assets: explicitly allow precision field to be optional
What the developer wrote
Authored by Mike Tolkachev
assets: explicitly allow precision field to be optional
What changed, and why it matters
This small change makes the 'precision' number in asset metadata optional, defaulting to 0 if missing. Previously, the code may have treated a missing precision field as a failure. The patch uses a wrapper that explicitly ignores any error from reading the field, which could hide unexpected parsing problems. There is no direct evidence this is exploitable, but silently ignoring errors can make future bugs harder to detect.
Review whether IGNORE_RESULT is appropriate here or whether a specific 'field missing' return code should be accepted while other errors are still handled. Consider adding a test case for a contract missing the precision field and for a malformed precision field.
Security signals we found
Use of IGNORE_RESULT macro suppresses return-value checking
Optional field handling change in asset contract parsing
Potential masking of CBOR parsing errors for precision field
Evidence from the diff
In main/assets.c, assets_get_allocate() now calls IGNORE_RESULT(rpc_get_sizet(“precision”, &contract, &precision)) instead of checking the return value. The commit message states the precision field is optional in the asset contract and defaults to 0. The change prevents a missing precision field from failing the asset load. However, IGNORE_RESULT also suppresses all error paths from rpc_get_sizet, including malformed CBOR or type mismatches, which could mask parsing issues. No buffer overflow, injection, or cryptographic weakness is visible in the diff.
Changed components
main/assets.cassets_get_allocate()Liquid asset contract parsingInspect captured patch +2 / −1
diff --git a/main/assets.c b/main/assets.c
index 53a87da..4f49408 100644
--- a/main/assets.c
+++ b/main/assets.c
@@ -168,8 +168,9 @@ bool assets_get_allocate(const char* field, const CborValue* value, asset_info_t
rpc_get_string_ptr("domain", &entity, &asset->issuer_domain, &asset->issuer_domain_len);
}
+ // "precision" field is optional in the asset contract and defaults to 0
size_t precision = 0;
- rpc_get_sizet("precision", &contract, &precision);
+ IGNORE_RESULT(rpc_get_sizet("precision", &contract, &precision));
asset->precision = precision;
}
Why this scored 26/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.