MetaMask / MetaMask/core

[utils] Drop the `web3` devDependency and replace the differential unit conversion test

Open
#10,212 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
413
Forks
308
Avg merge
1d 4h
Merged PRs (30d)
253

Description

`packages/utils` declares `web3@^4.16.0` as a devDependency. It backs exactly one test out of 78 in `src/unitsConversion.test.ts`, a randomised differential check of `toWei` and `fromWei` against web3's implementations. Nothing else in the package imports it.

It is not cheap. It came in with the migration ([#10185](https://github.com/MetaMask/core/pull/10185)) and added 42 of the 43 new entries in `yarn.lock`, 19 of them `web3-*` packages, roughly 3.5MB in `node_modules`. Every Socket Security alert on that PR traced back to it, ten in all, two of them blocking.

The `fromWei` half of the test earns very little for that price:

```ts
// skips the cases where web3 itself is wrong
if (web3Value.includes('-') && !web3Value.startsWith('-')) {
return;
}

const unitsValueAsNumber = parseFloat(unitsValue);
const web3ValueAsNumber = parseFloat(web3Value);

const tolerance = 1e-10;
expect(Math.abs(unitsValueAsNumber - web3ValueAsNumber)).toBeLessThan(tolerance);
```

It skips the inputs where web3 has a known formatting bug, then compares through `parseFloat` with a `1e-10` tolerance. At wei scale `parseFloat` cannot represent that precision, so the assertion passes on values it should not.

Proposal: replace the differential test with fixed vectors covering the same ground (every unit in `unitMap`, negatives, boundaries, round tripping) and drop the `web3` devDependency. That removes 42 packages from the tree and all ten Socket alerts.

Worth doing alongside #10209, which fixes a real `toWei` bug in the same file.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in packages/utils/src/unitsConversion.test.ts and inspect the existing randomized differential test, unitMap, and the toWei/fromWei cases. Replace that check with fixed vectors covering each unit, negatives, boundaries, and round trips, then remove web3 from the packages/utils development dependencies. Run the package tests and confirm the dependency tree no longer includes it.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
testing, tooling
Issue type
Refactor
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.