Repository navigation
Serve ERC-20 wallet balances under seid's cosmosmetrics metric name - #12
Conversation
|
I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".
|
PR SummaryMedium Risk Overview The handler resolves the wallet’s EVM address (addr precompile Per-token failures are logged and omitted for that scrape (cap 32 tokens); symbol is cached per contract while decimals are refreshed each scrape. Reviewed by Cursor Bugbot for commit 7e652a6. Bugbot is set up for automated code reviews on this repo. Configure here. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| if offset+32+length > uint64(len(raw)) { | ||
| return "", fmt.Errorf("abi string length out of range") | ||
| } | ||
| return string(raw[offset+32 : offset+32+length]), nil |
There was a problem hiding this comment.
ABI decoder overflow crashes process
Medium Severity
decodeABIString converts 32-byte ABI offset and length with Uint64() and then adds them. Those additions can wrap, so the range checks pass and the following slice panics. That panic runs inside a scrape goroutine, so the whole exporter exits rather than failing the token read.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 28792fb. Configure here.
|
Superseded: seid already reports cosmos_wallet_balance in-process (sei-chain#4298), and the ERC-20 view moves there too in sei-protocol/sei-chain#4342. |
|
Bad bot! baaad bot! |
|
This is the interim solution until v6.8 is out. Once this PR lands we need to roll out the latest exporter across the networks |
devin-ai-integration
Bot
changed the title
|
Agreed. To make the cutover a no-op on the monitoring side I've realigned this endpoint with seid's cosmosmetrics (sei-chain#4342): it now takes the wallet's |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Devin resolved all 4 findings on a27d6d0
Fixed by Devin (4)
- Empty balance responses trigger false alerts
- Upgraded tokens retain stale balance scaling
- Tokens without optional metadata lose balances
- Unbounded token lists overload the exporter
View all findings in Devin Review
An empty balanceOf result is a failed read, not a zero. decimals() is read on every scrape so a token that changes them is reported in its current units; only the symbol label is pinned, and it is optional, stripped of non-printable characters and capped at 32 characters. A request may list at most 32 tokens.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
There are 2 total unresolved issues (including 1 from previous review).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 6c8a7ae. Configure here.
Only a node answer, a revert or an unparseable string, counts as the token having no symbol. A transport failure leaves the cache empty and the balance unreported for that scrape, so the symbol is read again next time instead of an empty label being pinned for the process.
…ei_getEVMAddress The sei_* JSON-RPC surface is deprecated and already disabled by default on public nodes, so the interim exporter reads the association through eth_call getEvmAddr(string) on 0x...1004. A revert means the wallet is unassociated and the cast address is used, as before.
2 participants
Native SEI balances of the watched wallets are already scraped from this exporter as
cosmos_wallet_balance, but natively-deployed ERC-20 holdings of the same wallets have no signal at all. Platform PR 1717 filled that gap with a separate log-scanning watcher; a balance poll is enough, because a balance change is exactly what we want to page on.This adds
/metrics/evm-wallet?address=sei1...&tokens=0x...,0x.... The wallet is the same sei1 address the other endpoints take; its EVM address is resolved with aneth_callto the addr precompile (getEvmAddr, at0x...1004) rather than the deprecatedsei_getEVMAddress, falling back to the cast address when the wallet is unassociated, matching the chain'sGetEVMAddressOrDefault. Each listed contract is read witheth_callfordecimals,symbolandbalanceOf, and the scaled balance is emitted assei_chain_cosmos_wallet_erc20_balance{address, evm_address, token, symbol}. That is the exact name and label set seid's in-processcosmosmetricsreports (sei-chain#4342), so the platform rules work against this exporter today and need no change when nodes on a release carrying that code start reporting it themselves and this endpoint is retired.Token metadata is cached per contract; a token whose calls fail is logged and omitted from that scrape so a single bad contract cannot take down the rest. The module path in go.mod is changed from
mainso the package can be tested.