Optimize hotkey swap stake iteration

[UnArbosSix]

Summary

Fixes the hotkey-swap runtime resource-exhaustion path by ensuring stake storage is scanned once instead of once per subnet.

The previous all-subnet swap behavior repeatedly scanned the full Alpha and AlphaV2 prefixes inside every subnet iteration. For hotkeys with many stake positions, this multiplied the work by the number of active subnets and could cause validator execution stalls.

Changes

• Scan Alpha and AlphaV2 once before executing a stake-moving hotkey swap
• Preserve existing AlphaV2 precedence when merging duplicate stake positions
• Group prepared stake positions by subnet
• Reuse the prepared snapshot during each subnet migration
• Remove the repeated full-prefix scan from the per-subnet execution path
• Expand the hotkey-swap benchmark to cover a large production-scale workload
• Regenerate the declared weight from the updated benchmark

Behavior

Successful hotkey swaps retain the existing behavior:

• same stake transfers
• same subnet processing order
• same keep_stake behavior
• same ownership and metadata migration
• same root-claim handling
• same locks and staking indexes
• same events
• same call indices
• same storage layout

The implementation does not introduce new stake-position limits or reject swaps based on the number of stake rows.

The transaction fee may change because the declared weight is regenerated from a substantially larger and more representative benchmark workload.

Why this fixes the issue

Previously, an all-subnet swap performed approximately:

number of subnets × total stake rows

stake-row visits.

After this change, it performs approximately:

total stake rows + actual stake positions moved

This removes the accidental multiplicative scan while preserving the existing state transition.

Benchmark

The previous benchmark covered only four subnets with a small number of stake positions.

The updated benchmark exercises the optimized implementation with:

• 128 subnets
• 10,189 stake positions

Scope

The patch is limited to removing the repeated hotkey stake-prefix scans and updating the corresponding benchmark and weight.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
subtensor	Ready	Preview, Comment	Jul 16, 2026 5:28am

[github-actions]

🛡️ AI Review — Skeptic (security review)

VERDICT: VULNERABLE

VERY HIGH scrutiny: 14-day-old account with zero public repos; mitigated by repository write permission, matching human commits, an expected benchmark-bot commit, and no Gittensor association; bound-hotkey-swap-work → staging.

The refactor removes the subnet multiplier, but it still scans and materializes an unlimited number of stake rows while assigning one fixed dispatch weight. The latest benchmark was reduced to 16 subnets and 1,273 positions without introducing a protocol bound.

Findings

Sev	File	Finding
HIGH	pallets/subtensor/src/swap/swap_hotkey.rs:19	Fixed weight cannot cover the unbounded stake scan	inline

Prior-comment reconciliation

• fa0ffbf5: not addressed — The current head still permits unlimited stake positions while charging the fixed swap_hotkey() weight; reducing the benchmark workload does not bound execution.

Conclusion

A hotkey with sufficiently many stake rows can exceed the fixed charge and consume unaccounted runtime resources. The prior vulnerability remains unresolved.

---

📜 Previous run (superseded)

Sev	File	Finding	Status
HIGH	pallets/subtensor/src/swap/swap_hotkey.rs:19	Fixed weight cannot cover the unbounded stake scan	➡️ Carried forward to current findings The current head still permits unlimited stake positions while charging the fixed swap_hotkey() weight; reducing the benchmark workload does not bound execution.

---

🔍 AI Review — Auditor (domain review)

VERDICT: 👎

UNKNOWN gittensor association; newer contributor with repository write access, so the resource-limit rationale requires independent evidence.

The PR body claims fees remain unchanged, but stake-moving swaps now retain the maximum normal-extrinsic weight, materially changing transaction fees and normal-block capacity. The overlapping PRs concern broad runtime work and are not functional duplicates.

Findings

Sev	File	Finding
HIGH	pallets/subtensor/src/swap/swap_hotkey.rs:28	Benchmark the admitted workload instead of assigning maximum weight	inline

Conclusion

The repeated prefix scan is removed, but the replacement limits and weight are unbenchmarked. This does not establish that the maximum admitted workload is safe, while imposing maximum weight and fees on every stake-moving swap.

[github-actions]

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👎

[github-actions]

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

[github-actions]

🔄 AI review updated — Skeptic: VULNERABLE

[github-actions]

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

[github-actions]

🔄 AI review updated — Skeptic: VULNERABLE

[github-actions]

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

[github-actions]

🔄 AI review updated — Skeptic: VULNERABLE