2025 10 20 audit #93
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,70 +1,70 @@ | ||
| LibBloomTest:testLibBloomNoFalseNegatives(bytes32[],uint256,uint256) (runs: 1976, μ: 40655, ~: 35438) | ||
| LibBloomTest:testLibBloomVaguelyAvoidsFalsePositives(uint256,uint8) (runs: 2048, μ: 1581001, ~: 22262) | ||
| LibBytecodeCheckNoOOBPointersTest:testCheckNoOOBPointers0() (gas: 427) | ||
| LibBytecodeCheckNoOOBPointersTest:testCheckNoOOBPointers1() (gas: 455) | ||
| LibBytecodeCheckNoOOBPointersTest:testCheckNoOOBPointers1Fail(bytes) (runs: 2022, μ: 6776, ~: 6596) | ||
| LibBytecodeCheckNoOOBPointersTest:testCheckNoOOBPointersConforming(bytes,uint256,bytes32) (runs: 2048, μ: 18887, ~: 16837) | ||
| LibBytecodeCheckNoOOBPointersTest:testCheckNoOOBPointersCorruptOffsetPointer(bytes,uint8,bytes32,uint8) (runs: 1339, μ: 25442, ~: 22955) | ||
| LibBytecodeCheckNoOOBPointersTest:testCheckNoOOBPointersCorruptOpsCount(bytes,uint8,bytes32,uint8) (runs: 1399, μ: 25991, ~: 23574) | ||
| LibBytecodeCheckNoOOBPointersTest:testCheckNoOOBPointersCorruptSourcesCount(bytes,uint8,bytes32,uint8) (runs: 1871, μ: 21201, ~: 19864) | ||
| LibBytecodeCheckNoOOBPointersTest:testCheckNoOOBPointersEndGarbage(bytes,bytes) (runs: 2023, μ: 18234, ~: 16943) | ||
| LibBytecodeCheckNoOOBPointersTest:testCheckNoOOBPointersHeaderTruncated(bytes,uint8,bytes32,uint256) (runs: 1464, μ: 27962, ~: 25534) | ||
| LibBytecodeCheckNoOOBPointersTest:testCheckNoOOBPointersInputsNotMonotonic(bytes,uint8,bytes32,uint256,uint256) (runs: 1481, μ: 30614, ~: 27673) | ||
| LibBytecodeCheckNoOOBPointersTest:testCheckNoOOBPointersOffsetsTruncated(bytes,uint8,uint256) (runs: 1756, μ: 11314, ~: 11319) | ||
| LibBytecodeCheckNoOOBPointersTest:testCheckNoOOBPointersOutputsNotMonotonic(bytes,uint8,bytes32,uint256,uint256) (runs: 1481, μ: 30611, ~: 27640) | ||
| LibBytecodeCheckNoOOBPointersTest:testCheckNoOOBPointersSourceTruncated(bytes,uint8,bytes32,uint8) (runs: 1399, μ: 26658, ~: 24197) | ||
| LibBytecodeCheckNoOOBPointersTest:testCheckNoOOBPointersTrailingOffsetBytes(bytes,bytes,uint8,bytes32) (runs: 1473, μ: 31407, ~: 27697) | ||
| LibBytecodeSourceCountTest:testSourceCount0() (gas: 349) | ||
| LibBytecodeSourceCountTest:testSourceCount1(bytes) (runs: 2037, μ: 3619, ~: 3616) | ||
| LibBytecodeSourceCountTest:testSourceCountReference(bytes) (runs: 2048, μ: 836, ~: 833) | ||
| LibBytecodeSourceInputsOutputsTest:testSourceInputsOutputsAgainstSlow(bytes,uint256,uint256,bytes32) (runs: 1657, μ: 27607, ~: 23995) | ||
| LibBytecodeSourceInputsOutputsTest:testSourceInputsOutputsIndexOutOfBounds(bytes,uint256,uint256,bytes32) (runs: 2048, μ: 25469, ~: 22729) | ||
| LibBytecodeSourceOpsCountTest:testSourceOpsCount() (gas: 2212) | ||
| LibBytecodeSourceOpsCountTest:testSourceOpsCountAgainstSlow(bytes,uint256,uint256,bytes32) (runs: 1641, μ: 27558, ~: 23821) | ||
| LibBytecodeSourceOpsCountTest:testSourceOpsCountIndexOutOfBounds(bytes,uint256,uint256,bytes32) (runs: 2048, μ: 25366, ~: 22648) | ||
| LibBytecodeSourcePointerTest:testSourcePointerAgainstSlow(bytes,uint256,uint256,bytes32) (runs: 1634, μ: 27269, ~: 23675) | ||
| LibBytecodeSourcePointerTest:testSourcePointerEmpty0(uint256) (runs: 2048, μ: 5775, ~: 5775) | ||
| LibBytecodeSourcePointerTest:testSourcePointerEmpty1(uint256) (runs: 2048, μ: 6158, ~: 6158) | ||
| LibBytecodeSourcePointerTest:testSourcePointerIndexOutOfBounds(bytes,uint256,uint256,bytes32) (runs: 2048, μ: 25195, ~: 22360) | ||
| LibBytecodeSourceRelativeOffsetTest:testSourceRelativeOffsetHappy() (gas: 1237) | ||
| LibBytecodeSourceRelativeOffsetTest:testSourceRelativeOffsetIndexError() (gas: 95395) | ||
| LibBytecodeSourceRelativeOffsetTest:testSourceRelativeOffsetReference(bytes,uint256,uint256,bytes32) (runs: 1639, μ: 26790, ~: 23115) | ||
| LibBytecodeSourceStackAllocationTest:testSourceStackAllocationAgainstSlow(bytes,uint256,uint256,bytes32) (runs: 1625, μ: 27554, ~: 23875) | ||
| LibBytecodeSourceStackAllocationTest:testSourceStackAllocationIndexOutOfBounds(bytes,uint256,uint256,bytes32) (runs: 2048, μ: 25197, ~: 22550) | ||
| LibContextHashTest:testFuzzHash0() (gas: 3552) | ||
| LibContextHashTest:testHash(uint256) (runs: 2048, μ: 282, ~: 282) | ||
| LibContextHashTest:testHashGas0() (gas: 208) | ||
| LibContextHashTest:testSignedContextArrayHashReferenceImplementation((address,bytes32[],bytes)[]) (runs: 100, μ: 2616738, ~: 2348780) | ||
| LibContextHashTest:testSignedContextArrayHashReferenceImplementation0() (gas: 2190) | ||
| LibContextHashTest:testSignedContextHashEncodeGas0() (gas: 1683) | ||
| LibContextHashTest:testSignedContextHashGas0() (gas: 827) | ||
| LibContextHashTest:testSignedContextHashReferenceImplementation((address,bytes32[],bytes)) (runs: 100, μ: 13613, ~: 13205) | ||
| LibContextTest:testBase() (gas: 616) | ||
| LibContextTest:testBuild0() (gas: 5028) | ||
| LibContextTest:testBuildGas0() (gas: 962) | ||
| LibContextTest:testBuildStructureReferenceImplementation(bytes32[][]) (runs: 100, μ: 4643768, ~: 4795790) | ||
| LibDeployerDiscoverableTest:testTouchDeployerV4Mock() (gas: 184831) | ||
| LibEncodedDispatchTest:testRoundTrip(address,uint256,uint16) (runs: 2048, μ: 4498, ~: 4781) | ||
| LibEvaluableTest:testEvaluableV2HashDifferent((address,address,address),(address,address,address)) (runs: 2048, μ: 4238, ~: 4238) | ||
| LibEvaluableTest:testEvaluableV2HashGas0() (gas: 297) | ||
| LibEvaluableTest:testEvaluableV2HashGasSlow0() (gas: 583) | ||
| LibEvaluableTest:testEvaluableV2HashSame((address,address,address)) (runs: 2048, μ: 1006, ~: 1006) | ||
| LibEvaluableTest:testEvaluableV2HashSensitivity((address,address,address),(address,address,address)) (runs: 2045, μ: 6002, ~: 6002) | ||
| LibEvaluableTest:testEvaluableV2KnownHash() (gas: 354) | ||
| LibEvaluableTest:testEvaluableV2ReferenceImplementation((address,address,address)) (runs: 2048, μ: 1070, ~: 1070) | ||
| LibEvaluableTest:testEvaluableV3BytecodeLengthSensitivity() (gas: 901) | ||
| LibEvaluableTest:testEvaluableV3HashDifferent((address,address,bytes),(address,address,bytes)) (runs: 2048, μ: 5194, ~: 5192) | ||
| LibEvaluableTest:testEvaluableV3HashGas0() (gas: 431) | ||
| LibEvaluableTest:testEvaluableV3HashGasSlow0() (gas: 764) | ||
| LibEvaluableTest:testEvaluableV3HashSame((address,address,bytes)) (runs: 2048, μ: 1605, ~: 1594) | ||
| LibEvaluableTest:testEvaluableV3HashSensitivity((address,address,bytes),(address,address,bytes)) (runs: 2047, μ: 8339, ~: 8312) | ||
| LibEvaluableTest:testEvaluableV3KnownHash() (gas: 604) | ||
| LibEvaluableTest:testEvaluableV3ReferenceImplementation((address,address,bytes)) (runs: 2048, μ: 1711, ~: 1700) | ||
| LibGenParseMetaBuildMetaTest:testBuildMeta((bytes32,string)[]) (runs: 746, μ: 3740032, ~: 2814714) | ||
| LibGenParseMetaBuildMetaTest:testRoundMetaExpanderDeeper((bytes32,string)[],uint8,bytes32) (runs: 364, μ: 6840949, ~: 6501238) | ||
| LibGenParseMetaBuildMetaTest:testRoundMetaExpanderShallow((bytes32,string)[],uint8,bytes32) (runs: 717, μ: 3598305, ~: 2882702) | ||
| LibGenParseMetaFindExpanderTest:testFindExpanderSmall((bytes32,string)[]) (runs: 254, μ: 43912, ~: 33558) | ||
| LibNamespaceTest:testQualifyNamespaceGas0(uint256,address) (runs: 2048, μ: 362, ~: 362) | ||
| LibNamespaceTest:testQualifyNamespaceGasSlow0(uint256,address) (runs: 2048, μ: 569, ~: 569) | ||
| LibNamespaceTest:testQualifyNamespaceReferenceImplementation(uint256,address) (runs: 2048, μ: 726, ~: 726) | ||
| LitParseMetaTest:testWordBitmapped(uint256,bytes32) (runs: 2048, μ: 969, ~: 969) | ||
|
There was a problem hiding this comment. 🧩 Analysis chainPossible test name typo: LitParseMetaTest Is “LitParseMetaTest” intended, or should it be “LibParseMetaTest”? If unintentional, fix to avoid confusion and search misses. 🏁 Script executed: #!/bin/bash
set -euo pipefail
rg -nP '\bLitParseMetaTest\b|\bLibParseMetaTest\b' -n || trueLength of output: 89 I'll verify whether this is truly a typo by checking the library being tested and the naming convention used in the codebase.The web search is general and doesn't tell me about the specific library. Let me search more specifically for this codebase to understand the actual library naming. Let me also check the test file structure to understand the naming convention better: Length of output: 168 🏁 Script executed: #!/bin/bash
set -euo pipefail
# Check the actual test file content to see what library is imported
cat test/src/lib/parse/LibParseMeta.wordBitmapped.t.sol | head -20Length of output: 945 Let me verify this is consistent with naming conventions used elsewhere in the test suite:Now let me check other test files in the codebase to confirm the naming pattern: Length of output: 168 Length of output: 27 Length of output: 1019 Fix test contract name: LitParseMetaTest → LibParseMetaTest The test contract name is a typo. All test contracts in the codebase follow the pattern Rename the contract at line 9 of 🤖 Prompt for AI Agents |
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,29 +1,29 @@ | ||
| { | ||
| "lib/forge-std": { | ||
| "rev": "b8f065fda83b8cd94a6b2fec8fcd911dc3b444fd" | ||
| }, | ||
| "lib/openzeppelin-contracts": { | ||
| "rev": "dc44c9f1a4c3b10af99492eed84f83ed244203f6" | ||
| }, | ||
| "lib/rain.intorastring": { | ||
| "rev": "82bc048226050a0e33c01c9f4282f3349a27e491" | ||
| }, | ||
| "lib/rain.lib.hash": { | ||
| "rev": "97609eecc66fe2e30f37e48834eed4a71304af32" | ||
| }, | ||
| "lib/rain.lib.typecast": { | ||
| "rev": "6bf6e0e63bfbff37d9057332ff042a8158397681" | ||
| }, | ||
| "lib/rain.math.binary": { | ||
| "rev": "54450d62a89be456d07db1b9508f3b8a24dbb5f8" | ||
| }, | ||
| "lib/rain.math.float": { | ||
| "rev": "35b7b3980cdeab2f245dad17ee84658c1065648d" | ||
| }, | ||
| "lib/rain.sol.codegen": { | ||
| "rev": "00734d24d91db3fc4aac87c0a3c885de28449f96" | ||
| }, | ||
| "lib/rain.solmem": { | ||
| "rev": "c1c22cf27963a9de0889ebf7f52869050f1fdfb9" | ||
| } | ||
| } |
Submodule forge-std
updated
7 files
| +3 −3 | .github/workflows/ci.yml | |
| +1 −1 | package.json | |
| +5 −0 | src/StdChains.sol | |
| +4 −0 | src/StdMath.sol | |
| +21 −0 | src/Vm.sol | |
| +2 −2 | test/StdMath.t.sol | |
| +1 −1 | test/Vm.t.sol |
Submodule rain.intorastring
updated
7 files
| +10 −10 | .gas-snapshot | |
| +2 −1 | REUSE.toml | |
| +21 −21 | flake.lock | |
| +8 −0 | foundry.lock | |
| +1 −1 | lib/forge-std | |
| +1 −1 | lib/rain.solmem | |
| +1 −1 | test/src/lib/LibIntOrAString.t.sol |
Submodule rain.lib.hash
updated
5 files
| +7 −7 | .gas-snapshot | |
| +2 −1 | REUSE.toml | |
| +21 −21 | flake.lock | |
| +5 −0 | foundry.lock | |
| +1 −1 | lib/forge-std |
Submodule rain.lib.typecast
updated
4 files
| +2 −1 | REUSE.toml | |
| +21 −21 | flake.lock | |
| +5 −0 | foundry.lock | |
| +1 −1 | lib/forge-std |
Submodule rain.math.binary
updated
4 files
| +2 −1 | REUSE.toml | |
| +21 −21 | flake.lock | |
| +5 −0 | foundry.lock | |
| +1 −1 | lib/forge-std |
Submodule rain.math.float
updated
16 files
| +286 −286 | .gas-snapshot | |
| +10 −0 | .github/workflows/manual-sol-artifacts.yaml | |
| +2 −1 | REUSE.toml | |
| +95 −52 | crates/float/src/js_api.rs | |
| +80 −19 | crates/float/src/lib.rs | |
| +3 −3 | flake.lock | |
| +17 −0 | foundry.lock | |
| +1 −1 | lib/forge-std | |
| +1 −1 | lib/rain.datacontract | |
| +1 −1 | lib/rain.math.fixedpoint | |
| +1 −1 | lib/rain.sol.codegen | |
| +1 −1 | lib/rain.string | |
| +2 −2 | package-lock.json | |
| +1 −1 | package.json | |
| +12 −2 | script/Deploy.sol | |
| +22 −0 | test_js/float.test.ts |
Submodule rain.sol.codegen
updated
7 files
| +0 −2 | .gas-snapshot | |
| +2 −1 | REUSE.toml | |
| +21 −21 | flake.lock | |
| +8 −0 | foundry.lock | |
| +1 −1 | lib/forge-std | |
| +1 −1 | lib/rain.math.binary | |
| +2 −0 | src/lib/LibFs.sol |
Submodule rain.solmem
updated
4 files
| +113 −113 | .gas-snapshot | |
| +3 −3 | flake.lock | |
| +1 −1 | foundry.lock | |
| +1 −1 | lib/forge-std |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,6 +2,8 @@ | |
| // SPDX-FileCopyrightText: Copyright (c) 2020 Rain Open Source Software Ltd | ||
| pragma solidity ^0.8.18; | ||
|
|
||
| // Exported for convenience. | ||
| //forge-lint: disable-next-line(unused-import) | ||
| import {EncodedExternDispatch, ExternDispatch} from "./IInterpreterExternV1.sol"; | ||
|
Comment on lines
+5
to
7
There was a problem hiding this comment. 🧩 Analysis chainVerify: ExternDispatch is actively used in this interface. The imported type 🏁 Script executed: #!/bin/bash
# Verify usage of imported types in IInterpreterExternV2.sol
rg -n "EncodedExternDispatch|ExternDispatch" src/interface/deprecated/IInterpreterExternV2.solLength of output: 158 ExternDispatch is actively used; lint suppression scope is overly broad. The grep results confirm that 🤖 Prompt for AI Agents |
||
|
|
||
| /// @title IInterpreterExternV2 | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🛠️ Refactor suggestion | 🟠 Major
🧩 Analysis chain
Evaluable hashes — add V4 coverage if public struct was added
V2/V3 hash tests look steady. If a public EvaluableV4 type was introduced in this PR, please add analogous V4 hash/known‑hash/reference tests so it appears in the snapshot too.
🏁 Script executed:
Length of output: 477
🏁 Script executed:
Length of output: 291
🏁 Script executed:
Length of output: 168
🏁 Script executed:
Length of output: 561
🏁 Script executed:
Length of output: 1387
Add V4 hash test coverage to match V2/V3 pattern
EvaluableV4 struct has been introduced in
src/interface/unstable/IInterpreterCallerV4.sol, but no corresponding tests exist intest/src/lib/caller/LibEvaluable.t.sol. Add the following V4 tests to provide coverage equivalent to V2/V3:testEvaluableV4KnownHashtestEvaluableV4HashDifferenttestEvaluableV4HashSametestEvaluableV4HashSensitivitytestEvaluableV4HashGas0testEvaluableV4HashGasSlow0testEvaluableV4ReferenceImplementationThis will ensure V4 appears in the snapshot alongside V2/V3.
🤖 Prompt for AI Agents