[utils] Drop the `web3` devDependency and replace the differential unit conversion test
- Dominant language
- TypeScript
- Stars
- 413
- Forks
- 308
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 253
Description
`packages/utils` declares `web3@^4.16.0` as a devDependency. It backs exactly one test out of 78 in `src/unitsConversion.test.ts`, a randomised differential check of `toWei` and `fromWei` against web3's implementations. Nothing else in the package imports it.
It is not cheap. It came in with the migration ([#10185](https://github.com/MetaMask/core/pull/10185)) and added 42 of the 43 new entries in `yarn.lock`, 19 of them `web3-*` packages, roughly 3.5MB in `node_modules`. Every Socket Security alert on that PR traced back to it, ten in all, two of them blocking.
The `fromWei` half of the test earns very little for that price:
```ts
// skips the cases where web3 itself is wrong
if (web3Value.includes('-') && !web3Value.startsWith('-')) {
return;
}
const unitsValueAsNumber = parseFloat(unitsValue);
const web3ValueAsNumber = parseFloat(web3Value);
const tolerance = 1e-10;
expect(Math.abs(unitsValueAsNumber - web3ValueAsNumber)).toBeLessThan(tolerance);
```
It skips the inputs where web3 has a known formatting bug, then compares through `parseFloat` with a `1e-10` tolerance. At wei scale `parseFloat` cannot represent that precision, so the assertion passes on values it should not.
Proposal: replace the differential test with fixed vectors covering the same ground (every unit in `unitMap`, negatives, boundaries, round tripping) and drop the `web3` devDependency. That removes 42 packages from the tree and all ten Socket alerts.
Worth doing alongside #10209, which fixes a real `toWei` bug in the same file.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in packages/utils/src/unitsConversion.test.ts and inspect the existing randomized differential test, unitMap, and the toWei/fromWei cases. Replace that check with fixed vectors covering each unit, negatives, boundaries, and round trips, then remove web3 from the packages/utils development dependencies. Run the package tests and confirm the dependency tree no longer includes it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- testing, tooling
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100