires.rs (2)

40-47: Fix log message in ProposalExpiration::undo.

Warn says “missing pool” but this delta targets proposals.

-            warn!("missing pool");
+            warn!("missing proposal");

---

115-122: Message nit: replace “existing account” with “existing drep”.

Clarity improvement for DRepExpiration.

-        let entity = entity.as_mut().expect("existing account");
+        let entity = entity.as_mut().expect("existing drep");

crates/cardano/src/rupd/loading.rs (2)

59-76: Avoid potential panic: prefer non-panicking pparams access or guard Byron/None before unwrap.

Using epoch.pparams.unwrap_live() can panic if live params are absent. Guard with mark() and bail out early (neutral pot) or Byron check before using ensure_*.

-    let pparams = epoch.pparams.unwrap_live();
+    let Some(pparams) = epoch.pparams.mark() else {
+        info!("no pparams available for epoch; neutral incentives");
+        return Ok(neutral_incentives());
+    };
+    if pparams.is_byron() {
+        info!("no pot changes during Byron epoch");
+        return Ok(neutral_incentives());
+    }
-    if pparams.is_byron() {
-        info!("no pot changes during Byron epoch");
-        return Ok(neutral_incentives());
-    }

Please confirm unwrap_live cannot occur in Byron/edge epochs, otherwise this is required.

---

195-208: Display should not unwrap pool_params; handle missing gracefully.

Even with the insertion fix, defensive formatting avoids panics during debug output.

-        for (pool, blocks) in self.pool_blocks.iter() {
-            let pparams = self.pool_params.get(pool).unwrap();
-            writeln!(f, "| {pool} | {blocks} | {} |", pparams.pledge)?;
-        }
+        for (pool, blocks) in self.pool_blocks.iter() {
+            if let Some(pparams) = self.pool_params.get(pool) {
+                writeln!(f, "| {pool} | {blocks} | {} |", pparams.pledge)?;
+            } else {
+                writeln!(f, "| {pool} | {blocks} | <missing params> |")?;
+            }
+        }

crates/cardano/src/estart/reset.rs (3)

30-42: Undo paths are todo; confirm not required for current flows.

AccountTransition::undo left as todo!(). If rollbacks/rewinds can reach these deltas, this will crash.

Add a tracked issue or implement minimal reversible state if rewinds are possible in estart.

---

62-73: PoolTransition undo missing; verify no rewind usage.

Same concern as accounts; please confirm or stub with a safe no-op if acceptable.

---

102-129: Prefer non-panicking accessors for rolling live values.

Using unwrap_live() for rolling assumes presence at boundary. If absence is possible on early epochs, use mark() or expect(...) with context.

-    let rolling = epoch.rolling.unwrap_live();
+    let rolling = epoch
+        .rolling
+        .mark()
+        .expect("rolling stats should be live at epoch boundary");

Also confirm epoch.end is always Some at this stage; otherwise expect(...) with a clearer message.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro