fix(tlock): validate drand quicknet response shapes before use (#280) by merciiiqode · Pull Request #286 · Sub-Rosa-Issue/sub-rosa-issue

merciiiqode · 2026-08-31T01:32:52Z

Summary

Reject malformed Drand chain-info and beacon responses before cryptographic code uses them.

Added packages/tlock/src/validate.ts with assertChainInfo and assertBeacon guards.
validate.ts checks required fields, hex shapes, and numeric ranges (period, genesis_time, round).
Wired the guards into quicknet.ts (chainInfo, fetchRoundBeacon, fetchRoundSignature).
Exported the validators from the public index.ts.
Added focused, offline unit tests in validate.test.ts.
Registered the new test file in the test scripts.

Closes #280

drips-wave · 2026-08-31T01:32:56Z

@merciiiqode Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

fix(tlock): validate drand quicknet response shapes before use (Sub-R…

a57b375

…osa-Issue#280)

karagozemin merged commit 5944134 into Sub-Rosa-Issue:main Aug 31, 2026