0xMiden / 0xMiden/turnkey-sdk

hexToBytes silently converts invalid hex characters to zero bytes

Abierto
#18 0 comentarios 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
JavaScript
Estrellas
3
Forks
4
Merge medio
23 min
PR fusionados (30 d)
2

Descripción

`hexToBytes()` only checks for even length before parsing each byte with `parseInt(..., 16)`. Invalid hex pairs return `NaN`, and assigning `NaN` into a `Uint8Array` silently stores `0`.

File evidence:

- `src/utils.ts` strips an optional `0x` prefix and checks `hex.length % 2`.
- It then assigns `parseInt(`${hex[i]}${hex[i + 1]}`, 16)` into a `Uint8Array` without checking whether the result is `NaN`.
- The helper is used by `fromTurnkeySig()` for signature bytes and by `evmPkToCommitment()` for public key commitment derivation.

Examples like `0xZZZZ` or `0x12ZZ` therefore produce zero bytes instead of throwing. Invalid hex input should be rejected before it can affect signature or key material.

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.