Bug: account-cli CAIP-2 validator accepts references longer than 32 characters
- Dominant language
- TypeScript
- Stars
- 172
- Forks
- 207
- Avg merge
- 49m
- Merged PRs (30d)
- 1
Description
### Describe the bug
The CAIP-2 validation helper in account-cli accepts chain identifiers whose reference component exceeds the CAIP-2 maximum length of 32 characters. The current validator allows references up to 64 characters, so references containing 33–64 characters can be treated as valid CAIP-2 chain identifiers.
### Steps
1. Open `packages/account-cli/src/utils/caip.ts`.
2. Call `isValidChainId()` with CAIP-2 identifiers whose reference components are 32 and 33 characters long.
3. For example:
```ts
const ref32 = "a".repeat(32);
const ref33 = "a".repeat(33);
isValidChainId(`example:${ref32}`); // true
isValidChainId(`example:${ref33}`); // currently true
```
4. Observe that the 33-character reference is accepted even though CAIP-2 limits the reference component to 32 characters.
### Expected behavior
A CAIP-2 reference containing up to 32 characters should be accepted, while a reference longer than 32 characters should be rejected.
For example:
isValidChainId(`example:${"a".repeat(32)}`) // true
isValidChainId(`example:${"a".repeat(33)}`) // false
### Version
Current main branch
### Additional info
The current CAIP-2 validator uses:
```ts
const CAIP2_RE = /^[-a-z0-9]{3,8}:[-_a-zA-Z0-9]{1,64}$/;
```
CAIP-2 limits the reference component to 1–32 characters, so the current `{1,64}` range allows identifiers outside the specification.
A possible fix would be to change the reference bound to `{1,32}` and add boundary tests for 32-character and 33-character references.
CAIP-2 specification:
https://standards.chainagnostic.org/CAIPs/caip-2
### Desktop
N/A — this is a source-level CAIP-2 validation issue and is not specific to a desktop OS or browser.
### Smartphone
N/A — not device-specific.
Contributor guide
Research direction
Open packages/account-cli/src/utils/caip.ts and start with isValidChainId() and the CAIP2_RE definition. Add boundary tests for 32- and 33-character references; done means 32 characters are accepted and 33 characters are rejected while the existing CAIP-2 validation behavior remains intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 90/100