Some characters in user-supplied option strings (name, symbol, uri) can't round-trip cleanly through generated Solidity contracts — ASCII control characters, Unicode line terminators recognised by Solidity's lexer (NEL, LS, PS, VT, FF), and lone UTF-16 surrogates. Today, some of these slip through and produce non-compiling Solidity or contracts that store unexpected bytes.
Add input validation at each build entry point (buildERC20, buildERC721, etc.) to reject these characters with an OptionsError, so the failure surfaces at the build boundary rather than downstream.
A WIP here covers the solidity package. The confidential (buildERC7984) and uniswap-hooks (buildHooks) packages need the same treatment.
Some characters in user-supplied option strings (
name,symbol,uri) can't round-trip cleanly through generated Solidity contracts — ASCII control characters, Unicode line terminators recognised by Solidity's lexer (NEL, LS, PS, VT, FF), and lone UTF-16 surrogates. Today, some of these slip through and produce non-compiling Solidity or contracts that store unexpected bytes.Add input validation at each build entry point (
buildERC20,buildERC721, etc.) to reject these characters with anOptionsError, so the failure surfaces at the build boundary rather than downstream.A WIP here covers the solidity package. The confidential (
buildERC7984) and uniswap-hooks (buildHooks) packages need the same treatment.