[L-09] M3 Audit by ericnordelo · Pull Request #1741 · OpenZeppelin/cairo-contracts

ericnordelo · 2026-08-07T13:23:22Z

JSON-escapes custom type and member names before hashing and safely escapes generated debug output.

Summary by CodeRabbit

Bug Fixes
- Improved type-hash handling for names containing quotes, backslashes, braces, control characters, and null bytes.
- Prevented malformed generated formatting output when special characters appear in type or member names.
Tests
- Added coverage for special-character escaping in struct names, member names, and enum variants.

coderabbitai · 2026-08-07T13:23:29Z

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 56dd5e89-6169-4064-ad84-c27edb508528

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Walkthrough

Type-hash generation now JSON-escapes type and member names, including control characters. Debug output also escapes backslashes and braces. Unit and snapshot tests cover these cases.

Changes

Type-hash escaping

Layer / File(s)	Summary
JSON encoding for type-hash names `packages/macros/src/attribute/type_hash/parser.rs`, `packages/macros/src/tests/test_type_hash.rs`	Type and member names use JSON string encoding. Tests cover quotes, backslashes, control characters, null bytes, struct names, member names, and enum variants.
Generated debug output escaping `packages/macros/src/attribute/type_hash/definition.rs`	Debug type-hash strings now escape backslashes and braces before interpolation into generated Rust formatting code.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

I’m a rabbit guarding names in code,
With escaped paths along the road.
Quotes and braces hop safely through,
Backslashes behave as rabbits do.
Tests shine bright in snapshots new.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title identifies an audit but does not describe the main change: adding JSON escaping for type and member names and generated debug output.	Use a specific title such as "Escape type-hash names and debug output".

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/m3-audit-L-09

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-08-07T13:37:52Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

immrsd · 2026-08-07T14:19:04Z

@coderabbitai review

coderabbitai · 2026-08-07T14:19:10Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

immrsd

LGTM

* [N-01] M3 Audit (#1731) * fix: N-01 * feat: apply review updates (cherry picked from commit 13b7454) * fix: L-04 (#1732) (cherry picked from commit fc158d4) * fix: L-01 (#1733) (cherry picked from commit bd4e0e2) * [L-03] M3 Audit (#1734) * fix: L-04 * fix: L-01 * fix: L-03 * feat: apply review updates * fix: L-03 * feat: apply auditors feedback (cherry picked from commit 62e17d4) * fix: L-02 (#1743) (cherry picked from commit edd76a9) * [L-06] M3 Audit (#1736) * fix: L-06 * feat: apply review updates (cherry picked from commit 9a47516) * fix: L-07 (#1737) (cherry picked from commit 23da4ee) * fix: L-05 (#1738) (cherry picked from commit 00ec4c3) * fix: L-11 (#1739) (cherry picked from commit 9ba97df) * fix: L-08 (#1740) (cherry picked from commit 7b911da) * fix: L-09 (#1741) (cherry picked from commit 6bc3911) * [N-03] M3 Audit (#1744) * fix: N-03 * feat: apply review updates * feat: apply auditors review comments (cherry picked from commit 37ba01b) * feat: update CHANGELOG

* feat: update CHANGELOG * Bump version to 4.0.0 and update presets page * `v4.0.0` Support flash mint in components (#1691) * Chore(deps): Bump DavidAnson/markdownlint-cli2-action (#1688) Bumps [DavidAnson/markdownlint-cli2-action](https://github.com/davidanson/markdownlint-cli2-action) from 23.1.0 to 23.2.0. - [Release notes](https://github.com/davidanson/markdownlint-cli2-action/releases) - [Commits](DavidAnson/markdownlint-cli2-action@6b51ade...ded1f94) --- updated-dependencies: - dependency-name: DavidAnson/markdownlint-cli2-action dependency-version: 23.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Add ERC20FlashMint to with_components macro --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Backport v4.0.0 audit remediations (#1753) * [N-01] M3 Audit (#1731) * fix: N-01 * feat: apply review updates (cherry picked from commit 13b7454) * fix: L-04 (#1732) (cherry picked from commit fc158d4) * fix: L-01 (#1733) (cherry picked from commit bd4e0e2) * [L-03] M3 Audit (#1734) * fix: L-04 * fix: L-01 * fix: L-03 * feat: apply review updates * fix: L-03 * feat: apply auditors feedback (cherry picked from commit 62e17d4) * fix: L-02 (#1743) (cherry picked from commit edd76a9) * [L-06] M3 Audit (#1736) * fix: L-06 * feat: apply review updates (cherry picked from commit 9a47516) * fix: L-07 (#1737) (cherry picked from commit 23da4ee) * fix: L-05 (#1738) (cherry picked from commit 00ec4c3) * fix: L-11 (#1739) (cherry picked from commit 9ba97df) * fix: L-08 (#1740) (cherry picked from commit 7b911da) * fix: L-09 (#1741) (cherry picked from commit 6bc3911) * [N-03] M3 Audit (#1744) * fix: N-03 * feat: apply review updates * feat: apply auditors review comments (cherry picked from commit 37ba01b) * feat: update CHANGELOG * feat: bump interfaces and utils packages * feat: add version to dependencies --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: ericnordelo <26070224+ericnordelo@users.noreply.github.com> Co-authored-by: immrsd <103599616+immrsd@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

ericnordelo changed the title ~~fix: L-09~~ [L-09] M3 Audit Aug 7, 2026

bidzyyys linked an issue Aug 7, 2026 that may be closed by this pull request

[L-09]: User-provided names are not JSON-escaped in the encoded type #1716

Closed

ericnordelo force-pushed the fix/m3-audit-L-09 branch from 9ae260b to fdcc3e6 Compare August 10, 2026 10:58

immrsd self-requested a review August 12, 2026 12:32

immrsd approved these changes Aug 12, 2026

View reviewed changes

fix: L-09

314a744

ericnordelo force-pushed the fix/m3-audit-L-09 branch from fdcc3e6 to 314a744 Compare August 25, 2026 14:37

ericnordelo merged commit 6bc3911 into main Aug 25, 2026
12 checks passed

ericnordelo deleted the fix/m3-audit-L-09 branch August 26, 2026 09:44

Navigation Menu

Uh oh!

[L-09] M3 Audit - #1741

[L-09] M3 Audit#1741
ericnordelo merged 1 commit into
fix/m3-audit-L-08from
fix/m3-audit-L-09

ericnordelo commented Aug 7, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 7, 2026 •

edited

Loading

Review skipped

❌ Failed checks (1 inconclusive)

Uh oh!

codecov Bot commented Aug 7, 2026

Uh oh!

immrsd commented Aug 7, 2026

Uh oh!

coderabbitai Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

immrsd left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ericnordelo commented Aug 7, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Walkthrough

Changes

❌ Failed checks (1 inconclusive)

Uh oh!

codecov Bot commented Aug 7, 2026

Codecov Report

Uh oh!

immrsd commented Aug 7, 2026

Uh oh!

coderabbitai Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

immrsd left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ericnordelo commented Aug 7, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 7, 2026 •

edited

Loading

coderabbitai Bot commented Aug 7, 2026 •

edited

Loading