fix(binarycodec): guard NO_ACCOUNT issuer collision in Issue parser - #312
fix(binarycodec): guard NO_ACCOUNT issuer collision in Issue parser#312e-desouza wants to merge 2 commits into
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #312 +/- ##
=======================================
Coverage ? 84.24%
=======================================
Files ? 200
Lines ? 20752
Branches ? 0
=======================================
Hits ? 17483
Misses ? 3269
Partials ? 0
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
|
Follow-up to second opinion review: the |
Adds an explicit error in from_parser when an IOU's issuer bytes equal the NO_ACCOUNT sentinel (rrrrrrrrrrrrrrrrrrrrBZbvji) and the currency field starts with 0x00 (standard IOU layout). Without this guard the parser would silently misclassify the IOU as an MPT issue and read four extra bytes, corrupting the field. The fix returns a descriptive error for that ambiguous combination rather than producing a silent misparse. Also clarifies in code comments that the MPT Issue wire format stores the sequence field in little-endian byte order (confirmed by the codec-fixture test suite), and adds two new tests: one verifying the sequence round-trip and one confirming the colliding-issuer path returns the expected error. Closes #256
…sue::from_parser The byte[0] == 0x00 guard introduced to detect IOU/MPT ambiguity was wrong: MPT issuer account hashes can legitimately start with 0x00 (~1/256), which would reject valid MPT issues. The XRPL ledger prevents the address rrrrrrrrrrrrrrrrrrrrBZbvji from being assigned to any account, so NO_ACCOUNT is unambiguously an MPT type tag. Revert to treating NO_ACCOUNT as MPT unconditionally.
571f183 to
5c0fdc9
Compare
Summary
NO_ACCOUNT(rrrrrrrrrrrrrrrrrrrrBZbvji) serves as the unambiguous MPT wire-format type tag insideIssue::from_parser. The XRPL ledger prevents any account from being assigned these bytes, so encountering them in the issuer position unambiguously signals an MPT issue — no additional guard is needed. The decoding logic now matches the reference xrpl-py implementation exactly (IssueNO_ACCOUNTsentinel collides with legitimate AccountID #256 is a ledger-invariant, not a codec defect; see below). (Issue MPT sequence stored in LE inside a BE-elsewhere codec #255)test_issue_mpt_sequence_roundtrip_endian(JSON → binary → JSON roundtrip for a known MPT issuance ID, verifying the LE storage).What changed
src/core/binarycodec/types/issue.rs: expandedNO_ACCOUNTconstant doc comment; clarified existing MPT branch comments infrom_parser; clarified LE comment inTryFrom<Value>andSerialize.test_issue_mpt_sequence_roundtrip_endiantest.How to validate
cargo test --release cargo clippy --features std,tokio-rt,embassy-rt,actix-rt,futures-rt,smol-rt,core,wallet,models,utils,helpers,json-rpc,websocket,cli -- -D warningsBoth pass with zero failures and zero warnings.
Note on #256
Issue #256 describes a hypothetical adversarial input — an IOU with NO_ACCOUNT as the issuer byte sequence — that would cause
from_parserto consume four extra bytes and corrupt the parser stream. This scenario cannot occur in ledger-validated data: the XRPL ledger consensus rules prevent any account from holding or issuing with the NO_ACCOUNT address. Because this codec is a ledger binary codec (not a general-purpose byte parser), the existingnext_20 == NO_ACCOUNT → MPTbranch is both sufficient and correct — identical to the xrpl-py reference codec. Adding a guard keyed oncurrency[0] == 0x00would introduce a regression for MPT issues whose account ID starts with0x00(~1/256 probability). Issue #256 is tracked separately for any future hardened / fuzzing-safe parser variant.Closes #255