fix(core): BigInt for gasUsed + topicToAddress length guard - #161
Merged
Conversation
Two low-severity fixes from codebase audit: 1. `fetcher.ts`: Replace `parseInt(frame.gasUsed, 16)` with `BigInt(frame.gasUsed)` for gasUsed extraction. `parseInt` returns an IEEE 754 double which loses precision above 2^53. While gas values fit today, this is inconsistent with the rest of the codebase which uses BigInt for hex-to-number conversions. Also simplifies the NaN fallback to a try/catch. 2. `event-decoder.ts`: Add length guard to `topicToAddress()`. If a topic is shorter than 42 chars (a valid 32-byte topic is 66 chars), `slice(26)` would produce a truncated or empty address. This guards against malformed trace data from unvalidated RPC responses during generation. Returns the zero address for short topics. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
A 32-byte topic is 66 chars ("0x" + 64 hex). The guard used 42
(address length) instead of 66 (topic length), allowing topics
between 42-65 chars to produce truncated addresses.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two low-severity fixes from codebase audit:
1.
parseInt→BigIntfor gasUsed (fetcher.ts:736-741)parseInt(frame.gasUsed, 16)returns an IEEE 754 double, losing precision aboveNumber.MAX_SAFE_INTEGER(2^53). The rest of the codebase consistently usesBigIntfor hex-to-number conversions. Replaced withBigInt()in a try/catch, which also simplifies the NaN fallback logic.2.
topicToAddresslength guard (event-decoder.ts:81-83)If a log topic from an unvalidated
debug_traceCallresponse is shorter than 42 characters,topic.slice(26)produces a truncated or empty string, resulting in"0x"— an invalid address. Added a guard that returns the zero address for malformed short topics.Test plan
🤖 Generated with Claude Code
Note
Low Risk
Low risk, localized robustness fixes in simulation decoding; behavior only changes for malformed
debug_traceCallresponses or very largegasUsedvalues whereparseIntcould lose precision.Overview
Improves simulation trace decoding robustness.
gasUsedparsed fromdebug_traceCallnow usesBigInt(with try/catch) instead ofparseInt, preventing precision loss for large values and simplifying failure handling.topicToAddressnow guards against too-short topics and returns the zero address rather than producing an invalid/truncated address.Written by Cursor Bugbot for commit f4862bb. This will update automatically on new commits. Configure here.