Fix tsc -b build break from #360: widen slippage-floor param to string | null #868

Merged

Brouie merged 1 commit from qa/360-build-tsc-minreceived-null into main

2026-06-12 03:35:35 +00:00

Brouie commented

2026-06-12 03:05:54 +00:00

(Migrated from gitlab.com)

npm run build (tsc -b) is RED on main at 16e0656 after the #360 merge (!866).

buildSubmitAlignedSimPayload types its injected applySlippageFloor param as (returnAmount, slippagePct) => string, but:

the real fn wired in by useSubmitAlignedSimQuote is applySlippagePercentFloor, which returns string | null
the minReceived field it feeds is already string | null, and every consumer (SwapPage, TradeMarketOrderPanel) already null-checks it

So the param type was just too narrow. Widening it to => string | null clears the error with no behavior change.

npm run build green after the fix
full vitest 935/937 (the 2 fails = the known REG-00-02 localhost vs 127.0.0.1 env artifact, unrelated)

Same CI gap as before: pipeline runs vitest + eslint but not tsc -b, so type breaks land on main unseen.

`npm run build` (tsc -b) is RED on main at 16e0656 after the #360 merge (!866). `buildSubmitAlignedSimPayload` types its injected `applySlippageFloor` param as `(returnAmount, slippagePct) => string`, but: - the real fn wired in by `useSubmitAlignedSimQuote` is `applySlippagePercentFloor`, which returns `string | null` - the `minReceived` field it feeds is already `string | null`, and every consumer (SwapPage, TradeMarketOrderPanel) already null-checks it So the param type was just too narrow. Widening it to `=> string | null` clears the error with no behavior change. - `npm run build` green after the fix - full vitest 935/937 (the 2 fails = the known REG-00-02 `localhost` vs `127.0.0.1` env artifact, unrelated) Same CI gap as before: pipeline runs vitest + eslint but not `tsc -b`, so type breaks land on main unseen.

PlasticDigits commented

2026-06-12 03:08:04 +00:00

(Migrated from gitlab.com)

Security review

Commit reviewed: 4e17fcdf776e180046eff4d2f3248d7aa55f00bb
Scope: frontend-dapp/src/utils/quoteDebounce.ts — widen buildSubmitAlignedSimPayload injected applySlippageFloor callback return type from string to string | null (1-line diff).

Outcome: FINDINGS: 0 medium+

Analysis

This MR is a compile-time type alignment only. The output type SubmitAlignedSimPayload.minReceived was already string | null; useSubmitAlignedSimQuote (#360) wires applySlippagePercentFloor, which returns string | null. Widening the callback param type matches the real function and existing consumers — no runtime logic, validation, or on-chain arg construction changes.

Traced attacker-controlled inputs through the slippage path:

applySlippagePercentFloor → applyBpsFloor → tryParseBigInt; returns null only for non-uint return_amount strings.
simData.return_amount originates from indexer/chain simulation, not direct user text input.
Submit paths already use submitMinReceived ?? undefined and maxSpread independently; null-handling predates this diff (#360) and is unchanged here.

No injection, authz, XSS, secret leakage, SSRF, or deserialization surface in this diff. No new dependencies.

Inline threads: none (no findings to anchor).

Security review: no medium+ findings on this diff.

## Security review **Commit reviewed:** `4e17fcdf776e180046eff4d2f3248d7aa55f00bb` **Scope:** `frontend-dapp/src/utils/quoteDebounce.ts` — widen `buildSubmitAlignedSimPayload` injected `applySlippageFloor` callback return type from `string` to `string | null` (1-line diff). **Outcome:** `FINDINGS: 0` medium+ ### Analysis This MR is a compile-time type alignment only. The output type `SubmitAlignedSimPayload.minReceived` was already `string | null`; `useSubmitAlignedSimQuote` (#360) wires `applySlippagePercentFloor`, which returns `string | null`. Widening the callback param type matches the real function and existing consumers — no runtime logic, validation, or on-chain arg construction changes. Traced attacker-controlled inputs through the slippage path: - `applySlippagePercentFloor` → `applyBpsFloor` → `tryParseBigInt`; returns `null` only for non-uint `return_amount` strings. - `simData.return_amount` originates from indexer/chain simulation, not direct user text input. - Submit paths already use `submitMinReceived ?? undefined` and `maxSpread` independently; null-handling predates this diff (#360) and is unchanged here. No injection, authz, XSS, secret leakage, SSRF, or deserialization surface in this diff. No new dependencies. **Inline threads:** none (no findings to anchor). Security review: no medium+ findings on this diff.

Brouie commented

2026-06-12 03:11:48 +00:00

(Migrated from gitlab.com)

mentioned in issue #360