[PR #3226] [MERGED] fix(evm): decode shortest-form empty CBOR text in Solidity metadata #5658

Closed
opened 2026-10-31 01:08:20 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3226
Author: @pablodiazjorge
Created: 10/14/2026
Status: ✅ Merged
Merged: 10/14/2026
Merged by: @morluto

Base: main ← Head: fix/cbor-empty-text


📝 Commits (1)

  • 4e9a462 fix(evm): decode shortest-form empty CBOR text in Solidity metadata

📊 Changes

2 files changed (+45 additions, -2 deletions)

View changed files

📝 src/evm/SolidityMetadata.test.ts (+40 -0)
📝 src/evm/SolidityMetadata.ts (+5 -2)

📄 Description

Summary

Fixes #3203. A terminal Solidity metadata map that contains an empty text key or value in the shortest CBOR form (0x60) was reported as status: "not-decoded", with no entries and a null compiler version, while the same empty text in the longer form (0x78 0x00) decoded. cborg answers 0x60 with a shared quick token (new Token(Type.string, '', 1) in cborg/lib/jump.js) that has no byteValue, even with retainStringBytes: true, and BoundedMetadataTokenizer treated the missing bytes as unavailable text.

Problem and expected behavior

Smallest trigger: bytecode 00 + CBOR a264736f6c634300081e617860 ({"solc": h'00081e', "x": ""}) + the two-byte length, inspected with rea inspect-evm-interface <file> raw. Before this change: bytecode.metadata.status: "not-decoded", entries: [], compiler_version: null. Expected: the same result as the long-form encoding, decoded with both entries and compiler version 0.8.30.

Change and scope

  • src/evm/SolidityMetadata.ts: a string token without byteValue is accepted only when it is that shortest-form empty text (value === "" and encodedLength === 1), whose value can only be "". Every other string still goes through strict UTF-8 decoding of its retained bytes, and any other string token without bytes still fails as before. The shared quick token is not mutated.
  • src/evm/SolidityMetadata.test.ts: an empty text value and an empty text key in the shortest form, the long-form value as a control, and the compiler version kept beside a shortest-form empty text.

Not included: other CBOR major types; only text needs its bytes for strict UTF-8 validation.

Contribution scope: not applicable (decoding fix within an existing provider).

Contract and boundary impact

  • Semantic owner and earliest changed stage: the Solidity metadata tokenizer (BoundedMetadataTokenizer.next).
  • Contribution scope fit and linked maintainer decision: not applicable.
  • CLI and MCP/tool-catalog contract: no schema change; metadata that was reported not-decoded for this encoding is now decoded.
  • Provider, bridge, target-format, or platform compatibility: the EVM interface profile stays Linux x64 only; the tokenizer change has no platform-specific code.
  • Evidence, artifact, provenance, or reconstruction contract: unchanged; decoded entries keep their existing representation.
  • Target selection, authority, upstream behavior, and cleanup details (if applicable): none.
  • Generated metadata (docs/public/product-catalog.json), package, or installation impact: none.

Expected effects:

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added or updated: src/evm/SolidityMetadata.test.ts (four new cases).
  • Base reproduction or other evidence: on 500e32399 without the change, the three shortest-form cases fail and the long-form control passes; the compiled CLI on Linux x64 reports not-decoded, 0 entries and a null compiler version for the shortest form, and decoded, 2 entries and 0.8.30 for the long form.
  • User-visible CLI/MCP output (if applicable): with the change, rea inspect-evm-interface <file> raw --format json reports status: "decoded", two entries and compiler_version.value: "0.8.30" for both encodings.
  • Remaining proof gaps: the MCP tool was exercised through its existing boundary test, not by a separate manual session.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Branch based on 500e32399, Node 24.18.0.

  • Linux x64 (WSL2 Ubuntu), the admitted platform: after npm run build:cached, the nine EVM test files (src/domain/evm, src/evm, tests/boundary/evm, tests/boundary/mcp/evmInterfaceMcp.test.ts, tests/composition/evmModuleContract.test.ts) — 98 passed, 2 skipped.
  • Linux x64: node scripts/rea.mjs inspect-evm-interface <file> raw --format json on the shortest-form and long-form bytecodes, with the change and again on 500e32399 without it — results as described above.
  • Windows 11 x64: npx vitest run src/evm/SolidityMetadata.test.ts — 19 passed; without the change, the three shortest-form cases fail.
  • npm run check:fast — passed.
  • npx tsc --noEmit — passed.
  • npx oxfmt --check and npx oxlint on the two files — passed.

Compatibility, safety, and release

  • Breaking changes or migration steps: none.
  • Real Hopper/Ghidra, browser, or OS coverage: Linux x64 with the compiled CLI and worker; no external provider involved.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: no new input is admitted beyond the one-byte empty text token.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3226 **Author:** [@pablodiazjorge](https://github.com/pablodiazjorge) **Created:** 10/14/2026 **Status:** ✅ Merged **Merged:** 10/14/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/cbor-empty-text` --- ### 📝 Commits (1) - [`4e9a462`](https://github.com/morluto/rea/commit/4e9a462cbac867adb200857c3c4f6658d557391d) fix(evm): decode shortest-form empty CBOR text in Solidity metadata ### 📊 Changes **2 files changed** (+45 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `src/evm/SolidityMetadata.test.ts` (+40 -0) 📝 `src/evm/SolidityMetadata.ts` (+5 -2) </details> ### 📄 Description ## Summary Fixes #3203. A terminal Solidity metadata map that contains an empty text key or value in the shortest CBOR form (`0x60`) was reported as `status: "not-decoded"`, with no entries and a null compiler version, while the same empty text in the longer form (`0x78 0x00`) decoded. `cborg` answers `0x60` with a shared quick token (`new Token(Type.string, '', 1)` in `cborg/lib/jump.js`) that has no `byteValue`, even with `retainStringBytes: true`, and `BoundedMetadataTokenizer` treated the missing bytes as unavailable text. ## Problem and expected behavior Smallest trigger: bytecode `00` + CBOR `a264736f6c634300081e617860` (`{"solc": h'00081e', "x": ""}`) + the two-byte length, inspected with `rea inspect-evm-interface <file> raw`. Before this change: `bytecode.metadata.status: "not-decoded"`, `entries: []`, `compiler_version: null`. Expected: the same result as the long-form encoding, `decoded` with both entries and compiler version `0.8.30`. ## Change and scope - `src/evm/SolidityMetadata.ts`: a string token without `byteValue` is accepted only when it is that shortest-form empty text (`value === ""` and `encodedLength === 1`), whose value can only be `""`. Every other string still goes through strict UTF-8 decoding of its retained bytes, and any other string token without bytes still fails as before. The shared quick token is not mutated. - `src/evm/SolidityMetadata.test.ts`: an empty text value and an empty text key in the shortest form, the long-form value as a control, and the compiler version kept beside a shortest-form empty text. Not included: other CBOR major types; only text needs its bytes for strict UTF-8 validation. Contribution scope: not applicable (decoding fix within an existing provider). ## Contract and boundary impact - Semantic owner and earliest changed stage: the Solidity metadata tokenizer (`BoundedMetadataTokenizer.next`). - Contribution scope fit and linked maintainer decision: not applicable. - CLI and MCP/tool-catalog contract: no schema change; metadata that was reported `not-decoded` for this encoding is now decoded. - Provider, bridge, target-format, or platform compatibility: the EVM interface profile stays Linux x64 only; the tokenizer change has no platform-specific code. - Evidence, artifact, provenance, or reconstruction contract: unchanged; decoded entries keep their existing representation. - Target selection, authority, upstream behavior, and cleanup details (if applicable): none. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: none. Expected effects: - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: `src/evm/SolidityMetadata.test.ts` (four new cases). - Base reproduction or other evidence: on `500e32399` without the change, the three shortest-form cases fail and the long-form control passes; the compiled CLI on Linux x64 reports `not-decoded`, 0 entries and a null compiler version for the shortest form, and `decoded`, 2 entries and `0.8.30` for the long form. - User-visible CLI/MCP output (if applicable): with the change, `rea inspect-evm-interface <file> raw --format json` reports `status: "decoded"`, two entries and `compiler_version.value: "0.8.30"` for both encodings. - Remaining proof gaps: the MCP tool was exercised through its existing boundary test, not by a separate manual session. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed Branch based on `500e32399`, Node 24.18.0. - Linux x64 (WSL2 Ubuntu), the admitted platform: after `npm run build:cached`, the nine EVM test files (`src/domain/evm`, `src/evm`, `tests/boundary/evm`, `tests/boundary/mcp/evmInterfaceMcp.test.ts`, `tests/composition/evmModuleContract.test.ts`) — 98 passed, 2 skipped. - Linux x64: `node scripts/rea.mjs inspect-evm-interface <file> raw --format json` on the shortest-form and long-form bytecodes, with the change and again on `500e32399` without it — results as described above. - Windows 11 x64: `npx vitest run src/evm/SolidityMetadata.test.ts` — 19 passed; without the change, the three shortest-form cases fail. - `npm run check:fast` — passed. - `npx tsc --noEmit` — passed. - `npx oxfmt --check` and `npx oxlint` on the two files — passed. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: Linux x64 with the compiled CLI and worker; no external provider involved. - Package or release metadata impact: none. - Security, privacy, process, or containment review: no new input is admitted beyond the one-byte empty text token. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-10-31 01:08:20 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#5658
No description provided.