Expand the description of Number::isInteger_

- Anything above 13 is _nearly_ unusable, but there might be some edge
  use cases where it is.
- Added unit tests to show this.

include/xrpl/basics/Number.h

@@ -28,6 +28,13 @@ class Number
     rep mantissa_{0};
     int exponent_{std::numeric_limits<int>::lowest()};
 
+    // isInteger_ is informational only. It is not serialized, transmitted, or
+    // used in calculations in any way. It is used only for internal validation
+    // of integer types, usually in transactions. It is a one-way switch. Once
+    // it's on, it stays on. It is also transmissible in that any operation
+    // involving a Number with this flag will have a result with this flag.
+    bool isInteger_ = false;
+
 public:
     // The range for the mantissa when normalized
     constexpr static rep minMantissa = 1'000'000'000'000'000LL;
@@ -49,15 +56,42 @@ public:
 
     explicit constexpr Number() = default;
 
-    Number(rep mantissa);
-    explicit Number(rep mantissa, int exponent);
+    Number(rep mantissa, bool isInteger = false);
+    explicit Number(rep mantissa, int exponent, bool isInteger = false);
     explicit constexpr Number(rep mantissa, int exponent, unchecked) noexcept;
+    constexpr Number(Number const& other) = default;
+    constexpr Number(Number&& other) = default;
+
+    ~Number() = default;
+
+    constexpr Number&
+    operator=(Number const& other);
+    constexpr Number&
+    operator=(Number&& other);
 
     constexpr rep
     mantissa() const noexcept;
     constexpr int
     exponent() const noexcept;
 
+    void
+    setIsInteger(bool isInteger);
+
+    bool
+    isInteger() const noexcept;
+
+    bool
+    valid() const noexcept;
+    bool
+    representable() const noexcept;
+    /// Combines setIsInteger(bool) and valid()
+    bool
+    valid(bool isInteger);
+    /// Because this function is const, it should only be used for one-off
+    /// checks
+    bool
+    valid(bool isInteger) const;
+
     constexpr Number
     operator+() const noexcept;
     constexpr Number
@@ -211,16 +245,47 @@ inline constexpr Number::Number(rep mantissa, int exponent, unchecked) noexcept
 {
 }
 
-inline Number::Number(rep mantissa, int exponent)
-    : mantissa_{mantissa}, exponent_{exponent}
+inline Number::Number(rep mantissa, int exponent, bool isInteger)
+    : mantissa_{mantissa}, exponent_{exponent}, isInteger_(isInteger)
 {
     normalize();
 }
 
-inline Number::Number(rep mantissa) : Number{mantissa, 0}
+inline Number::Number(rep mantissa, bool isInteger)
+    : Number{mantissa, 0, isInteger}
 {
 }
 
+constexpr Number&
+Number::operator=(Number const& other)
+{
+    if (this != &other)
+    {
+        mantissa_ = other.mantissa_;
+        exponent_ = other.exponent_;
+        if (!isInteger_)
+            isInteger_ = other.isInteger_;
+    }
+
+    return *this;
+}
+
+constexpr Number&
+Number::operator=(Number&& other)
+{
+    if (this != &other)
+    {
+        // std::move doesn't really do anything for these types, but
+        // this is future-proof in case the types ever change
+        mantissa_ = std::move(other.mantissa_);
+        exponent_ = std::move(other.exponent_);
+        if (!isInteger_)
+            isInteger_ = std::move(other.isInteger_);
+    }
+
+    return *this;
+}
+
 inline constexpr Number::rep
 Number::mantissa() const noexcept
 {
@@ -233,6 +298,20 @@ Number::exponent() const noexcept
     return exponent_;
 }
 
+inline void
+Number::setIsInteger(bool isInteger)
+{
+    if (isInteger_)
+        return;
+    isInteger_ = isInteger;
+}
+
+inline bool
+Number::isInteger() const noexcept
+{
+    return isInteger_;
+}
+
 inline constexpr Number
 Number::operator+() const noexcept
 {
@@ -418,12 +497,6 @@ public:
     operator=(NumberRoundModeGuard const&) = delete;
 };
 
-class NumberOverflow : public std::overflow_error
-{
-public:
-    using overflow_error::overflow_error;
-};
-
 }  // namespace ripple
 
 #endif  // XRPL_BASICS_NUMBER_H_INCLUDED

include/xrpl/protocol/Asset.h

@@ -81,14 +81,21 @@ public:
     bool
     native() const
     {
-        return holds<Issue>() && get<Issue>().native();
+        return std::visit(
+            [&]<ValidIssueType TIss>(TIss const& issue) {
+                if constexpr (std::is_same_v<TIss, Issue>)
+                    return issue.native();
+                if constexpr (std::is_same_v<TIss, MPTIssue>)
+                    return false;
+            },
+            issue_);
     }
 
     bool
     integral() const
     {
         return std::visit(
-            []<ValidIssueType TIss>(TIss const& issue) {
+            [&]<ValidIssueType TIss>(TIss const& issue) {
                 if constexpr (std::is_same_v<TIss, Issue>)
                     return issue.native();
                 if constexpr (std::is_same_v<TIss, MPTIssue>)

include/xrpl/protocol/MPTAmount.h

@@ -64,7 +64,7 @@ public:
 
     operator Number() const noexcept
     {
-        return value();
+        return {value(), true};
     }
 
     /** Return the sign of the amount */

include/xrpl/protocol/Protocol.h

@@ -108,9 +108,11 @@ std::uint8_t constexpr vaultStrategyFirstComeFirstServe = 1;
 /** Default IOU scale factor for a Vault */
 std::uint8_t constexpr vaultDefaultIOUScale = 6;
 /** Maximum scale factor for a Vault. The number is chosen to ensure that
-1 IOU can be always converted to shares.
+1 IOU can be always converted to shares and will fit into Number.
+10^16 > Number::maxMantissa
+In the future, this should be increased to 18.
 10^19 > maxMPTokenAmount (2^64-1) > 10^18 */
-std::uint8_t constexpr vaultMaximumIOUScale = 18;
+std::uint8_t constexpr vaultMaximumIOUScale = 15;
 
 /** Maximum recursion depth for vault shares being put as an asset inside
  * another vault; counted from 0 */

include/xrpl/protocol/STAmount.h

@@ -146,6 +146,11 @@ public:
     STAmount(MPTAmount const& amount, MPTIssue const& mptIssue);
     operator Number() const;
 
+    bool
+    validNumber() const noexcept;
+    bool
+    representableNumber() const noexcept;
+
     //--------------------------------------------------------------------------
     //
     // Observers

include/xrpl/protocol/STNumber.h

@@ -24,10 +24,6 @@ class STNumber : public STBase, public CountedObject<STNumber>
 {
 private:
     Number value_;
-    // isInteger_ is not serialized or transmitted in any way. It is used only
-    // for internal validation of integer types. It is a one-way switch. Once
-    // it's on, it stays on.
-    bool isInteger_ = false;
 
 public:
     using value_type = Number;
@@ -55,35 +51,6 @@ public:
         return *this;
     }
 
-    // Tell the STNumber whether the value it is holding represents an integer,
-    // and must fit within the allowable range.
-    void
-    usesAsset(Asset const& a);
-    // The asset isn't stored, only whether it's an integral type. Get that flag
-    // back out.
-    bool
-    isIntegral() const;
-    // Returns whether the value fits within Number::maxIntValue. Transactors
-    // should check this whenever interacting with an STNumber.
-    bool
-    safeNumber() const;
-    /// Combines usesAsset(a) and safeNumber()
-    static std::int64_t
-    safeNumberLimit();
-    bool
-    safeNumber(Asset const& a);
-    // Returns whether the value fits within Number::maxMantissa. Transactors
-    // may check this, too, but are not required to. It will be checked when
-    // serializing, and will throw if false, thus preventing the value from
-    // being silently truncated.
-    bool
-    validNumber() const;
-    /// Combines usesAsset(a) and validAsset()
-    bool
-    validNumber(Asset const& a);
-    static std::int64_t
-    validNumberLimit();
-
     bool
     isEquivalent(STBase const& t) const override;
     bool

include/xrpl/protocol/STObject.h

@@ -487,10 +487,6 @@ public:
     T const*
     operator->() const;
 
-    /// Access the underlying STObject without necessarily dereferencing it
-    T*
-    stValue() const;
-
 protected:
     STObject* st_;
     SOEStyle style_;
@@ -730,15 +726,7 @@ template <class T>
 T const*
 STObject::Proxy<T>::operator->() const
 {
-    return stValue();
-}
-
-/// Access the underlying STObject without necessarily dereferencing it
-template <class T>
-T*
-STObject::Proxy<T>::stValue() const
-{
-    return dynamic_cast<T*>(st_->getPField(*f_));
+    return this->find();
 }
 
 template <class T>

include/xrpl/protocol/XRPAmount.h

@@ -143,7 +143,7 @@ public:
 
     operator Number() const noexcept
     {
-        return drops();
+        return {drops(), true};
     }
 
     /** Return the sign of the amount */

src/libxrpl/basics/Number.cpp

@@ -164,9 +164,8 @@ Number::normalize()
         return;
     }
     bool const negative = (mantissa_ < 0);
-    auto m = static_cast<std::make_unsigned_t<rep>>(mantissa_);
-    if (negative)
-        m = -m;
+    auto m = static_cast<std::make_unsigned_t<rep>>(
+        negative ? -mantissa_ : mantissa_);
     while ((m < minMantissa) && (exponent_ > minExponent))
     {
         m *= 10;
@@ -207,9 +206,52 @@ Number::normalize()
         mantissa_ = -mantissa_;
 }
 
+bool
+Number::valid() const noexcept
+{
+    return valid(isInteger_);
+}
+
+bool
+Number::valid(bool isInteger)
+{
+    setIsInteger(isInteger);
+    return valid();
+}
+
+bool
+Number::valid(bool isInteger) const
+{
+    if (!isInteger)
+        return true;
+    static Number const max = maxIntValue;
+    static Number const maxNeg = -max;
+    // Avoid making a copy
+    if (mantissa_ < 0)
+        return *this >= maxNeg;
+    return *this <= max;
+}
+
+bool
+Number::representable() const noexcept
+{
+    if (!isInteger_)
+        return true;
+    static Number const max = maxMantissa;
+    static Number const maxNeg = -max;
+    // Avoid making a copy
+    if (mantissa_ < 0)
+        return *this >= maxNeg;
+    return *this <= max;
+}
+
 Number&
 Number::operator+=(Number const& y)
 {
+    // The strictest setting prevails
+    if (!isInteger_)
+        isInteger_ = y.isInteger_;
+
     if (y == Number{})
         return *this;
     if (*this == Number{})
@@ -356,6 +398,10 @@ divu10(uint128_t& u)
 Number&
 Number::operator*=(Number const& y)
 {
+    // The strictest setting prevails
+    if (!isInteger_)
+        isInteger_ = y.isInteger_;
+
     if (*this == Number{})
         return *this;
     if (y == Number{})
@@ -428,6 +474,10 @@ Number::operator*=(Number const& y)
 Number&
 Number::operator/=(Number const& y)
 {
+    // The strictest setting prevails
+    if (!isInteger_)
+        isInteger_ = y.isInteger_;
+
     if (y == Number{})
         throw std::overflow_error("Number: divide by 0");
     if (*this == Number{})

src/libxrpl/ledger/View.cpp

@@ -2927,7 +2927,7 @@ assetsToSharesWithdraw(
 {
     XRPL_ASSERT(
         !assets.negative(),
-        "ripple::assetsToSharesDeposit : non-negative assets");
+        "ripple::assetsToSharesWithdraw : non-negative assets");
     XRPL_ASSERT(
         assets.asset() == vault->at(sfAsset),
         "ripple::assetsToSharesWithdraw : assets and vault match");

src/libxrpl/protocol/STAmount.cpp

@@ -255,6 +255,20 @@ STAmount::move(std::size_t n, void* buf)
     return emplace(n, buf, std::move(*this));
 }
 
+bool
+STAmount::validNumber() const noexcept
+{
+    Number n = *this;
+    return n.valid();
+}
+
+bool
+STAmount::representableNumber() const noexcept
+{
+    Number n = *this;
+    return n.representable();
+}
+
 //------------------------------------------------------------------------------
 //
 // Conversion

src/libxrpl/protocol/STLedgerEntry.cpp

@@ -12,7 +12,6 @@
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STBase.h>
 #include <xrpl/protocol/STLedgerEntry.h>
-#include <xrpl/protocol/STNumber.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/Serializer.h>
 #include <xrpl/protocol/jss.h>
@@ -68,32 +67,6 @@ STLedgerEntry::setSLEType()
 
     type_ = format->getType();
     applyTemplate(format->getSOTemplate());  // May throw
-
-    // Per object type overrides
-    // Currently only covers STNumber fields to link them to appropriate assets
-    switch (type_)
-    {
-        case ltVAULT: {
-            auto const asset = at(sfAsset);
-            for (auto const& field :
-                 {~sfAssetsAvailable,
-                  ~sfAssetsTotal,
-                  ~sfAssetsMaximum,
-                  ~sfLossUnrealized})
-            {
-                if (auto proxy = at(field))
-                    if (auto stNumber = proxy.stValue())
-                        stNumber->usesAsset(asset);
-            }
-        }
-            /*
-            // TODO: If possible, set up the loan-related STNumber fields, too.
-            // May not be possible because we don't have a view available.
-
-            case ltLOAN_BROKER:
-            case ltLOAN:
-            */
-    }
 }
 
 std::string

src/libxrpl/protocol/STNumber.cpp

@@ -50,8 +50,6 @@ STNumber::add(Serializer& s) const
     XRPL_ASSERT(
         getFName().fieldType == getSType(),
         "ripple::STNumber::add : field type match");
-    if (!validNumber())
-        throw NumberOverflow(to_string(value_));
     s.add64(value_.mantissa());
     s.add32(value_.exponent());
 }
@@ -68,87 +66,6 @@ STNumber::setValue(Number const& v)
     value_ = v;
 }
 
-// Tell the STNumber whether the value it is holding represents an integer, and
-// must fit within the allowable range.
-void
-STNumber::usesAsset(Asset const& a)
-{
-    XRPL_ASSERT_PARTS(
-        !isInteger_ || a.integral(),
-        "ripple::STNumber::value",
-        "asset check only gets stricter");
-    // isInteger_ is a one-way switch. Once it's on, it stays on.
-    if (isInteger_)
-        return;
-    isInteger_ = a.integral();
-}
-
-bool
-STNumber::isIntegral() const
-{
-    return isInteger_;
-}
-
-// Returns whether the value fits within Number::maxIntValue. Transactors
-// should check this whenever interacting with an STNumber.
-bool
-STNumber::safeNumber() const
-{
-    if (!isInteger_)
-        return true;
-
-    static Number const max = safeNumberLimit();
-    static Number const maxNeg = -max;
-    // Avoid making a copy
-    if (value_ < 0)
-        return value_ >= maxNeg;
-    return value_ <= max;
-}
-
-bool
-STNumber::safeNumber(Asset const& a)
-{
-    usesAsset(a);
-    return safeNumber();
-}
-
-std::int64_t
-STNumber::safeNumberLimit()
-{
-    return Number::maxIntValue;
-}
-
-// Returns whether the value fits within Number::maxMantissa. Transactors
-// may check this, too, but are not required to. It will be checked when
-// serializing, and will throw if false, thus preventing the value from
-// being silently truncated.
-bool
-STNumber::validNumber() const
-{
-    if (!isInteger_)
-        return true;
-
-    static Number const max = validNumberLimit();
-    static Number const maxNeg = -max;
-    // Avoid making a copy
-    if (value_ < 0)
-        return value_ >= maxNeg;
-    return value_ <= max;
-}
-
-bool
-STNumber::validNumber(Asset const& a)
-{
-    usesAsset(a);
-    return validNumber();
-}
-
-std::int64_t
-STNumber::validNumberLimit()
-{
-    return Number::maxMantissa;
-}
-
 STBase*
 STNumber::copy(std::size_t n, void* buf) const
 {

src/test/app/Vault_test.cpp

@@ -962,16 +962,25 @@ class Vault_test : public beast::unit_test::suite
                 env(tx, ter(temMALFORMED));
             }
 
-            // accepted range from 0 to 18
+            // the prior acceptable upper limit
             {
                 auto [tx, keylet] =
                     vault.create({.owner = owner, .asset = asset});
                 tx[sfScale] = 18;
+                env(tx, ter(temMALFORMED));
+            }
+
+            // accepted range from 0 to 13
+            {
+                auto [tx, keylet] =
+                    vault.create({.owner = owner, .asset = asset});
+                tx[sfScale] = 13;
                 env(tx);
                 env.close();
                 auto const sleVault = env.le(keylet);
-                BEAST_EXPECT(sleVault);
-                BEAST_EXPECT((*sleVault)[sfScale] == 18);
+                if (BEAST_EXPECT(sleVault))
+                    ;
+                BEAST_EXPECT((*sleVault)[sfScale] == 13);
             }
 
             {
@@ -3625,13 +3634,18 @@ class Vault_test : public beast::unit_test::suite
             tx[sfScale] = scale;
             env(tx);
 
-            auto const [vaultAccount, issuanceId] =
-                [&env](ripple::Keylet keylet) -> std::tuple<Account, MPTID> {
+            auto const vaultInfo = [&env](ripple::Keylet keylet)
+                -> std::optional<std::tuple<Account, MPTID>> {
                 auto const vault = env.le(keylet);
-                return {
+                if (!vault)
+                    return std::nullopt;
+                return std::make_tuple(
                     Account("vault", vault->at(sfAccount)),
-                    vault->at(sfShareMPTID)};
+                    vault->at(sfShareMPTID));
             }(keylet);
+            if (!BEAST_EXPECT(vaultInfo))
+                return;
+            auto const [vaultAccount, issuanceId] = *vaultInfo;
             MPTIssue shares(issuanceId);
             env.memoize(vaultAccount);
 
@@ -3673,18 +3687,92 @@ class Vault_test : public beast::unit_test::suite
                  .peek = peek});
         };
 
-        testCase(18, [&, this](Env& env, Data d) {
-            testcase("Scale deposit overflow on first deposit");
+        // The scale can go to 15, which will allow the total assets to
+        // go that high, but single deposits are not allowed over 10^13.
+        // There probably aren't too many use cases that will be able to
+        // use this, but it does work.
+        testCase(15, [&, this](Env& env, Data d) {
+            testcase("MPT fractional deposits are supported");
+
+            // Deposits large than Number::maxIntValue are invalid
+            {
+                auto tx = d.vault.deposit(
+                    {.depositor = d.depositor,
+                     .id = d.keylet.key,
+                     .amount = d.asset(10)});
+                env(tx, ter{tecPRECISION_LOSS});
+                env.close();
+            }
+            {
+                auto tx = d.vault.deposit(
+                    {.depositor = d.depositor,
+                     .id = d.keylet.key,
+                     .amount = d.asset(5)});
+                env(tx, ter{tecPRECISION_LOSS});
+                env.close();
+            }
+            {
+                auto tx = d.vault.deposit(
+                    {.depositor = d.depositor,
+                     .id = d.keylet.key,
+                     .amount = d.asset(Number{1, -1})});
+                env(tx, ter{tecPRECISION_LOSS});
+                env.close();
+            }
+
+            auto const smallDeposit = d.asset(Number{5, -2});
+            {
+                // Individual deposits that fit within
+                // Number::maxIntValue are valid
+                auto tx = d.vault.deposit(
+                    {.depositor = d.depositor,
+                     .id = d.keylet.key,
+                     .amount = smallDeposit});
+                env(tx);
+            }
+            env.close();
+            {
+                // The total shares can not go over Number::maxIntValue
+                auto tx = d.vault.deposit(
+                    {.depositor = d.depositor,
+                     .id = d.keylet.key,
+                     .amount = smallDeposit});
+                env(tx, ter{tecPRECISION_LOSS});
+                env.close();
+            }
+
+            {
+                auto tx = d.vault.withdraw(
+                    {.depositor = d.depositor,
+                     .id = d.keylet.key,
+                     .amount = d.asset(Number(10, 0))});
+                env(tx, ter{tecPRECISION_LOSS});
+                env.close();
+            }
+
+            {
+                // A withdraw can take any representable amount, even one
+                // that can't be deposited
+                auto tx = d.vault.withdraw(
+                    {.depositor = d.depositor,
+                     .id = d.keylet.key,
+                     .amount = d.asset(Number{10, -2})});
+                env(tx, ter{tecINSUFFICIENT_FUNDS});
+            }
+        });
+
+        testCase(13, [&, this](Env& env, Data d) {
+            testcase("MPT scale deposit over maxIntValue on first deposit");
             auto tx = d.vault.deposit(
                 {.depositor = d.depositor,
                  .id = d.keylet.key,
                  .amount = d.asset(10)});
-            env(tx, ter{tecPATH_DRY});
+            env(tx, ter{tecPRECISION_LOSS});
             env.close();
         });
 
-        testCase(18, [&, this](Env& env, Data d) {
-            testcase("Scale deposit overflow on second deposit");
+        testCase(13, [&, this](Env& env, Data d) {
+            testcase("MPT scale deposit over maxIntValue on second deposit");
 
             {
                 auto tx = d.vault.deposit(
@@ -3700,13 +3788,13 @@ class Vault_test : public beast::unit_test::suite
                     {.depositor = d.depositor,
                      .id = d.keylet.key,
                      .amount = d.asset(10)});
-                env(tx, ter{tecPATH_DRY});
+                env(tx, ter{tecPRECISION_LOSS});
                 env.close();
             }
         });
 
-        testCase(18, [&, this](Env& env, Data d) {
-            testcase("Scale deposit overflow on total shares");
+        testCase(13, [&, this](Env& env, Data d) {
+            testcase("MPT scale deposit over maxIntValue on total shares");
 
             {
                 auto tx = d.vault.deposit(
@@ -3722,7 +3810,7 @@ class Vault_test : public beast::unit_test::suite
                     {.depositor = d.depositor,
                      .id = d.keylet.key,
                      .amount = d.asset(5)});
-                env(tx, ter{tecPATH_DRY});
+                env(tx, ter(tecPRECISION_LOSS));
                 env.close();
             }
         });
@@ -4003,8 +4091,8 @@ class Vault_test : public beast::unit_test::suite
             }
         });
 
-        testCase(18, [&, this](Env& env, Data d) {
-            testcase("Scale withdraw overflow");
+        testCase(13, [&, this](Env& env, Data d) {
+            testcase("MPT scale withdraw over maxIntValue");
 
             {
                 auto tx = d.vault.deposit(
@@ -4016,11 +4104,22 @@ class Vault_test : public beast::unit_test::suite
             }
 
             {
+                // withdraws are allowed to be invalid...
                 auto tx = d.vault.withdraw(
                     {.depositor = d.depositor,
                      .id = d.keylet.key,
                      .amount = STAmount(d.asset, Number(10, 0))});
-                env(tx, ter{tecPATH_DRY});
+                env(tx, ter{tecINSUFFICIENT_FUNDS});
+                env.close();
+            }
+
+            {
+                // ...but they are not allowed to be unrepresentable
+                auto tx = d.vault.withdraw(
+                    {.depositor = d.depositor,
+                     .id = d.keylet.key,
+                     .amount = STAmount(d.asset, Number(1000, 0))});
+                env(tx, ter{tecPRECISION_LOSS});
                 env.close();
             }
         });
@@ -4221,9 +4320,51 @@ class Vault_test : public beast::unit_test::suite
             }
         });
 
-        testCase(18, [&, this](Env& env, Data d) {
+        // The scale can go to 15, which will allow the total assets to
+        // go that high, but single deposits are not allowed over 10^13.
+        // There probably aren't too many use cases that will be able to
+        // use this, but it does work.
+        testCase(15, [&, this](Env& env, Data d) {
             testcase("Scale clawback overflow");
 
+            auto const smallDeposit = d.asset(Number{5, -2});
+            {
+                // Individual deposits that fit within
+                // Number::maxIntValue are valid
+                auto tx = d.vault.deposit(
+                    {.depositor = d.depositor,
+                     .id = d.keylet.key,
+                     .amount = smallDeposit});
+                env(tx);
+            }
+            env.close();
+
+            {
+                auto tx = d.vault.clawback(
+                    {.issuer = d.issuer,
+                     .id = d.keylet.key,
+                     .holder = d.depositor,
+                     .amount = d.asset(10)});
+                env(tx, ter{tecPRECISION_LOSS});
+                env.close();
+            }
+
+            {
+                // A clawback can take any representable amount, even one
+                // that can't be deposited
+                auto tx = d.vault.clawback(
+                    {.issuer = d.issuer,
+                     .id = d.keylet.key,
+                     .holder = d.depositor,
+                     .amount = d.asset(Number(10, -2))});
+                env(tx);
+                env.close();
+            }
+        });
+
+        testCase(13, [&, this](Env& env, Data d) {
+            testcase("MPT Scale clawback overflow");
+
             {
                 auto tx = d.vault.deposit(
                     {.depositor = d.depositor,
@@ -4234,14 +4375,27 @@ class Vault_test : public beast::unit_test::suite
             }
 
             {
+                // clawbacks are allowed to be invalid...
                 auto tx = d.vault.clawback(
                     {.issuer = d.issuer,
                      .id = d.keylet.key,
                      .holder = d.depositor,
                      .amount = STAmount(d.asset, Number(10, 0))});
-                env(tx, ter{tecPATH_DRY});
+                env(tx);
                 env.close();
             }
+
+            {
+                // ...but they are not allowed to be unrepresentable
+                auto tx = d.vault.clawback(
+                    {.issuer = d.issuer,
+                     .id = d.keylet.key,
+                     .holder = d.depositor,
+                     .amount = STAmount(d.asset, Number(1000, 0))});
+                env(tx, ter{tecPRECISION_LOSS});
+                env.close();
+            }
+
         });
 
         testCase(1, [&, this](Env& env, Data d) {

src/test/basics/Number_test.cpp

@@ -725,6 +725,89 @@ public:
         BEAST_EXPECT(Number(-100, -30000).truncate() == Number(0, 0));
     }
 
+    void
+    testInteger()
+    {
+        testcase("Integer enforcement");
+
+        using namespace std::string_literals;
+
+        {
+            Number a{100};
+            BEAST_EXPECT(!a.isInteger());
+            BEAST_EXPECT(a.valid());
+            BEAST_EXPECT(a.representable());
+            a = Number{1, 30};
+            BEAST_EXPECT(a.valid());
+            BEAST_EXPECT(a.representable());
+            a = -100;
+            BEAST_EXPECT(!a.isInteger());
+            BEAST_EXPECT(a.valid());
+            BEAST_EXPECT(a.representable());
+            // If there's any interaction with an integer, the value
+            // becomes an integer. This is not always what the value is
+            // being used for, so it's up to the context to check or not
+            // check whether the number is a _valid_ integer.
+            a += Number{37, 2, true};
+            BEAST_EXPECT(a.isInteger());
+            BEAST_EXPECT(a.valid());
+            BEAST_EXPECT(a.representable());
+        }
+        {
+            Number a{100, true};
+            BEAST_EXPECT(a.isInteger());
+            BEAST_EXPECT(a.valid());
+            BEAST_EXPECT(a.representable());
+            a = Number{1, 15};
+            BEAST_EXPECT(!a.valid());
+            BEAST_EXPECT(a.representable());
+            // The false in the assigned value does not override the
+            // flag in "a"
+            a = Number{1, 30, false};
+            BEAST_EXPECT(a.isInteger());
+            BEAST_EXPECT(!a.valid());
+            BEAST_EXPECT(!a.representable());
+            a = -100;
+            BEAST_EXPECT(a.isInteger());
+            BEAST_EXPECT(a.valid());
+            BEAST_EXPECT(a.representable());
+            a *= Number{1, 13};
+            BEAST_EXPECT(a.isInteger());
+            BEAST_EXPECT(!a.valid());
+            BEAST_EXPECT(a.representable());
+            a *= Number{1, 3};
+            BEAST_EXPECT(a.isInteger());
+            BEAST_EXPECT(!a.valid());
+            BEAST_EXPECT(!a.representable());
+            // Intermittent value precision can be lost, but the result
+            // will be rounded, so that's fine.
+            a /= Number{1, 5};
+            BEAST_EXPECT(a.isInteger());
+            BEAST_EXPECT(a.valid());
+            BEAST_EXPECT(a.representable());
+            a = Number{1, 14} - 3;
+            BEAST_EXPECT(a.isInteger());
+            BEAST_EXPECT(a.valid());
+            BEAST_EXPECT(a.representable());
+            a += 1;
+            BEAST_EXPECT(a.isInteger());
+            BEAST_EXPECT(a.valid());
+            BEAST_EXPECT(a.representable());
+            ++a;
+            BEAST_EXPECT(a.isInteger());
+            BEAST_EXPECT(a.valid());
+            BEAST_EXPECT(a.representable());
+            a++;
+            BEAST_EXPECT(a.isInteger());
+            BEAST_EXPECT(!a.valid());
+            BEAST_EXPECT(a.representable());
+            a = Number{5, true};
+            BEAST_EXPECT(a.isInteger());
+            BEAST_EXPECT(a.valid());
+            BEAST_EXPECT(a.representable());
+        }
+    }
+
     void
     run() override
     {
@@ -746,6 +829,7 @@ public:
         test_inc_dec();
         test_toSTAmount();
         test_truncate();
+        testInteger();
     }
 };
 

src/xrpld/app/tx/detail/InvariantCheck.cpp

@@ -2164,28 +2164,6 @@ ValidAMM::finalize(
 
 //------------------------------------------------------------------------------
 
-ValidVault::NumberInfo
-ValidVault::NumberInfo::make(
-    SLE const& from,
-    SF_NUMBER const& field,
-    Asset const& asset)
-{
-    bool valid = true;
-
-    // Poke around in the internals of STObject to get the STNumber object
-    if (auto const stNumber =
-            dynamic_cast<STNumber const*>(from.peekAtPField(field)))
-        valid = stNumber->isIntegral() == asset.integral() &&
-            stNumber->validNumber();
-
-    return {.n = from.at(field), .valid = valid};
-}
-
-ValidVault::NumberInfo::operator Number const&() const
-{
-    return n;
-}
-
 ValidVault::Vault
 ValidVault::Vault::make(SLE const& from)
 {
@@ -2198,11 +2176,17 @@ ValidVault::Vault::make(SLE const& from)
     self.asset = from.at(sfAsset);
     self.pseudoId = from.getAccountID(sfAccount);
     self.shareMPTID = from.getFieldH192(sfShareMPTID);
-    self.assetsTotal = NumberInfo::make(from, sfAssetsTotal, self.asset);
-    self.assetsAvailable =
-        NumberInfo::make(from, sfAssetsAvailable, self.asset);
-    self.assetsMaximum = NumberInfo::make(from, sfAssetsMaximum, self.asset);
-    self.lossUnrealized = NumberInfo::make(from, sfLossUnrealized, self.asset);
+    self.assetsTotal = from.at(sfAssetsTotal);
+    self.assetsAvailable = from.at(sfAssetsAvailable);
+    self.assetsMaximum = from.at(sfAssetsMaximum);
+    self.lossUnrealized = from.at(sfLossUnrealized);
+    if (self.asset.integral())
+    {
+        self.assetsTotal.setIsInteger(true);
+        self.assetsAvailable.setIsInteger(true);
+        self.assetsMaximum.setIsInteger(true);
+        self.lossUnrealized.setIsInteger(true);
+    }
     return self;
 }
 
@@ -2436,8 +2420,10 @@ ValidVault::finalize(
         beforeVault_.empty() || beforeVault_[0].key == afterVault.key,
         "ripple::ValidVault::finalize : single vault operation");
 
-    if (!afterVault.assetsTotal.valid || !afterVault.assetsAvailable.valid ||
-        !afterVault.assetsMaximum.valid || !afterVault.lossUnrealized.valid)
+    if (!afterVault.assetsTotal.representable() ||
+        !afterVault.assetsAvailable.representable() ||
+        !afterVault.assetsMaximum.representable() ||
+        !afterVault.lossUnrealized.representable())
     {
         JLOG(j.fatal()) << "Invariant failed: vault overflowed maximum current "
                            "representable integer value";
@@ -2521,7 +2507,7 @@ ValidVault::finalize(
         result = false;
     }
 
-    if (afterVault.assetsAvailable.n > afterVault.assetsTotal)
+    if (afterVault.assetsAvailable > afterVault.assetsTotal)
     {
         JLOG(j.fatal()) << "Invariant failed: assets available must "
                            "not be greater than assets outstanding";
@@ -2562,7 +2548,7 @@ ValidVault::finalize(
     }
 
     if (!beforeVault_.empty() &&
-        afterVault.lossUnrealized.n != beforeVault_[0].lossUnrealized)
+        afterVault.lossUnrealized != beforeVault_[0].lossUnrealized)
     {
         JLOG(j.fatal()) <<  //
             "Invariant failed: vault transaction must not change loss "
@@ -2732,7 +2718,7 @@ ValidVault::finalize(
                     result = false;
                 }
 
-                if (beforeVault.assetsTotal.n != afterVault.assetsTotal)
+                if (beforeVault.assetsTotal != afterVault.assetsTotal)
                 {
                     JLOG(j.fatal()) <<  //
                         "Invariant failed: set must not change assets "
@@ -2741,7 +2727,7 @@ ValidVault::finalize(
                 }
 
                 if (afterVault.assetsMaximum > zero &&
-                    afterVault.assetsTotal.n > afterVault.assetsMaximum)
+                    afterVault.assetsTotal > afterVault.assetsMaximum)
                 {
                     JLOG(j.fatal()) <<  //
                         "Invariant failed: set assets outstanding must not "
@@ -2749,7 +2735,7 @@ ValidVault::finalize(
                     result = false;
                 }
 
-                if (beforeVault.assetsAvailable.n != afterVault.assetsAvailable)
+                if (beforeVault.assetsAvailable != afterVault.assetsAvailable)
                 {
                     JLOG(j.fatal()) <<  //
                         "Invariant failed: set must not change assets "
@@ -2837,7 +2823,7 @@ ValidVault::finalize(
                 }
 
                 if (afterVault.assetsMaximum > zero &&
-                    afterVault.assetsTotal.n > afterVault.assetsMaximum)
+                    afterVault.assetsTotal > afterVault.assetsMaximum)
                 {
                     JLOG(j.fatal()) <<  //
                         "Invariant failed: deposit assets outstanding must not "

src/xrpld/app/tx/detail/InvariantCheck.h

@@ -5,7 +5,6 @@
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/beast/utility/Journal.h>
 #include <xrpl/protocol/MPTIssue.h>
-#include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STLedgerEntry.h>
 #include <xrpl/protocol/STTx.h>
 #include <xrpl/protocol/TER.h>
@@ -739,38 +738,16 @@ class ValidVault
 {
     Number static constexpr zero{};
 
-    struct Vault;
-
-    struct NumberInfo final
-    {
-        Number n;
-        bool valid;
-
-        // Make this Number wrapper as transparent as possible, except when
-        // checking validity. However, rather than fleshing out all the
-        // comparison operators, etc, a few places will still need to specify
-        // "n".
-        operator Number const&() const;
-
-    private:
-        friend class ValidVault::Vault;
-
-        NumberInfo static make(
-            SLE const& from,
-            SF_NUMBER const& field,
-            Asset const& asset);
-    };
-
     struct Vault final
     {
         uint256 key = beast::zero;
         Asset asset = {};
         AccountID pseudoId = {};
         uint192 shareMPTID = beast::zero;
-        NumberInfo assetsTotal{0, true};
-        NumberInfo assetsAvailable{0, true};
-        NumberInfo assetsMaximum{0, true};
-        NumberInfo lossUnrealized{0, true};
+        Number assetsTotal = 0;
+        Number assetsAvailable = 0;
+        Number assetsMaximum = 0;
+        Number lossUnrealized = 0;
 
         Vault static make(SLE const&);
     };

src/xrpld/app/tx/detail/VaultClawback.cpp

@@ -48,6 +48,8 @@ VaultClawback::preflight(PreflightContext const& ctx)
                 << "VaultClawback: only asset issuer can clawback.";
             return temMALFORMED;
         }
+        else if (!amount->representableNumber())
+            return temBAD_AMOUNT;
     }
 
     return tesSUCCESS;
@@ -146,8 +148,11 @@ VaultClawback::doApply()
         amount.asset() == vaultAsset,
         "ripple::VaultClawback::doApply : matching asset");
 
+    // Both of these values are going to be decreased in this transaction,
+    // so the limit doesn't really matter.
     auto assetsAvailable = vault->at(sfAssetsAvailable);
     auto assetsTotal = vault->at(sfAssetsTotal);
+
     [[maybe_unused]] auto const lossUnrealized = vault->at(sfLossUnrealized);
     XRPL_ASSERT(
         lossUnrealized <= (assetsTotal - assetsAvailable),
@@ -156,7 +161,7 @@ VaultClawback::doApply()
     AccountID holder = tx[sfHolder];
     MPTIssue const share{mptIssuanceID};
     STAmount sharesDestroyed = {share};
-    STAmount assetsRecovered;
+    STAmount assetsRecovered = {vaultAsset};
     try
     {
         if (amount == beast::zero)
@@ -192,6 +197,12 @@ VaultClawback::doApply()
                 return tecINTERNAL;  // LCOV_EXCL_LINE
             assetsRecovered = *maybeAssets;
         }
+        // Clawback amounts are allowed to be invalid, but not unrepresentable.
+        // Amounts over the "soft" limit help bring the numbers back into the
+        // valid range.
+        if (!sharesDestroyed.representableNumber() ||
+            !assetsRecovered.representableNumber())
+            return tecPRECISION_LOSS;
 
         // Clamp to maximum.
         if (assetsRecovered > *assetsAvailable)

src/xrpld/app/tx/detail/VaultCreate.cpp

@@ -194,27 +194,28 @@ VaultCreate::doApply()
     // Leave default values for AssetTotal and AssetAvailable, both zero.
     if (auto value = tx[~sfAssetsMaximum])
     {
-        auto assetsMaximumProxy = vault->at(~sfAssetsMaximum);
+        auto assetsMaximumProxy = vault->at(sfAssetsMaximum);
         assetsMaximumProxy = *value;
-        if (auto const stNumber = assetsMaximumProxy.stValue();
-            stNumber && !stNumber->validNumber(asset))
+        if (asset.integral())
         {
-            JLOG(j_.warn()) << "VaultCreate: Invalid assets maximum value for "
-                               "integral asset type: "
-                            << *value << " > " << STNumber::validNumberLimit();
-            return tecPRECISION_LOSS;
+            // Only the Maximum can be a non-zero value, so only it needs to be
+            // checked.
+            assetsMaximumProxy.value().setIsInteger(true);
+            if (!assetsMaximumProxy.value().representable())
+                return tecPRECISION_LOSS;
         }
     }
     // TODO: Should integral types automatically set a limit to the
-    // Number::validNumberLimit() value? Or safeNumberLimit()?
+    // Number::maxMantissa value? Or maxIntValue?
     /*
     else if (asset.integral())
     {
         auto assetsMaximumProxy = vault->at(~sfAssetsMaximum);
-        assetsMaximumProxy = STNumber::validNumberLimit();
-        assetsMaximumProxy.stValue()->usesAsset(asset);
+        assetsMaximumProxy = STNumber::maxIntValue
+        assetsMaximumProxy.value().setIsInteger(true);
     }
     */
+
     vault->at(sfShareMPTID) = mptIssuanceID;
     if (auto value = tx[~sfData])
         vault->at(sfData) = *value;

src/xrpld/app/tx/detail/VaultDeposit.cpp

@@ -23,7 +23,10 @@ VaultDeposit::preflight(PreflightContext const& ctx)
         return temMALFORMED;
     }
 
-    if (ctx.tx[sfAmount] <= beast::zero)
+    auto const amount = ctx.tx[sfAmount];
+    if (amount <= beast::zero)
+        return temBAD_AMOUNT;
+    if (!amount.validNumber())
         return temBAD_AMOUNT;
 
     return tesSUCCESS;
@@ -162,7 +165,8 @@ VaultDeposit::doApply()
     auto const amount = ctx_.tx[sfAmount];
     // Make sure the depositor can hold shares.
     auto const mptIssuanceID = (*vault)[sfShareMPTID];
-    auto const sleIssuance = view().read(keylet::mptIssuance(mptIssuanceID));
+    SLE::const_pointer sleIssuance =
+        view().read(keylet::mptIssuance(mptIssuanceID));
     if (!sleIssuance)
     {
         // LCOV_EXCL_START
@@ -172,6 +176,8 @@ VaultDeposit::doApply()
     }
 
     auto const& vaultAccount = vault->at(sfAccount);
+    auto const& vaultAsset = vault->at(sfAsset);
+
     // Note, vault owner is always authorized
     if (vault->isFlag(lsfVaultPrivate) && account_ != vault->at(sfOwner))
     {
@@ -216,7 +222,8 @@ VaultDeposit::doApply()
         }
     }
 
-    STAmount sharesCreated = {vault->at(sfShareMPTID)}, assetsDeposited;
+    STAmount sharesCreated = {vault->at(sfShareMPTID)};
+    STAmount assetsDeposited = {vaultAsset};
     try
     {
         // Compute exchange before transferring any amounts.
@@ -242,13 +249,19 @@ VaultDeposit::doApply()
             // LCOV_EXCL_STOP
         }
         assetsDeposited = *maybeAssets;
+
+        // Deposit needs to be more strict than the other Vault transactions
+        // that deal with asset <-> share calculations, because we don't
+        // want to go over the "soft" limit.
+        if (!sharesCreated.validNumber() || !assetsDeposited.validNumber())
+            return tecPRECISION_LOSS;
     }
     catch (std::overflow_error const&)
     {
         // It's easy to hit this exception from Number with large enough Scale
         // so we avoid spamming the log and only use debug here.
         JLOG(j_.debug())  //
-            << "VaultDeposit: overflow error with"
+            << "VaultDeposit: overflow error computing shares with"
             << " scale=" << (int)vault->at(sfScale).value()  //
             << ", assetsTotal=" << vault->at(sfAssetsTotal).value()
             << ", sharesTotal=" << sleIssuance->at(sfOutstandingAmount)
@@ -262,43 +275,38 @@ VaultDeposit::doApply()
 
     auto assetsTotalProxy = vault->at(sfAssetsTotal);
     auto assetsAvailableProxy = vault->at(sfAssetsAvailable);
-
+    if (vaultAsset.value().integral())
+    {
+        assetsTotalProxy.value().setIsInteger(true);
+        assetsAvailableProxy.value().setIsInteger(true);
+    }
     assetsTotalProxy += assetsDeposited;
     assetsAvailableProxy += assetsDeposited;
-    view().update(vault);
+    if (!assetsTotalProxy.value().valid() ||
+        !assetsAvailableProxy.value().valid())
+    {
+        // It's easy to hit this exception from Number with large enough
+        // Scale so we avoid spamming the log and only use debug here.
+        JLOG(j_.warn())  //
+            << "VaultDeposit: integer overflow error in total assets with"
+            << " scale=" << (int)vault->at(sfScale).value()  //
+            << ", assetsTotal=" << vault->at(sfAssetsTotal).value()
+            << ", sharesTotal=" << sleIssuance->at(sfOutstandingAmount)
+            << ", amount=" << amount;
 
-    auto const asset = *vault->at(sfAsset);
-    if (auto stNumber = assetsTotalProxy.stValue();
-        stNumber && !stNumber->safeNumber(asset))
-    {
-        JLOG(j_.warn()) << "VaultDeposit: Invalid assets total value for "
-                           "integral asset type: "
-                        << *assetsTotalProxy << " > "
-                        << STNumber::safeNumberLimit();
         return tecPRECISION_LOSS;
     }
-    if (auto stNumber = assetsAvailableProxy.stValue();
-        stNumber && !stNumber->safeNumber(asset))
-    {
-        // LCOV_EXCL_START
-        // This should be impossible to reach because total should never be less
-        // than available, so if total is ok, available should be ok.
-        UNREACHABLE(
-            "ripple::VaultDeposit::doApply() : AssetsAvailable exceeds "
-            "AssetsTotal");
-        JLOG(j_.warn()) << "VaultDeposit: Invalid assets available value for "
-                           "integral asset type: "
-                        << *assetsAvailableProxy << " > "
-                        << STNumber::safeNumberLimit();
-        return tecPRECISION_LOSS;
-        // LCOV_EXCL_STOP
-    }
+
+    view().update(vault);
 
     // A deposit must not push the vault over its limit.
     auto const maximum = *vault->at(sfAssetsMaximum);
     if (maximum != 0 && *assetsTotalProxy > maximum)
         return tecLIMIT_EXCEEDED;
 
+    // Reset the sleIssance ptr, since it's about to get invalidated
+    sleIssuance.reset();
+
     // Transfer assets from depositor to vault.
     if (auto const ter = accountSend(
             view(),
@@ -336,6 +344,37 @@ VaultDeposit::doApply()
         !isTesSuccess(ter))
         return ter;
 
+    {
+        // Load the updated issuance
+        sleIssuance = view().read(keylet::mptIssuance(mptIssuanceID));
+        if (!sleIssuance)
+        {
+            // LCOV_EXCL_START
+            JLOG(j_.error())
+                << "VaultDeposit: missing issuance of vault shares.";
+            return tefINTERNAL;
+            // LCOV_EXCL_STOP
+        }
+
+        // Check if the deposit pushed the total over the integer Number limit.
+        // That is not a problem for the MPT itself, which is 64-bit, but for
+        // any computations that use it, such as converting assets to shares and
+        // vice-versa
+        STAmount const shareTotal{
+            vault->at(sfShareMPTID), sleIssuance->at(sfOutstandingAmount)};
+        if (!shareTotal.validNumber())
+        {
+            JLOG(j_.warn())  //
+                << "VaultDeposit: integer overflow error in total shares with"
+                << " scale=" << (int)vault->at(sfScale).value()  //
+                << ", assetsTotal=" << vault->at(sfAssetsTotal).value()
+                << ", sharesTotal=" << sleIssuance->at(sfOutstandingAmount)
+                << ", amount=" << amount;
+
+            return tecPRECISION_LOSS;
+        }
+    }
+
     return tesSUCCESS;
 }
 

src/xrpld/app/tx/detail/VaultSet.cpp

@@ -138,23 +138,17 @@ VaultSet::doApply()
     // Update mutable flags and fields if given.
     if (tx.isFieldPresent(sfData))
         vault->at(sfData) = tx[sfData];
-    if (tx.isFieldPresent(sfAssetsMaximum))
+    if (auto const value = tx[~sfAssetsMaximum])
     {
-        if (tx[sfAssetsMaximum] != 0 &&
-            tx[sfAssetsMaximum] < *vault->at(sfAssetsTotal))
+        if (*value != 0 && *value < *vault->at(sfAssetsTotal))
             return tecLIMIT_EXCEEDED;
-        auto assetsMaximumProxy = vault->at(~sfAssetsMaximum);
-        assetsMaximumProxy = tx[sfAssetsMaximum];
-        if (auto const stNumber = assetsMaximumProxy.stValue();
-            stNumber && !stNumber->validNumber(vault->at(sfAsset)))
+        auto assetsMaximumProxy = vault->at(sfAssetsMaximum);
+        assetsMaximumProxy = *value;
+        if (vault->at(sfAsset).value().integral())
         {
-            // LCOV_EXCL_START
-            // This should be impossible, because invalid values would have been
-            // stopped by `VaultCreate`.
-            UNREACHABLE(
-                "ripple::VaultSet::doApply : invalid assets maximum value");
-            return tecLIMIT_EXCEEDED;
-            // LCOV_EXCL_STOP
+            assetsMaximumProxy.value().setIsInteger(true);
+            if (!assetsMaximumProxy.value().representable())
+                return tecPRECISION_LOSS;
         }
     }
 

src/xrpld/app/tx/detail/VaultWithdraw.cpp

@@ -20,7 +20,10 @@ VaultWithdraw::preflight(PreflightContext const& ctx)
         return temMALFORMED;
     }
 
-    if (ctx.tx[sfAmount] <= beast::zero)
+    auto const amount = ctx.tx[sfAmount];
+    if (amount <= beast::zero)
+        return temBAD_AMOUNT;
+    if (!amount.representableNumber())
         return temBAD_AMOUNT;
 
     if (auto const destination = ctx.tx[~sfDestination];
@@ -153,7 +156,7 @@ VaultWithdraw::doApply()
     Asset const vaultAsset = vault->at(sfAsset);
     MPTIssue const share{mptIssuanceID};
     STAmount sharesRedeemed = {share};
-    STAmount assetsWithdrawn;
+    STAmount assetsWithdrawn = {vaultAsset};
     try
     {
         if (amount.asset() == vaultAsset)
@@ -187,6 +190,12 @@ VaultWithdraw::doApply()
         }
         else
             return tefINTERNAL;  // LCOV_EXCL_LINE
+        // Withdraw amounts are allowed to be invalid, but not unrepresentable.
+        // Amounts over the "soft" limit help bring the numbers back into the
+        // valid range.
+        if (!sharesRedeemed.representableNumber() ||
+            !assetsWithdrawn.representableNumber())
+            return tecPRECISION_LOSS;
     }
     catch (std::overflow_error const&)
     {
@@ -213,6 +222,8 @@ VaultWithdraw::doApply()
         return tecINSUFFICIENT_FUNDS;
     }
 
+    // These values are only going to decrease, and can't be less than 0, so
+    // there's no need for integer range enforcement.
     auto assetsAvailable = vault->at(sfAssetsAvailable);
     auto assetsTotal = vault->at(sfAssetsTotal);
     [[maybe_unused]] auto const lossUnrealized = vault->at(sfLossUnrealized);