From bca6b6808770aa39be0ad7be16d147bb8fc4c38c Mon Sep 17 00:00:00 2001 From: kumburovicbranko682-boop Date: Sat, 27 Jun 2026 20:09:21 +0800 Subject: [PATCH] refactor: silent data corruption from ignored setstring error in newbuilderbids In `NewBuilderBids`, `big.Int.SetString()` returns `(value, ok)` where ok indicates success, but the return value is completely ignored. If any Redis-stored bid value contains invalid characters for base-10 parsing (e.g., malformed data, corruption, or malicious input), `SetString` will fail silently - the bid value will remain at its zero-initialized `big.Int` (0) instead of the actual value. This corrupts auction calculations since zero bids will be considered, potentially causing invalid block selections or fund loss. Affected files: utils.go Signed-off-by: kumburovicbranko682-boop <295886834+kumburovicbranko682-boop@users.noreply.github.com> --- datastore/utils.go | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/datastore/utils.go b/datastore/utils.go index b3e57aa28..6a684e2d2 100644 --- a/datastore/utils.go +++ b/datastore/utils.go @@ -3,6 +3,7 @@ package datastore import ( "context" "errors" + "fmt" "math/big" "github.com/redis/go-redis/v9" @@ -25,18 +26,21 @@ func NewBuilderBidsFromRedis(ctx context.Context, r *RedisCache, pipeliner redis if err != nil { return nil, err } - return NewBuilderBids(bidValueMap), nil + return NewBuilderBids(bidValueMap) } -func NewBuilderBids(bidValueMap map[string]string) *BuilderBids { +func NewBuilderBids(bidValueMap map[string]string) (*BuilderBids, error) { b := BuilderBids{ bidValues: make(map[string]*big.Int), } for builderPubkey, bidValue := range bidValueMap { - b.bidValues[builderPubkey] = new(big.Int) - b.bidValues[builderPubkey].SetString(bidValue, 10) + v, ok := new(big.Int).SetString(bidValue, 10) + if !ok { + return nil, fmt.Errorf("invalid bid value for builder %s: %q", builderPubkey, bidValue) + } + b.bidValues[builderPubkey] = v } - return &b + return &b, nil } func (b *BuilderBids) getTopBid() (string, *big.Int) {