fix: block undeclared state-diff changes from matching (SECBUGS-24878) - #191
Merged
Conversation
Pair expected vs actual state overrides, changes, and balances by address and slot instead of array index, and fail validation when the simulation produces results the task config did not declare. Co-Authored-By: Claude <[email protected]> Co-authored-by: Cursor <[email protected]>
Collaborator
✅ Heimdall Review Status
|
Pair by Map get/delete instead of duplicate-key buckets, and fail validation with a direct identity-set check instead of rebuilding comparison rows. Co-Authored-By: Claude <[email protected]> Co-authored-by: Cursor <[email protected]>
Drop match/mismatch/UI coverage; those paths were already blocked or are not the H1 hole. Co-Authored-By: Claude <[email protected]> Co-authored-by: Cursor <[email protected]>
jackchuma
reviewed
Aug 19, 2026
Drop the service throw so signers see unexpected rows, fail pairing when an address and slot appear twice, and compare storage keys case-insensitively. Co-authored-by: Cursor <[email protected]>
jackchuma
reviewed
Aug 19, 2026
Emit extra address/slot rows as blocking mismatches instead of throwing in render, compare hex values case-insensitively, and cover overrides, balances, and declared mismatches in tests. Co-authored-by: Cursor <[email protected]>
jackchuma
reviewed
Aug 20, 2026
Skip display diffs when identity comparison already treats the values as a match, so a green match is not contradicted by removed/added highlights. Co-authored-by: Cursor <[email protected]>
jackchuma
approved these changes
Aug 20, 2026
0xth4nh
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
(address, slot/field)instead of array index, so extra simulation results cannot be dropped.hasBlockingErrors()returns true). Duplicate identities stay on the review screen as blocking unexpected/missing rows.Fixes SECBUGS-24878. Fixes H1#3945949.
Test plan
npm test -- src/lib/__tests__/validation-results-utils.test.ts(match, declared mismatch, undeclared extras, reorder, duplicates, case-insensitive hex)npm testnpm run lintnpm run build