OpenZeppelin / OpenZeppelin/contracts-wizard
Solidity: Validate user-supplied option strings at build entry points
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 294
- Forks
- 186
- Avg merge
- 6h 46m
- Merged PRs (30d)
- 22
Description
Some characters in user-supplied option strings (name, symbol, uri) can't round-trip cleanly through generated Solidity contracts — ASCII control characters, Unicode line terminators recognised by Solidity's lexer (NEL, LS, PS, VT, FF), and lone UTF-16 surrogates. Today, some of these slip through and produce non-compiling Solidity or contracts that store unexpected bytes.
Add input validation at each build entry point (buildERC20, buildERC721, etc.) to reject these characters with an OptionsError, so the failure surfaces at the build boundary rather than downstream.
A WIP here covers the solidity package. The confidential (buildERC7984) and uniswap-hooks (buildHooks) packages need the same treatment.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the WIP validateSolidityStrings branch and its validation in the solidity package. Then inspect the buildERC20/buildERC721 entry points and the confidential buildERC7984 and uniswap-hooks buildHooks packages. Done means each build boundary rejects the listed invalid characters with an OptionsError before generating Solidity.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- solidity, typescript
- Domain
- blockchain, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100