hexToBytes silently converts invalid hex characters to zero bytes
- Lenguaje dominante
- JavaScript
- Estrellas
- 3
- Forks
- 4
- Merge medio
- 23 min
- PR fusionados (30 d)
- 2
Descripción
`hexToBytes()` only checks for even length before parsing each byte with `parseInt(..., 16)`. Invalid hex pairs return `NaN`, and assigning `NaN` into a `Uint8Array` silently stores `0`.
File evidence:
- `src/utils.ts` strips an optional `0x` prefix and checks `hex.length % 2`.
- It then assigns `parseInt(`${hex[i]}${hex[i + 1]}`, 16)` into a `Uint8Array` without checking whether the result is `NaN`.
- The helper is used by `fromTurnkeySig()` for signature bytes and by `evmPkToCommitment()` for public key commitment derivation.
Examples like `0xZZZZ` or `0x12ZZ` therefore produce zero bytes instead of throwing. Invalid hex input should be rejected before it can affect signature or key material.
Guía de contribución
Evaluación
Este issue todavía no se ha evaluado.