pyth-network / pyth-network/pyth-crosschain
Docs/DX: Clarify on-chain validation and lack of pre-validation for price update payloads
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 247
- Forks
- 348
- Avg merge
- 2d 1h
- Merged PRs (30d)
- 27
Description
Description
While integrating Pyth price updates via the SDK and EVM contracts, it is not स्पष्ट in the documentation that payload validation (e.g., VAA integrity and data source checks) occurs strictly on-chain.
As a result, developers may submit invalid price_update payloads that are only rejected at execution time with errors such as InvalidWormholeVaa() or InvalidUpdateDataSource().
Current Behavior
-
SDK forwards payloads without explicit validation feedback
-
Invalid payloads are accepted client-side
-
Transaction reverts on-chain with:
InvalidWormholeVaa()InvalidUpdateDataSource()
Minimal Reproduction
-
Fetch a valid price update payload (via Hermes or examples)
-
Modify the payload (e.g., truncate bytes or alter a segment)
-
Submit via
updatePriceFeeds(or equivalent) -
Observe:
- No SDK-side validation error
- On-chain revert with
InvalidWormholeVaa()
This demonstrates that invalid payloads are only detected at contract level.
Why This Matters
- Developers may assume payload correctness before submission
- Failed transactions increase iteration cost (gas + time)
- Debugging requires decoding revert reasons instead of early feedback
Documentation Gap
It is not clearly stated that:
-
Payload validation is exclusively enforced on-chain
-
The SDK does not pre-validate:
- Wormhole VAA structure
- Data source / emitter correctness
Suggested Improvement (Docs Only)
-
Add a short note in README or docs:
- Clarifying that validation occurs on-chain
- Warning that malformed payloads will revert
-
Optionally reference best practices (e.g., simulation, payload sourcing)
Scope
Documentation and developer experience only.
No claim of contract bug or security issue.
Impact
Improves onboarding clarity and reduces avoidable failed transactions during integration.
Labels Suggested: documentation, developer-experience
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the README or documentation covering SDK price updates, and review the existing Hermes/examples guidance and the updatePriceFeeds flow described in the issue. Add a concise warning that malformed payloads are validated on-chain and may revert, noting the lack of SDK-side validation; the documentation should clearly explain this behavior and possible simulation or sourcing practices.
Written by the indexing model from the issue text.
Assessment
- Domain
- developer-experience, documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100