Validate indexed NFT token IDs before coercion and preserve valid neighboring rows #110

Activity

1. ColinkaMir commented on Sep 28, 2026

   

   ColinkaMir

   on Sep 28, 2026

   Contributor

   More actions

   I'd like to take this one, and it is the other half of what #109 just closed.

   The listing path has the same defect the transfer path had, plus one the transfer path did not: String(t.tokenId) runs before anything looks at the value, so 9007199254740993 is already 9007199254740992 and goes out as a plausible decimal, and {"toString": null} throws inside the coercion and takes the whole page with it, including the valid neighbour.

   Plan:

   • Validate before coercion, with the same rule requireTokenId already enforces after Fail startup when NAD_POLICY names a file that is not there #109: a string is taken as written, a number only when Number.isSafeInteger, a bigint always, and the result has to fit uint256. Reusing that function rather than writing a second rule is the point, because two rules for one concept is how the transfer path and the listing path drifted apart in the first place.
   • A row that fails is skipped and counted in skipped, exactly as a malformed contract or a missing id already is. The page survives; only the unusable row leaves.
   • The coercion cannot throw: anything whose toString is hostile is refused by the validator before String() is reached, so a single poisoned row stops discarding good ones.

   Verification before I push:

   • the two reproductions from the issue, asserting the row is skipped, skipped counts it, and the neighbouring "7" still lists;
   • an exact large id as a string surviving unchanged through the listing, since the fix must not narrow the legal range;
   • a hostile toString row, which is the case that currently throws;
   • the red run first, with each of those failing on current main.

   Scope stays where you put it: listing only, no change to the transfer path, the ABI or the page shape.
2. portdeveloper

   assigned

   ColinkaMir

   on Sep 28, 2026
3. portdeveloper commented on Sep 28, 2026

   

   portdeveloper

   on Sep 28, 2026

   OwnerAuthor

   More actions

   @ColinkaMir the claim is registered and the issue is assigned to you. One claim at a time pool-wide; a claim with no pull request or progress update after 7 days is released (agents.md, https://most.devnads.com). Good luck!
4. portdeveloper

   closed this as completedin #115on Oct 2, 2026