pyth-network / pyth-network/pyth-crosschain

Docs/DX: Clarify on-chain validation and lack of pre-validation for price update payloads

Open Beginner friendly
#3,653 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
247
Forks
348
Avg merge
2d 1h
Merged PRs (30d)
27

Description

Description

While integrating Pyth price updates via the SDK and EVM contracts, it is not स्पष्ट in the documentation that payload validation (e.g., VAA integrity and data source checks) occurs strictly on-chain.

As a result, developers may submit invalid price_update payloads that are only rejected at execution time with errors such as InvalidWormholeVaa() or InvalidUpdateDataSource().


Current Behavior

  • SDK forwards payloads without explicit validation feedback

  • Invalid payloads are accepted client-side

  • Transaction reverts on-chain with:

    • InvalidWormholeVaa()
    • InvalidUpdateDataSource()

Minimal Reproduction

  1. Fetch a valid price update payload (via Hermes or examples)

  2. Modify the payload (e.g., truncate bytes or alter a segment)

  3. Submit via updatePriceFeeds (or equivalent)

  4. Observe:

    • No SDK-side validation error
    • On-chain revert with InvalidWormholeVaa()

This demonstrates that invalid payloads are only detected at contract level.


Why This Matters

  • Developers may assume payload correctness before submission
  • Failed transactions increase iteration cost (gas + time)
  • Debugging requires decoding revert reasons instead of early feedback

Documentation Gap

It is not clearly stated that:

  • Payload validation is exclusively enforced on-chain

  • The SDK does not pre-validate:

    • Wormhole VAA structure
    • Data source / emitter correctness

Suggested Improvement (Docs Only)

  • Add a short note in README or docs:

    • Clarifying that validation occurs on-chain
    • Warning that malformed payloads will revert
  • Optionally reference best practices (e.g., simulation, payload sourcing)


Scope

Documentation and developer experience only.
No claim of contract bug or security issue.


Impact

Improves onboarding clarity and reduces avoidable failed transactions during integration.


Labels Suggested: documentation, developer-experience

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the README or documentation covering SDK price updates, and review the existing Hermes/examples guidance and the updatePriceFeeds flow described in the issue. Add a concise warning that malformed payloads are validated on-chain and may revert, noting the lack of SDK-side validation; the documentation should clearly explain this behavior and possible simulation or sourcing practices.

Written by the indexing model from the issue text.

Assessment

Domain
developer-experience, documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.