Handle swap errors in chain buys

[gztensor]

Description

Chain buys may result in swap errors, in which case the TAO will be withdrawn from the subnet account and returned to the total imbalance.

Related Issue(s)

• Closes inject_and_maybe_swap silently strands TAO when swap_tao_for_alpha fails #2661

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Other (please describe):

Checklist

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have run ./scripts/fix_rust.sh to ensure my code is formatted and linted correctly
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[github-actions]

🛡️ AI Review — Skeptic (security review)

VERDICT: SAFE

BASELINE scrutiny: gztensor has repo write permission, substantial prior subtensor activity, no trusted Gittensor allowlist hit; branch fix/handle-chain-buy-swap-failures -> devnet-ready.

Static review only. The PR does not modify .github/ai-review/*, .github/copilot-instructions.md, dependencies, or build scripts. The workflow changes are runner-label substitutions, and the pallet changes are limited to refunding failed chain-buy deposits back into the existing TAO credit flow, adjusting Subtensor TotalIssuance when a withdrawal reaps dust, and tightening hotkey-swap ownership checks for globally existing target hotkeys.

Findings

No findings.

Conclusion

No malicious behavior or security vulnerability was found. The failed swap path restores the deposited subnet-account TAO without adding panic, origin-bypass, dependency, or build-time execution surfaces.

---

🔍 AI Review — Auditor (domain review)

VERDICT: 👍

Gittensor LIKELY by recent Subtensor-heavy contribution history; author has repo write permission and is not in the trusted gittensor allowlists.

The Auditor proposed a replacement PR description, but the current body is non-trivial; not overwriting. Maintainers: ask the Auditor to regenerate if you want it.

No duplicate-work blocker found. The overlapping PRs appear to be branch-lineage/workflow overlap or adjacent accounting work, not a better candidate for the chain-buy swap failure handled here.

Spec-version auto-fix was not applied. This PR touches pallets/ and targets devnet-ready without the no-spec-version-bump label, but the sandbox could not resolve dev.chain.opentensor.ai, so I could not perform the required live-network comparison before bumping. CI should run the normal devnet spec-version check.

Static review found the failed chain-buy path withdraws the deposited subnet-account TAO back into the remaining credit when swap_tao_for_alpha returns an error. The lower-level swap path rolls back failed swap state, and the remaining credit is later either spent into normal emissions or recycled, preserving the relevant issuance accounting. I did not run additional tests because no finding required runtime confirmation.

Findings

No findings.

Conclusion

The accounting change is focused and the added tests cover the failed-swap refund path and the dust/reaping issuance alignment path. No domain blocker found.

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👍

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👍

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👍

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👍