850223a953
- Added comprehensive bounds checking to prevent buffer overruns in multicall parsing - Implemented graduated validation system (Strict/Moderate/Permissive) to reduce false positives - Added LRU caching system for address validation with 10-minute TTL - Enhanced ABI decoder with missing Universal Router and Arbitrum-specific DEX signatures - Fixed duplicate function declarations and import conflicts across multiple files - Added error recovery mechanisms with multiple fallback strategies - Updated tests to handle new validation behavior for suspicious addresses - Fixed parser test expectations for improved validation system - Applied gofmt formatting fixes to ensure code style compliance - Fixed mutex copying issues in monitoring package by introducing MetricsSnapshot - Resolved critical security vulnerabilities in heuristic address extraction - Progress: Updated TODO audit from 10% to 35% complete 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
68 lines
1.6 KiB
Go
68 lines
1.6 KiB
Go
package arbitrum
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"encoding/hex"
|
|
"testing"
|
|
|
|
"github.com/fraktal/mev-beta/pkg/calldata"
|
|
)
|
|
|
|
// FuzzABIDecoder ensures the swap decoder tolerates arbitrary calldata without panicking.
|
|
func FuzzABIDecoder(f *testing.F) {
|
|
decoder, err := NewABIDecoder()
|
|
if err != nil {
|
|
f.Fatalf("failed to create ABI decoder: %v", err)
|
|
}
|
|
|
|
// Seed with known selectors (Uniswap V2/V3 multicall patterns)
|
|
f.Add([]byte{0xa9, 0x05, 0x9c, 0xbb})
|
|
f.Add([]byte{0x41, 0x4b, 0xf3, 0x89})
|
|
f.Add([]byte{0x18, 0xcb, 0xaf, 0xe5})
|
|
|
|
// Seed with random data of reasonable length
|
|
random := make([]byte, 64)
|
|
_, _ = rand.Read(random)
|
|
f.Add(random)
|
|
|
|
f.Fuzz(func(t *testing.T, data []byte) {
|
|
defer func() {
|
|
if r := recover(); r != nil {
|
|
t.Fatalf("DecodeSwapTransaction panicked for %x: %v", data, r)
|
|
}
|
|
}()
|
|
|
|
if len(data) == 0 {
|
|
data = []byte{0x00}
|
|
}
|
|
|
|
hexPayload := "0x" + hex.EncodeToString(data)
|
|
if _, err := decoder.DecodeSwapTransaction("generic", hexPayload); err != nil {
|
|
t.Logf("decoder returned expected error: %v", err)
|
|
}
|
|
})
|
|
}
|
|
|
|
// FuzzMulticallExtractor validates robustness of multicall token extraction.
|
|
func FuzzMulticallExtractor(f *testing.F) {
|
|
seed := make([]byte, 96)
|
|
copy(seed[:4], []byte{0xac, 0x96, 0x50, 0xd8})
|
|
f.Add(seed)
|
|
|
|
random := make([]byte, 128)
|
|
_, _ = rand.Read(random)
|
|
f.Add(random)
|
|
|
|
f.Fuzz(func(t *testing.T, params []byte) {
|
|
defer func() {
|
|
if r := recover(); r != nil {
|
|
t.Fatalf("ExtractTokensFromMulticall panicked for %x: %v", params, r)
|
|
}
|
|
}()
|
|
|
|
if _, err := calldata.ExtractTokensFromMulticall(params); err != nil {
|
|
t.Logf("multicall extraction reported error: %v", err)
|
|
}
|
|
})
|
|
}
|