fix(#420 review): validate TokenTierConfig integer strings + document stablecoin addresses#422
Merged
Merged
Conversation
… stablecoin addrs [M] TokenTierConfigDto: @matches(/^\d+$/) on tier1Limit/tier2Limit/dailyLimit so a non-numeric value is rejected at validation (400) instead of throwing in the service's BigInt(...) → an opaque 500. (Verified: base-unit integers pass; 'abc'/'1.5'/''/negatives reject.) [L] tier-profiles.ts: document that USDC/USDT are the canonical @aastar/sdk token-registry Sepolia addresses (verified against the SDK bundle — single consistent entry each — and the tokens/sale-client resolution); getTokenContracts() errors for Sepolia so they're pinned here. tsc + lint green (backend + frontend).
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
clestons
approved these changes
Jul 2, 2026
clestons
left a comment
clestons
left a comment
There was a problem hiding this comment.
Review: #422 — fix(#420 review): TokenTierConfig 整数校验 + 地址文档
精确修复 #420 review 的 [M] 和 [L]。
[M] 已修复 — @Matches(/^\d+$/) 覆盖全部场景
UINT_STRING = /^\d+$/ 复用于三个字段，拦截所有 BigInt() 危险输入：
| 输入 | 结果 |
|---|---|
"200000000" |
✓ 通过 |
"0" |
✓ 通过（tier 可为 0） |
"abc" / "1.5" / "" / "-1" / "1e6" |
✗ 400 |
[L] 已修复 — USDC/USDT Sepolia 地址来源记录
明确说明地址来自 @aastar/sdk token-registry（SDK bundle 单一一致条目），getTokenContracts() 目前对 Sepolia 报错所以本地固定，并注明随 SDK 变更需重新对齐 ✓
APPROVE
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses the two #420 review follow-ups:
TokenTierConfigDto—@Matches(/^\d+$/)ontier1Limit/tier2Limit/dailyLimitso a non-numeric value is rejected at validation (400) instead of throwing in the service'sBigInt(...)→ an opaque 500. Verified: base-unit integers pass;abc/1.5/empty/negatives reject.tier-profiles.ts— documents that USDC/USDT are the canonical @aastar/sdk token-registry Sepolia addresses (verified against the SDK bundle — single, consistent entry each — and the tokens/sale-client resolution;getTokenContracts()errors for Sepolia, so they're pinned with a re-align note).tsc + lint green (backend + frontend); backend build verified.