feat(torii-grpc): erc tokens and balances #2698
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -10,12 +10,36 @@ | |
| ContractStorageDiffItem, Felt, FromStrError, StateDiff, StateUpdate, StorageEntry, | ||
| }; | ||
| use strum_macros::{AsRefStr, EnumIter, FromRepr}; | ||
| use torii_core::types::{Token, TokenBalance}; | ||
|
|
||
| use crate::proto::types::member_value; | ||
| use crate::proto::{self}; | ||
|
|
||
| pub mod schema; | ||
|
|
||
| impl From<Token> for proto::types::Token { | ||
| fn from(value: Token) -> Self { | ||
| Self { | ||
| contract_address: value.contract_address, | ||
| name: value.name, | ||
| symbol: value.symbol, | ||
| decimals: value.decimals as u32, | ||
| metadata: serde_json::to_string(&value.metadata).unwrap(), | ||
| } | ||
| } | ||
| } | ||
|
There was a problem hiding this comment. 💡 Codebase verification Handle serialization errors gracefully in Token conversion Ohayo sensei! Looking at the codebase, I can confirm this is a critical issue. The Here's a suggested improvement: impl From<Token> for proto::types::Token {
fn from(value: Token) -> Self {
+ // Serialize metadata, using empty JSON object as fallback
+ let metadata = serde_json::to_string(&value.metadata)
+ .unwrap_or_else(|_| "{}".to_string());
+
Self {
contract_address: value.contract_address,
name: value.name,
symbol: value.symbol,
decimals: value.decimals as u32,
- metadata: serde_json::to_string(&value.metadata).unwrap(),
+ metadata,
}
}
}The change ensures that even if metadata serialization fails, we'll get a valid JSON object rather than a panic. This is a safer approach for production code. 🔗 Analysis chainHandle potential serialization errors gracefully Ohayo sensei! While the implementation is generally good, the Here's a suggested improvement: impl From<Token> for proto::types::Token {
fn from(value: Token) -> Self {
+ // Serialize metadata, using empty JSON object as fallback
+ let metadata = serde_json::to_string(&value.metadata)
+ .unwrap_or_else(|_| "{}".to_string());
+
Self {
contract_address: value.contract_address,
name: value.name,
symbol: value.symbol,
decimals: value.decimals as u32,
- metadata: serde_json::to_string(&value.metadata).unwrap(),
+ metadata,
}
}
}Let's verify if there are similar unwrap patterns in other type conversions: Let me search for similar patterns in the codebase to verify if this is a common issue or an isolated case. 🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Search for potentially dangerous unwrap calls in type conversions
rg 'unwrap\(\)' --type rust
Length of output: 192327 Script: #!/bin/bash
# Search for serde_json::to_string unwrap patterns in type conversions
rg 'serde_json::to_string\(.*\)\.unwrap\(\)' --type rust
# Search for error handling patterns in similar type conversions
rg 'impl From<.*> for proto::types::.*' --type rust -A 10
Length of output: 13698 |
||
|
|
||
| impl From<TokenBalance> for proto::types::TokenBalance { | ||
| fn from(value: TokenBalance) -> Self { | ||
| Self { | ||
| balance: value.balance, | ||
| account_address: value.account_address, | ||
| contract_address: value.contract_address, | ||
| token_id: value.token_id, | ||
| } | ||
| } | ||
| } | ||
|
|
||
| #[derive(Debug, Serialize, Deserialize, PartialEq, Hash, Eq, Clone)] | ||
| pub struct IndexerUpdate { | ||
| pub head: i64, | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ohayo sensei! Please address SQL injection and input validation concerns.
The implementation needs several security and robustness improvements:
Consider this safer implementation:
async fn retrieve_tokens( &self, contract_addresses: Vec<Felt>, ) -> Result<RetrieveTokensResponse, Status> { + const MAX_ADDRESSES: usize = 100; + if contract_addresses.is_empty() { + return Err(Status::invalid_argument("No contract addresses provided")); + } + if contract_addresses.len() > MAX_ADDRESSES { + return Err(Status::invalid_argument( + format!("Too many addresses. Maximum allowed: {}", MAX_ADDRESSES) + )); + } + + let placeholders = contract_addresses + .iter() + .map(|_| "?") + .collect::<Vec<_>>() + .join(", "); + + let query = format!("SELECT * FROM tokens WHERE contract_address IN ({})", placeholders); + + let mut query_builder = sqlx::query_as(&query); + for address in contract_addresses { + query_builder = query_builder.bind(format!("{:#x}", address)); + } - let query = format!( - "SELECT * FROM tokens WHERE contract_address IN ({})", - contract_addresses - .iter() - .map(|address| format!("{:#x}", address)) - .collect::<Vec<_>>() - .join(", ") - ); - - let tokens: Vec<Token> = sqlx::query_as(&query) + let tokens: Vec<Token> = query_builder .fetch_all(&self.pool) .await .map_err(|e| Status::internal(e.to_string()))?; let tokens = tokens.iter().map(|token| token.clone().into()).collect(); Ok(RetrieveTokensResponse { tokens }) }📝 Committable suggestion