fix: validate hotkey registration on specific subnet in serve_axon and serve_prometheus#2545
Open
ppolewicz wants to merge 13 commits intodevnet-readyfrom
Open
fix: validate hotkey registration on specific subnet in serve_axon and serve_prometheus#2545ppolewicz wants to merge 13 commits intodevnet-readyfrom
ppolewicz wants to merge 13 commits intodevnet-readyfrom
Conversation
ppolewicz
added
the
skip-cargo-audit
…hip workflow Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…d serve_prometheus - serve_axon and serve_prometheus now check is_hotkey_registered_on_network(netuid, ...) instead of is_hotkey_registered_on_any_network, preventing hotkeys from setting axon info on subnets they are not registered on - Add migrate_remove_orphan_axon_prom_cert_v2 migration to clean up 243 orphaned entries found on mainnet (242 orphaned Axons + 1 orphaned NeuronCertificate across 41 subnets) - Add 3 new serving tests and 1 migration test
…tion check before IP validation in prometheus; fix migration test setup - Remove redundant `validate_axon_data` call in `do_serve_axon` (already called earlier) - Move registration check before IP validation in `do_serve_prometheus` - Add `target: "runtime"` to migration log in migrate_remove_orphan_axon_prom_cert_v2 - Fix migration test: update setup_for args and matching assert - Use saturating_add in migration test - Add test_serve_axon_with_cert_rejects_unregistered_hotkey test
…et; fix doc comments
ppolewicz
force-pushed
the
fix/serve-axon-registration-check
branch
from
edda939 to
4d30375
Compare
Removes an orphaned `<<<<<<< HEAD` conflict marker at line 3145 of migration.rs that caused `cargo clippy` to fail with an "encountered diff marker" error.
The merge target (devnet-ready) has staking.rs with imports that are not alphabetically sorted, which causes `cargo fmt --check` to fail on the merge commit. Bring the file from devnet-ready and apply rustfmt so the merged result is correctly formatted.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
serve_axonandserve_prometheususedis_hotkey_registered_on_any_networkinstead ofis_hotkey_registered_on_network(netuid, ...), allowing a hotkey registered on any subnet to serve axon/prometheus info on a subnet it is not actually registered onnetuidmigrate_remove_orphan_axon_prom_cert_v2migration to clean up the 243 orphanedAxons/NeuronCertificatesentries that accumulated on mainnet due to this bug (confirmed via mainnet state inspection script)Details
Bug:
validate_serve_axonanddo_serve_prometheusboth calledis_hotkey_registered_on_any_network, so a hotkey registered on subnet 3 could callserve_axonfor subnet 7, writing garbage entries intoAxons,Prometheus, andNeuronCertificatesfor a subnet it had no uid on.Fix: Both checks now call
is_hotkey_registered_on_network(netuid, hotkey)which checksUids::contains_key(netuid, hotkey).Migration: A mainnet inspection script (
scripts/inspect_orphan_axons.py) found 243 orphaned entries across 41 subnets. This is well within migration safety limits (threshold: 1 000). The migrationmigrate_remove_orphan_axon_prom_cert_v2clears them identically to the earliermigrate_remove_unknown_neuron_axon_cert_prommigration but with a newHasMigrationRunkey so it runs again.Test plan
test_serve_axon_rejects_hotkey_registered_on_other_network— hotkey on subnet 1 cannot serve axon on subnet 2test_serve_axon_requires_registration_on_target_network— hotkey on correct subnet succeedstest_serve_prometheus_rejects_hotkey_registered_on_other_network— same guard for prometheustest_migrate_remove_orphan_axon_prom_cert_v2— migration cleans orphaned entries and is idempotent🤖 Generated with Claude Code