forked from ton-core/ton-core
-
Notifications
You must be signed in to change notification settings - Fork 42
Open
Description
BitBuilder
incorrectly allows writing more than the maximum permitted 1023 bits per cell, failing to throw an immediate overflow error. This results in invalid serialization that's detected only later, upon finalizing the cell.
Minimal Example:
import { beginCell } from "@ton/core";
const payload = Buffer.alloc(128, 0xff); // exactly 1024 bits (128 bytes)
const b = beginCell();
b.storeBuffer(payload); // writes 1024 bits without error (should overflow at 1023)
console.log("bits after payload:", b.bits); // incorrectly logs 1024 bits
b.storeBit(1); // writes an additional bit, total now 1025 bits
console.log("bits after extra bit:", b.bits); // incorrectly logs 1025 bits
try {
b.endCell(); // delayed overflow detection here
} catch (e) {
console.log("error:", e.message); // => "Bits overflow: 1025 > 1023"
}
Expected Behavior:
The builder should immediately throw an overflow error as soon as the bit count exceeds 1023 bits.
Actual Behavior:
No immediate error is raised. The bit count reaches 1025 bits, and the overflow error is thrown only during finalization (endCell()
), potentially masking subtle serialization issues in production environments.
LLM Fuzzing discovery (see tact-lang/tact#3123)
Metadata
Metadata
Assignees
Labels
No labels