forked from ton-core/ton-core
-
Notifications
You must be signed in to change notification settings - Fork 42
Open
Description
Friendly address serialization (Address.toString()
) correctly encodes negative workchains (e.g., -2
) as signed 8-bit integers. However, the deserialization function (Address.parse()
) misinterprets these encoded negative values as unsigned, corrupting the original workchain number.
Example:
import { Address } from "@ton/core";
const addr = new Address(-2, Buffer.alloc(32, 0));
const encoded = addr.toString();
console.log(encoded); // => "Ef4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL3I" (correct for -2)
const decoded = Address.parse(encoded);
console.log(decoded.workChain); // => 254 (incorrect, should be -2)
Explanation:
- The serialized friendly address
"Ef4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL3I"
is correctly encoded with the workchain byte0xFE
, representing-2
in signed 8-bit form. Address.parse
incorrectly treats this signed byte as an unsigned value (254
), resulting in an incorrect workchain upon parsing.
Expected Behavior:
Address.parse
must interpret the workchain byte as a signed integer, correctly restoring the original negative value.
LLM Fuzzing discovery (see tact-lang/tact#3123)
Metadata
Metadata
Assignees
Labels
No labels