Skip to content

fix(dpp): bound untrusted length prefixes on the proof-verification decode path - #4629

Merged
QuantumExplorer merged 3 commits into
v4.2-devfrom
fix/dpp-bound-untrusted-length-reads
Sep 8, 2026
Merged

fix(dpp): bound untrusted length prefixes on the proof-verification decode path#4629
QuantumExplorer merged 3 commits into
v4.2-devfrom
fix/dpp-bound-untrusted-length-reads

fix(dpp): enforce a byte budget when decoding stored group actions

5fa2964
Select commit
Loading
Failed to load commit list.
Codecov / codecov/project succeeded Sep 8, 2026 in 1s

84.24% (-1.13%) compared to fa44292

View this Pull Request on Codecov

84.24% (-1.13%) compared to fa44292

Details

Codecov Report

❌ Patch coverage is 78.70968% with 33 lines in your changes missing coverage. Please review.
✅ Project coverage is 84.24%. Comparing base (fa44292) to head (5fa2964).
⚠️ Report is 14 commits behind head on v4.2-dev.

Files with missing lines Patch % Lines
...pp/src/data_contract/document_type/property/mod.rs 69.30% 31 Missing ⚠️
...dpp/src/asset_lock/reduced_asset_lock_value/mod.rs 97.05% 1 Missing ⚠️
packages/rs-dpp/src/group/group_action/mod.rs 95.00% 1 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##           v4.2-dev    #4629      +/-   ##
============================================
- Coverage     85.36%   84.24%   -1.13%     
============================================
  Files          2792     2794       +2     
  Lines        370547   376651    +6104     
============================================
+ Hits         316331   317307     +976     
- Misses        54216    59344    +5128     
Components Coverage Δ
dpp 83.26% <78.70%> (-2.39%) ⬇️
drive 83.55% <ø> (-0.46%) ⬇️
drive-abci 88.36% <ø> (-0.25%) ⬇️
sdk ∅ <ø> (∅)
dapi-client ∅ <ø> (∅)
platform-version ∅ <ø> (∅)
platform-value 92.92% <ø> (ø)
platform-wallet ∅ <ø> (∅)
drive-proof-verifier 39.85% <ø> (-8.97%) ⬇️
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.