Skip to content

fix: block undeclared state-diff changes from matching - #191

Open
0xth4nh wants to merge 5 commits into
mainfrom
fix/undeclared-state-diff-changes
Open

fix: block undeclared state-diff changes from matching#191
0xth4nh wants to merge 5 commits into
mainfrom
fix/undeclared-state-diff-changes

Conversation

@0xth4nh

@0xth4nh 0xth4nh commented Aug 18, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Pair expected vs actual state overrides, changes, and balances by (address, slot/field) instead of array index, so extra simulation results cannot be dropped.
  • Surface undeclared actual entries as blocking unexpected rows (hasBlockingErrors() returns true) and fail validateUpgrade when the simulation produces results the task config did not declare.
  • Fixes the H1#3945949 gap where a task could declare a small expected set while its script performed additional hidden state changes.

Test plan

  • npm test -- src/lib/__tests__/validation-results-utils.test.ts (exact match, declared mismatch, undeclared extras, reordered pairing)
  • Run validation on a real task whose expected list matches the simulation and confirm signing is still allowed
  • Run validation against a task config with a deliberately incomplete expected list and confirm undeclared results fail validation / block signing

Made with Cursor

Pair expected vs actual state overrides, changes, and balances by address and slot instead of array index, and fail validation when the simulation produces results the task config did not declare.

Co-Authored-By: Claude <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
@cb-heimdall

Copy link
Copy Markdown
Collaborator

🟡 Heimdall Review Status

Requirement Status More Info
Reviews 🟡 0/1
Denominator calculation
Show calculation
1 if user is bot 0
1 if user is external 0
2 if repo is sensitive 0
From .codeflow.yml 1
Additional review requirements
Show calculation
Max 0
0
From CODEOWNERS 0
Global minimum 0
Max 1
1
1 if commit is unverified 0
Sum 1

0xth4nh and others added 2 commits August 18, 2026 13:48
Pair by Map get/delete instead of duplicate-key buckets, and fail validation with a direct identity-set check instead of rebuilding comparison rows.

Co-Authored-By: Claude <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Drop match/mismatch/UI coverage; those paths were already blocked or are not the H1 hole.

Co-Authored-By: Claude <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Comment thread src/lib/validation-results-utils.ts Outdated
Comment thread src/lib/validation-results-utils.ts Outdated
Comment thread src/lib/validation-results-utils.ts
Comment thread src/lib/validation-service.ts Outdated
Comment thread src/lib/validation-service.ts Outdated
Drop the service throw so signers see unexpected rows, fail pairing when an address and slot appear twice, and compare storage keys case-insensitively.

Co-authored-by: Cursor <cursoragent@cursor.com>
Comment thread src/lib/validation-results-utils.ts
Comment thread src/lib/validation-results-utils.ts
Comment thread src/lib/__tests__/validation-results-utils.test.ts
Emit extra address/slot rows as blocking mismatches instead of throwing in render, compare hex values case-insensitively, and cover overrides, balances, and declared mismatches in tests.

Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants