release v1.1.0 - #83
Conversation
Will-Guan
left a comment
Will-Guan
left a comment
There was a problem hiding this comment.
Finding
- Medium — Parsed token symbols can be silently ignored.
The TRON batch, exact, and upto price-parsing paths can discard the symbol returned byparseMoney(), causing prices such as"1 USDD"or"$1 USDD"to fall back to the network default USDT asset. Preserve the symbol during token resolution or explicitly reject unsupported suffixes.
Suggestion
- Enforce a consistent zero-amount policy.
Core and EVM intentionally truncate sub-atomic prices to"0", while TRON exact and upto reject them locally. If paid routes must charge at least one atomic unit, validateBigInt(parsedPrice.amount) > 0ncentrally when buildingPaymentRequirements, rather than adding a TRON-batch-only guard.
| @@ -240,7 +243,7 @@ export class BatchSettlementTronScheme implements SchemeNetworkServer { | |||
| return { amount: price.amount, asset: price.asset, extra: price.extra || {} }; | |||
| } | |||
|
|
|||
| const amount = this.parseMoneyToDecimal(price); | |||
| const amount = parseMoney(price).amount; | |||
There was a problem hiding this comment.
Medium · bug — Preserve or reject the parsed token symbol
parseMoney() returns { amount, symbol }, but this line keeps only amount, so the fallback conversion always uses the network default asset. For example, parsePrice("1 USDD", Nile) is silently converted to 1_000_000 units of Nile USDT instead of USDD. Unsupported symbols can likewise be treated as USDT without an error.
The EVM implementation preserves symbol and passes it to asset resolution. Please either propagate the symbol into the TRON token lookup/conversion path or explicitly reject non-USD suffixes that this path does not support.
| @@ -76,7 +79,7 @@ export class ExactTronScheme implements SchemeNetworkServer { | |||
| } | |||
|
|
|||
| // Parse Money to decimal number | |||
| const amount = this.parseMoneyToDecimal(price); | |||
| const amount = parseMoney(price).amount; | |||
There was a problem hiding this comment.
Same finding — the token symbol is lost on the dollar-prefixed path
A value such as "$1 USDD" does not match the token-price branch above, because that expression does not accept the $ prefix. It therefore reaches parseMoney(), where USDD is parsed successfully but discarded by selecting only .amount, and the price falls back to the default USDT asset.
Please preserve and resolve the returned symbol, or explicitly reject this syntax instead of silently changing the requested asset.
| @@ -61,7 +63,7 @@ export class UptoTronScheme implements SchemeNetworkServer { | |||
| return parseTokenPrice(price.trim(), network); | |||
| } | |||
|
|
|||
| const amount = this.parseMoneyToDecimal(price); | |||
| const amount = parseMoney(price).amount; | |||
There was a problem hiding this comment.
Same finding — the token symbol is lost on the dollar-prefixed path
As in the exact implementation, "$1 USDD" bypasses the token-price branch, after which parseMoney() extracts USDD but this line discards it. The resulting requirement is then denominated in the default USDT asset.
Please handle the parsed symbol consistently with the token-price path, or reject unsupported suffixes explicitly.
2 participants
Description
Tests
Checklist