base / base/account-sdk

Bug: account-cli CAIP-2 validator accepts references longer than 32 characters

Open Beginner friendly
#391 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
172
Forks
207
Avg merge
49m
Merged PRs (30d)
1

Description

### Describe the bug

The CAIP-2 validation helper in account-cli accepts chain identifiers whose reference component exceeds the CAIP-2 maximum length of 32 characters. The current validator allows references up to 64 characters, so references containing 33–64 characters can be treated as valid CAIP-2 chain identifiers.

### Steps

1. Open `packages/account-cli/src/utils/caip.ts`.

2. Call `isValidChainId()` with CAIP-2 identifiers whose reference components are 32 and 33 characters long.

3. For example:

```ts
const ref32 = "a".repeat(32);
const ref33 = "a".repeat(33);

isValidChainId(`example:${ref32}`); // true
isValidChainId(`example:${ref33}`); // currently true
```

4. Observe that the 33-character reference is accepted even though CAIP-2 limits the reference component to 32 characters.

### Expected behavior

A CAIP-2 reference containing up to 32 characters should be accepted, while a reference longer than 32 characters should be rejected.

For example:

isValidChainId(`example:${"a".repeat(32)}`) // true
isValidChainId(`example:${"a".repeat(33)}`) // false

### Version

Current main branch

### Additional info

The current CAIP-2 validator uses:

```ts
const CAIP2_RE = /^[-a-z0-9]{3,8}:[-_a-zA-Z0-9]{1,64}$/;
```

CAIP-2 limits the reference component to 1–32 characters, so the current `{1,64}` range allows identifiers outside the specification.

A possible fix would be to change the reference bound to `{1,32}` and add boundary tests for 32-character and 33-character references.

CAIP-2 specification:
https://standards.chainagnostic.org/CAIPs/caip-2

### Desktop

N/A — this is a source-level CAIP-2 validation issue and is not specific to a desktop OS or browser.

### Smartphone

N/A — not device-specific.

Contributor guide

Open the contributing guide

Research direction

Open packages/account-cli/src/utils/caip.ts and start with isValidChainId() and the CAIP2_RE definition. Add boundary tests for 32- and 33-character references; done means 32 characters are accepted and 33 characters are rejected while the existing CAIP-2 validation behavior remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
cli
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
90/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.