flashbots / flashbots/mev-boost-relay

fix: silent data corruption from ignored setstring error in newbuilderbids

Open Beginner friendly
#788 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
498
Forks
147
PR merge metrics
No merged PRs in 30d

Description

## Description

In `NewBuilderBids`, `big.Int.SetString()` returns `(value, ok)` where ok indicates success, but the return value is completely ignored. If any Redis-stored bid value contains invalid characters for base-10 parsing (e.g., malformed data, corruption, or malicious input), `SetString` will fail silently - the bid value will remain at its zero-initialized `big.Int` (0) instead of the actual value. This corrupts auction calculations since zero bids will be considered, potentially causing invalid block selections or fund loss.

**Severity**: `high`
**File**: `datastore/utils.go`

## Expected Behavior

The code should handle this case properly to avoid unexpected errors or degraded quality.

Contributor guide

Open the contributing guide

Research direction

Start in datastore/utils.go at NewBuilderBids and inspect how Redis-stored bid values are passed to big.Int.SetString. Trace the existing error-handling path, then verify that malformed values no longer silently remain zero and that the resulting failure is handled visibly.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, redis
Domain
backend, databases
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.