[NONEVM-5607] Overflow Static Analyzer#802
Open
patricios-space wants to merge 6 commits into
Open
Conversation
patricios-space
changed the title
patricios-space
force-pushed
the
sec/overflow-static-analyzer
branch
from
July 21, 2026 17:28
b7b7082 to
3350b91
Compare
patricios-space
marked this pull request as ready for review
July 21, 2026 18:14
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a TypeScript static analyzer to detect Tolk ABI-serialized types that can overflow a single TON cell (1023 bits / 4 refs), including support for custom-serialized types via doc-comment bounds annotations, and wires it into both Yarn scripts and Nix tooling.
Changes:
- Introduces
scripts/overflowCheck.tsto compute worst-case bit/ref usage across ABI type graphs and report unsafe cell boundaries. - Adds a minimal TOML parser for
Acton.tomland reuses it fromabigen.ts. - Exposes the analyzer via
yarn check-overflowsand adefault.nixoverflow-checkshell application; annotatesCrossChainAddressserialization bounds.
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| contracts/scripts/overflowCheck.ts | New analyzer that walks ABI types, computes bounds, and aggregates reports/diagnostics across contracts. |
| contracts/scripts/acton/toml.ts | New minimal TOML parser used to read Acton.toml contract entries. |
| contracts/scripts/abigen.ts | Switches TOML parsing import to the new shared parser. |
| contracts/package.json | Adds a Yarn script entry to run the overflow checker. |
| contracts/default.nix | Adds overflow-check wrapper script for running the analyzer from Nix tooling. |
| contracts/contracts/ccip/common/types.tolk | Adds ABI serialization bounds annotation for a custom-serialized type. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+171
to
+178
| function widen(alternatives: Bounds[]): Bounds { | ||
| return alternatives.reduce((acc, b) => ({ | ||
| minBits: Math.min(acc.minBits, b.minBits), | ||
| maxBits: Math.max(acc.maxBits, b.maxBits), | ||
| minRefs: Math.min(acc.minRefs, b.minRefs), | ||
| maxRefs: Math.max(acc.maxRefs, b.maxRefs), | ||
| })) | ||
| } |
patricios-space
force-pushed
the
sec/overflow-static-analyzer
branch
from
July 21, 2026 21:30
a83a9f5 to
9f9b14e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
NONEVM-5607