flashbots / flashbots/mev-boost-relay
fix: silent data corruption from ignored setstring error in newbuilderbids
- Dominant language
- Go
- Stars
- 498
- Forks
- 147
- PR merge metrics
- No merged PRs in 30d
Description
## Description
In `NewBuilderBids`, `big.Int.SetString()` returns `(value, ok)` where ok indicates success, but the return value is completely ignored. If any Redis-stored bid value contains invalid characters for base-10 parsing (e.g., malformed data, corruption, or malicious input), `SetString` will fail silently - the bid value will remain at its zero-initialized `big.Int` (0) instead of the actual value. This corrupts auction calculations since zero bids will be considered, potentially causing invalid block selections or fund loss.
**Severity**: `high`
**File**: `datastore/utils.go`
## Expected Behavior
The code should handle this case properly to avoid unexpected errors or degraded quality.
Contributor guide
Research direction
Start in datastore/utils.go at NewBuilderBids and inspect how Redis-stored bid values are passed to big.Int.SetString. Trace the existing error-handling path, then verify that malformed values no longer silently remain zero and that the resulting failure is handled visibly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, redis
- Domain
- backend, databases
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100