harden: a holders_count that is not plain digits is unknown, not read in part #445

Merged
clawbot merged 1 commits from issue-251-holders-count-parse into next 2026-10-05 02:59:16 +02:00
Collaborator

Closes #251.

parseHoldersCount used parseInt, which reads the leading digits and drops the rest: "1,000" became 1, "0x10" 0, "1e3" 1. That is a reported low count, so the transaction history and the send-screen token selector would hide the token, the outcome #230 was fixed to prevent. It now takes only a whole number of zero or more, or a string of digits alone, and returns null (unknown) for anything else. The comment says exactly that.

The balance list's holders !== null && is dropped, not made load-bearing: null >= 1000 is already false. The existing test that an unknown count does not admit an unvouched token covers it, and the comment there now says why.

README.md and docs/README.md now say what an unknown count is and how each filter treats it: the history and the send selector keep the token, and the balance list admits it only if it is on the bundled list or tracked. They also say the token screen leaves out its "Holders:" row when the count is unknown, rather than showing 0. README.md lists src/shared/holders.js in the source tree.

  • Judgement call: a negative count (-5 or "-5") is now unknown too. parseInt used to keep it, as a low count. A test pins this.
  • Also touched: the comment above holders in src/shared/transactions.js now says "no readable count", because null now covers a malformed count as well.

Model: opus-5-5

Closes https://git.eeqj.de/sneak/AutistMask/issues/251. `parseHoldersCount` used `parseInt`, which reads the leading digits and drops the rest: `"1,000"` became 1, `"0x10"` 0, `"1e3"` 1. That is a reported low count, so the transaction history and the send-screen token selector would hide the token, the outcome https://git.eeqj.de/sneak/AutistMask/issues/230 was fixed to prevent. It now takes only a whole number of zero or more, or a string of digits alone, and returns `null` (unknown) for anything else. The comment says exactly that. The balance list's `holders !== null &&` is dropped, not made load-bearing: `null >= 1000` is already false. The existing test that an unknown count does not admit an unvouched token covers it, and the comment there now says why. `README.md` and `docs/README.md` now say what an unknown count is and how each filter treats it: the history and the send selector keep the token, and the balance list admits it only if it is on the bundled list or tracked. They also say the token screen leaves out its "Holders:" row when the count is unknown, rather than showing 0. `README.md` lists `src/shared/holders.js` in the source tree. - Judgement call: a negative count (`-5` or `"-5"`) is now unknown too. `parseInt` used to keep it, as a low count. A test pins this. - Also touched: the comment above `holders` in `src/shared/transactions.js` now says "no readable count", because `null` now covers a malformed count as well. Model: opus-5-5
clawbot added the needs-review label 2026-10-05 02:05:02 +02:00
clawbot self-assigned this 2026-10-05 02:05:02 +02:00
Author
Collaborator

FAIL

  1. src/shared/holders.js:21: a string of digits too long for a JavaScript number (310 or more digits) now parses to Infinity instead of null. The old code returned null for it because it checked that the result was finite, and this change dropped that check. The number branch at line 19 still returns null for Infinity, so the same value gets two different answers depending on whether it arrives as a number or a string. Infinity passes the balance list's 1,000-holder floor and shows on the token screen as "Holders: ∞". It also breaks the promise in the comment at lines 12-16 that the result is a whole number or null. Digit strings above 2^53 come back rounded rather than as the reported count. Acceptable: both branches return null unless the result is a safe integer (Number.isSafeInteger, the check rawUnits() in src/shared/balances.js uses), and tests/holders.test.js has a test that an over-long digit string is unknown.

Model: opus-5-5

FAIL 1. `src/shared/holders.js:21`: a string of digits too long for a JavaScript number (310 or more digits) now parses to `Infinity` instead of `null`. The old code returned `null` for it because it checked that the result was finite, and this change dropped that check. The number branch at line 19 still returns `null` for `Infinity`, so the same value gets two different answers depending on whether it arrives as a number or a string. `Infinity` passes the balance list's 1,000-holder floor and shows on the token screen as "Holders: ∞". It also breaks the promise in the comment at lines 12-16 that the result is a whole number or `null`. Digit strings above 2^53 come back rounded rather than as the reported count. Acceptable: both branches return `null` unless the result is a safe integer (`Number.isSafeInteger`, the check `rawUnits()` in `src/shared/balances.js` uses), and `tests/holders.test.js` has a test that an over-long digit string is unknown. Model: opus-5-5
clawbot added needs-rework and removed needs-review labels 2026-10-05 02:18:22 +02:00
clawbot added 1 commit 2026-10-05 02:30:58 +02:00
harden: a holders_count that is not plain digits is unknown, not read in part (closes #251)
check / check (push) Failing after 3s
e2e / e2e-chrome (push) Failing after 3s
e2e / e2e-firefox (push) Failing after 2s
57e5b7c0ba
parseHoldersCount used parseInt, which reads "1,000" as 1, "0x10" as 0 and
"1e3" as 1: a reported low count, which hides the token in the transaction
history and the send-screen token selector. It now accepts only a whole
number of zero or more, or a string of digits alone, no larger than
Number.MAX_SAFE_INTEGER, and returns null for anything else. The balance
list's holders !== null check did nothing, since null >= 1000 is already
false, and is dropped. README.md and docs/README.md say how each filter
treats an unknown count and that the token screen then leaves out its
Holders row; README.md lists src/shared/holders.js.

Model: opus-5-5
clawbot force-pushed issue-251-holders-count-parse from 657ba3b059 to 57e5b7c0ba 2026-10-05 02:30:58 +02:00 Compare
Author
Collaborator

Reworked in 57e5b7c.

  1. Fixed: both branches of parseHoldersCount now return null unless the result is a safe integer, and the comment says so. tests/holders.test.js checks that "9007199254740993", a 400-digit string and 2 ** 53 are unknown, and that Number.MAX_SAFE_INTEGER is still read.
  • Judgement call: README.md and docs/README.md are unchanged, since no explorer will report more than 2^53 - 1 holders.

Model: opus-5-5

Reworked in `57e5b7c`. 1. Fixed: both branches of `parseHoldersCount` now return `null` unless the result is a safe integer, and the comment says so. `tests/holders.test.js` checks that `"9007199254740993"`, a 400-digit string and `2 ** 53` are unknown, and that `Number.MAX_SAFE_INTEGER` is still read. - Judgement call: `README.md` and `docs/README.md` are unchanged, since no explorer will report more than 2^53 - 1 holders. Model: opus-5-5
clawbot added needs-review and removed needs-rework labels 2026-10-05 02:31:09 +02:00
Author
Collaborator

PASS

Model: opus-5-5

PASS Model: opus-5-5
clawbot merged commit 6c885a0c05 into next 2026-10-05 02:59:16 +02:00
clawbot deleted branch issue-251-holders-count-parse 2026-10-05 02:59:16 +02:00
Sign in to join this conversation.
No Reviewers
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/AutistMask#445