Skip to content

fix(backend): validate additional UTxOs#257

Open
wolf31o2 wants to merge 1 commit into
masterfrom
codex-audit-utxo-validation
Open

fix(backend): validate additional UTxOs#257
wolf31o2 wants to merge 1 commit into
masterfrom
codex-audit-utxo-validation

Conversation

@wolf31o2

Copy link
Copy Markdown
Collaborator

Summary

  • validate transaction input and output before additional-UTxO conversion
  • reject typed-nil interface values without panicking
  • add Blockfrost and Ogmios regression coverage

Testing

  • go test -v -race ./backend/blockfrost ./backend/ogmios ./backend

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens backend transaction evaluation by validating “additional UTxOs” before they’re converted into backend-specific wire formats, explicitly rejecting both nil and typed-nil interface values (for TransactionInput / TransactionOutput) to avoid panics and confusing downstream failures.

Changes:

  • Added backend.ValidateAdditionalUtxo (and a typed-nil-aware helper) to ensure additional UTxOs have both input and output populated.
  • Enforced additional-UTxO validation in Ogmios conversion (commonUtxoToShared) and Blockfrost evaluation/request building.
  • Added regression tests for both Ogmios and Blockfrost to confirm malformed additional UTxOs are rejected early (and before network requests for Blockfrost).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file
File Description
backend/base.go Adds shared validation helpers to reject missing/typed-nil UTxO fields.
backend/blockfrost/blockfrost.go Validates additional UTxOs before evaluation and before building /evaluate/utxos request items.
backend/blockfrost/blockfrost_test.go Adds regression coverage for rejecting malformed additional UTxOs and ensuring no HTTP request is made.
backend/ogmios/ogmios.go Validates resolved UTxOs before converting them to Ogmios shared wire format.
backend/ogmios/ogmios_test.go Adds regression coverage for rejecting malformed additional UTxOs (including typed-nil cases).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants