Use crypto.getRandomValues for salt. Use helper utils to validate bigint values.

Author: jeffsmale90

packages/gator-permissions-snap/snap.manifest.json

@@ -7,7 +7,7 @@
     "url": "https://github.com/MetaMask/snap-7715-permissions.git"
   },
   "source": {
-    "shasum": "OuArP0RAiIuuilf8/74gv9GSFwhcUnQqC1xbLAvXpLk=",
+    "shasum": "PoFMZl7wTNzoiX+wVkMk8Gwmhxd4el+wY1HHBX0XjGs=",
     "location": {
       "npm": {
         "filePath": "dist/bundle.js",

packages/gator-permissions-snap/src/core/permissionRequestLifecycleOrchestrator.ts

@@ -234,11 +234,7 @@ export class PermissionRequestLifecycleOrchestrator {
       validBefore,
     );
 
-    // use a random salt to ensure unique delegation
-    const saltBytes = new Uint8Array(32);
-    for (let i = 0; i < 32; i++) {
-      saltBytes[i] = Math.floor(Math.random() * 256);
-    }
+    const saltBytes = crypto.getRandomValues(new Uint8Array(32));
     const salt = bytesToHex(saltBytes);
 
     const delegation = {

packages/gator-permissions-snap/src/permissions/erc20TokenStream/validation.ts

@@ -1,5 +1,6 @@
 import type { PermissionRequest } from '@metamask/7715-permissions-shared/types';
 import { extractZodError } from '@metamask/7715-permissions-shared/utils';
+import { validateHexInteger } from '../validation';
 
 import type {
   Erc20TokenStreamPermission,
@@ -16,30 +17,30 @@ import { zErc20TokenStreamPermission } from './types';
 function validatePermissionData(permission: Erc20TokenStreamPermission): true {
   const { initialAmount, maxAmount, amountPerSecond, startTime, tokenAddress } =
     permission.data;
-  const bigIntAmountPerSecond = BigInt(amountPerSecond);
 
-  if (maxAmount) {
-    if (BigInt(maxAmount) === 0n) {
-      throw new Error('Invalid maxAmount: must be a positive number');
-    }
-  }
+  validateHexInteger({
+    name: 'maxAmount',
+    value: maxAmount,
+    required: false,
+    allowZero: false,
+  });
 
-  if (initialAmount) {
-    const bigIntInitialAmount = BigInt(initialAmount);
-    if (bigIntInitialAmount === 0n) {
-      throw new Error('Invalid initialAmount: must be greater than zero');
-    }
-    if (maxAmount) {
-      if (BigInt(maxAmount) < bigIntInitialAmount) {
-        throw new Error(
-          'Invalid maxAmount: must be greater than initialAmount',
-        );
-      }
-    }
-  }
+  validateHexInteger({
+    name: 'initialAmount',
+    value: initialAmount,
+    required: false,
+    allowZero: false,
+  });
+
+  validateHexInteger({
+    name: 'amountPerSecond',
+    value: amountPerSecond,
+    required: true,
+    allowZero: false,
+  });
 
-  if (bigIntAmountPerSecond === 0n) {
-    throw new Error('Invalid amountPerSecond: must be a positive number');
+  if (initialAmount && maxAmount && BigInt(maxAmount) < BigInt(initialAmount)) {
+    throw new Error('Invalid maxAmount: must be greater than initialAmount');
   }
 
   if (startTime <= 0) {

packages/gator-permissions-snap/src/permissions/nativeTokenPeriodic/validation.ts

@@ -1,5 +1,6 @@
 import type { PermissionRequest } from '@metamask/7715-permissions-shared/types';
 import { extractZodError } from '@metamask/7715-permissions-shared/utils';
+import { validateHexInteger } from '../validation';
 
 import type {
   NativeTokenPeriodicPermission,
@@ -17,11 +18,13 @@ function validatePermissionData(
   permission: NativeTokenPeriodicPermission,
 ): true {
   const { periodAmount, periodDuration, startTime } = permission.data;
-  const bigIntPeriodAmount = BigInt(periodAmount);
 
-  if (bigIntPeriodAmount === 0n) {
-    throw new Error('Invalid periodAmount: must be a positive number');
-  }
+  validateHexInteger({
+    name: 'periodAmount',
+    value: periodAmount,
+    required: true,
+    allowZero: false,
+  });
 
   if (periodDuration <= 0) {
     throw new Error('Invalid periodDuration: must be a positive number');

packages/gator-permissions-snap/src/permissions/nativeTokenStream/validation.ts

@@ -1,5 +1,6 @@
 import type { PermissionRequest } from '@metamask/7715-permissions-shared/types';
 import { extractZodError } from '@metamask/7715-permissions-shared/utils';
+import { validateHexInteger } from '../validation';
 
 import type {
   NativeTokenStreamPermission,
@@ -16,30 +17,30 @@ import { zNativeTokenStreamPermission } from './types';
 function validatePermissionData(permission: NativeTokenStreamPermission): true {
   const { initialAmount, maxAmount, amountPerSecond, startTime } =
     permission.data;
-  const bigIntAmountPerSecond = BigInt(amountPerSecond);
 
-  if (maxAmount) {
-    if (BigInt(maxAmount) === 0n) {
-      throw new Error('Invalid maxAmount: must be a positive number');
-    }
-  }
+  validateHexInteger({
+    name: 'maxAmount',
+    value: maxAmount,
+    required: false,
+    allowZero: false,
+  });
 
-  if (initialAmount) {
-    const bigIntInitialAmount = BigInt(initialAmount);
-    if (bigIntInitialAmount === 0n) {
-      throw new Error('Invalid initialAmount: must be greater than zero');
-    }
-    if (maxAmount) {
-      if (BigInt(maxAmount) < bigIntInitialAmount) {
-        throw new Error(
-          'Invalid maxAmount: must be greater than initialAmount',
-        );
-      }
-    }
-  }
+  validateHexInteger({
+    name: 'initialAmount',
+    value: initialAmount,
+    required: false,
+    allowZero: false,
+  });
+
+  validateHexInteger({
+    name: 'amountPerSecond',
+    value: amountPerSecond,
+    required: true,
+    allowZero: false,
+  });
 
-  if (bigIntAmountPerSecond === 0n) {
-    throw new Error('Invalid amountPerSecond: must be a positive number');
+  if (initialAmount && maxAmount && BigInt(maxAmount) < BigInt(initialAmount)) {
+    throw new Error('Invalid maxAmount: must be greater than initialAmount');
   }
 
   if (startTime <= 0) {

packages/gator-permissions-snap/src/permissions/validation.ts

@@ -0,0 +1,44 @@
+import { Hex } from 'viem';
+
+/**
+ * Validates a hex integer value with configurable constraints.
+ *
+ * @param params - The validation parameters.
+ * @param params.name - The name of the value being validated, used in error messages.
+ * @param params.value - The hex value to validate.
+ * @param params.allowZero - Whether zero values are allowed.
+ * @param params.required - Whether the value is required (must be defined).
+ * @throws {Error} If the value fails validation.
+ */
+export function validateHexInteger({
+  name,
+  value,
+  allowZero,
+  required,
+}: {
+  name: string;
+  value: Hex | undefined;
+  allowZero: boolean;
+  required: boolean;
+}) {
+  if (value === undefined || value === null) {
+    if (!required) {
+      return;
+    }
+
+    throw new Error(`Invalid ${name}: must be defined`);
+  }
+  let parsedValue: bigint;
+
+  try {
+    parsedValue = BigInt(value);
+  } catch (error) {
+    throw new Error(`Invalid ${name}: must be a valid hex integer`);
+  }
+
+  if (parsedValue === 0n && !allowZero) {
+    throw new Error(`Invalid ${name}: must be greater than 0`);
+  }
+
+  return parsedValue;
+}

packages/gator-permissions-snap/test/permissions/erc20TokenStream/validation.test.ts

@@ -72,7 +72,7 @@ describe('erc20TokenStream:validation', () => {
         };
 
         expect(() => parseAndValidatePermission(zeroMaxAmountRequest)).toThrow(
-          'Invalid maxAmount: must be a positive number',
+          'Invalid maxAmount: must be greater than 0',
         );
       });
 
@@ -110,7 +110,7 @@ describe('erc20TokenStream:validation', () => {
 
         expect(() =>
           parseAndValidatePermission(zeroInitialAmountRequest),
-        ).toThrow('Invalid initialAmount: must be greater than zero');
+        ).toThrow('Invalid initialAmount: must be greater than 0');
       });
 
       it('should allow missing initialAmount', () => {
@@ -146,7 +146,7 @@ describe('erc20TokenStream:validation', () => {
 
         expect(() =>
           parseAndValidatePermission(zeroAmountPerSecondRequest),
-        ).toThrow('Invalid amountPerSecond: must be a positive number');
+        ).toThrow('Invalid amountPerSecond: must be greater than 0');
       });
     });
 

packages/gator-permissions-snap/test/permissions/nativeTokenPeriodic/validation.test.ts

@@ -73,7 +73,7 @@ describe('nativeTokenPeriodic:validation', () => {
 
         expect(() =>
           parseAndValidatePermission(zeroPeriodAmountRequest),
-        ).toThrow('Invalid periodAmount: must be a positive number');
+        ).toThrow('Invalid periodAmount: must be greater than 0');
       });
     });
 

packages/gator-permissions-snap/test/permissions/nativeTokenStream/validation.test.ts

@@ -69,7 +69,7 @@ describe('nativeTokenStream:validation', () => {
         };
 
         expect(() => parseAndValidatePermission(zeroMaxAmountRequest)).toThrow(
-          'Invalid maxAmount: must be a positive number',
+          'Invalid maxAmount: must be greater than 0',
         );
       });
 
@@ -107,7 +107,7 @@ describe('nativeTokenStream:validation', () => {
 
         expect(() =>
           parseAndValidatePermission(zeroInitialAmountRequest),
-        ).toThrow('Invalid initialAmount: must be greater than zero');
+        ).toThrow('Invalid initialAmount: must be greater than 0');
       });
 
       it('should allow missing initialAmount', () => {
@@ -143,7 +143,7 @@ describe('nativeTokenStream:validation', () => {
 
         expect(() =>
           parseAndValidatePermission(zeroAmountPerSecondRequest),
-        ).toThrow('Invalid amountPerSecond: must be a positive number');
+        ).toThrow('Invalid amountPerSecond: must be greater than 0');
       });
     });
 

packages/permissions-kernel-snap/src/permissions/index.ts

@@ -1 +1,2 @@
 export * from './origin';
+export * from './validation';