Skip to content

Commit 44d53b3

Browse files
fbsobreirafbsobreira
authored
fix: pre-release improvements — deps, result decoding, cleanup (#289)
- Update direct deps: btcec v2.3.6, go-ethereum v1.17.1, cobra v1.10.2, crypto v0.49.0, term v0.41.0, zap v1.27.1 - Add Dec.Display() for trailing-zero-free numeric formatting - Add auto-decode for contract constant results (uint256, string, bool, address) - Replace trc20enc init() hex decoding with pre-computed byte literals - Return explicit error for ledger message signing (was silent no-op) - Remove dead commented-out signature validation code
1 parent 696c6d0 commit 44d53b3

10 files changed

Lines changed: 140 additions & 53 deletions

File tree

‎.github/ISSUE_TEMPLATE/SECURITY.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ The following versions of gotron-sdk are currently being supported with security
1616
We take the security of gotron-sdk seriously. If you believe you've found a security vulnerability, please follow these steps:
1717

1818
1. **Do not disclose the vulnerability publicly**
19-
2. **Email us directly** at security@cryptochain.network
19+
2. **Email us directly** at security@gotron.sh
2020
3. **Include the following information**:
2121
- A description of the vulnerability
2222
- Steps to reproduce the issue

‎.goreleaser.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ builds:
1212
- -X main.version=v{{ .Version }}
1313
- -X main.commit={{ .ShortCommit }}
1414
- -X main.builtAt={{ .Date }}
15-
- -X main.builtBy=goreleaser@cryptochain.network
15+
- -X main.builtBy=goreleaser@gotron.sh
1616
goos:
1717
- linux
1818
- darwin

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ SHELL := /bin/bash
22
version := $(shell git rev-list --count HEAD)
33
commit := $(shell git describe --always --long --dirty)
44
built_at := $(shell date +%FT%T%z)
5-
built_by := ${USER}@cryptochain.network
5+
built_by := ${USER}@gotron.sh
66
BUILD_TARGET := tronctl
77

88
flags := -gcflags="all=-N -l -c 2"

‎cmd/subcommands/contract.go‎

Lines changed: 67 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"encoding/json"
55
"fmt"
66
"math"
7+
"math/big"
78
"os"
89
"strings"
910

@@ -200,8 +201,19 @@ func contractConstantCmd() *cobra.Command {
200201
}
201202

202203
result := make(map[string]interface{})
203-
//TODO: parse based on contract ABI
204-
result["Result"] = common.BytesToHexString(cResult[0])
204+
if len(cResult) == 0 {
205+
result["Result"] = ""
206+
} else {
207+
result["Result"] = common.BytesToHexString(cResult[0])
208+
209+
// Try to auto-decode common return types
210+
if len(cResult[0]) >= 32 {
211+
decoded := tryDecodeResult(cResult[0])
212+
for k, v := range decoded {
213+
result[k] = v
214+
}
215+
}
216+
}
205217

206218
asJSON, _ := json.Marshal(result)
207219
fmt.Println(common.JSONPrettyFormat(string(asJSON)))
@@ -212,6 +224,59 @@ func contractConstantCmd() *cobra.Command {
212224
return cmd
213225
}
214226

227+
// tryDecodeResult attempts to auto-decode ABI-encoded return data into
228+
// human-readable values. It handles the most common return types:
229+
// uint256, bool, string, and address.
230+
func tryDecodeResult(data []byte) map[string]interface{} {
231+
result := make(map[string]interface{})
232+
233+
if len(data) < 32 {
234+
return result
235+
}
236+
237+
first32 := data[:32]
238+
val := new(big.Int).SetBytes(first32)
239+
240+
// 1. Try ABI-encoded string first (offset=32 at first word)
241+
if len(data) >= 64 && val.IsUint64() && val.Uint64() == 32 {
242+
lengthWord := new(big.Int).SetBytes(data[32:64])
243+
if lengthWord.IsUint64() {
244+
strLen := lengthWord.Uint64()
245+
if strLen > 0 && strLen < 1024 && 64+strLen <= uint64(len(data)) {
246+
result["asString"] = string(data[64 : 64+strLen])
247+
return result
248+
}
249+
}
250+
}
251+
252+
// 2. Try TRON address (first 12 bytes zero, 160-bit payload)
253+
allZero := true
254+
for i := 0; i < 12; i++ {
255+
if first32[i] != 0 {
256+
allZero = false
257+
break
258+
}
259+
}
260+
if allZero && val.BitLen() > 64 && val.BitLen() <= 160 {
261+
evmAddr := first32[12:]
262+
tronAddr := make([]byte, 21)
263+
tronAddr[0] = 0x41
264+
copy(tronAddr[1:], evmAddr)
265+
result["asAddress"] = address.Address(tronAddr).String()
266+
return result
267+
}
268+
269+
// 3. Try bool (0 or 1)
270+
if val.IsUint64() && (val.Uint64() == 0 || val.Uint64() == 1) {
271+
result["asBool"] = val.Uint64() == 1
272+
}
273+
274+
// 4. Try number (full uint256)
275+
result["asNumber"] = val.String()
276+
277+
return result
278+
}
279+
215280
func contractTriggerCmd() *cobra.Command {
216281
cmd := &cobra.Command{
217282
Use: "trigger <CONTRACT_ADDRESS> <METHOD> [PARAMETER]",

‎go.mod‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,20 +14,20 @@ retract (
1414

1515
require (
1616
github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de
17-
github.com/btcsuite/btcd/btcec/v2 v2.3.4
17+
github.com/btcsuite/btcd/btcec/v2 v2.3.6
1818
github.com/deckarep/golang-set v1.8.0
19-
github.com/ethereum/go-ethereum v1.17.0
19+
github.com/ethereum/go-ethereum v1.17.1
2020
github.com/fatih/color v1.18.0
2121
github.com/fatih/structs v1.1.0
2222
github.com/fbsobreira/go-bip39 v1.2.0
2323
github.com/joho/godotenv v1.5.1
2424
github.com/pborman/uuid v1.2.1
2525
github.com/rjeczalik/notify v0.9.3
2626
github.com/shengdoushi/base58 v1.0.0
27-
github.com/spf13/cobra v1.9.1
27+
github.com/spf13/cobra v1.10.2
2828
github.com/stretchr/testify v1.11.1
2929
github.com/zondax/hid v0.9.2
30-
go.uber.org/zap v1.27.0
30+
go.uber.org/zap v1.27.1
3131
golang.org/x/crypto v0.46.0
3232
golang.org/x/term v0.38.0
3333
google.golang.org/genproto/googleapis/api v0.0.0-20251222181119-0a764e51fe1b
@@ -48,8 +48,9 @@ require (
4848
github.com/mattn/go-isatty v0.0.20 // indirect
4949
github.com/pmezard/go-difflib v1.0.0 // indirect
5050
github.com/russross/blackfriday/v2 v2.1.0 // indirect
51-
github.com/spf13/pflag v1.0.6 // indirect
51+
github.com/spf13/pflag v1.0.9 // indirect
5252
go.uber.org/multierr v1.11.0 // indirect
53+
go.yaml.in/yaml/v3 v3.0.4 // indirect
5354
golang.org/x/net v0.48.0 // indirect
5455
golang.org/x/sys v0.39.0 // indirect
5556
golang.org/x/text v0.32.0 // indirect

‎go.sum‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ github.com/ProjectZKM/Ziren/crates/go-runtime/zkvm_runtime v0.0.0-20251001021608
22
github.com/ProjectZKM/Ziren/crates/go-runtime/zkvm_runtime v0.0.0-20251001021608-1fe7b43fc4d6/go.mod h1:ioLG6R+5bUSO1oeGSDxOV3FADARuMoytZCSX6MEMQkI=
33
github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de h1:FxWPpzIjnTlhPwqqXc4/vE0f7GvRjuAsbW+HOIe8KnA=
44
github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de/go.mod h1:DCaWoUhZrYW9p1lxo/cm8EmUOOzAPSEZNGF2DK1dJgw=
5-
github.com/btcsuite/btcd/btcec/v2 v2.3.4 h1:3EJjcN70HCu/mwqlUsGK8GcNVyLVxFDlWurTXGPFfiQ=
6-
github.com/btcsuite/btcd/btcec/v2 v2.3.4/go.mod h1:zYzJ8etWJQIv1Ogk7OzpWjowwOdXY1W/17j2MW85J04=
5+
github.com/btcsuite/btcd/btcec/v2 v2.3.6 h1:IzlsEr9olcSRKB/n7c4351F3xHKxS2lma+1UFGCYd4E=
6+
github.com/btcsuite/btcd/btcec/v2 v2.3.6/go.mod h1:m22FrOAiuxl/tht9wIqAoGHcbnCCaPWyauO8y2LGGtQ=
77
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
88
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
99
github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
@@ -17,8 +17,8 @@ github.com/decred/dcrd/crypto/blake256 v1.1.0 h1:zPMNGQCm0g4QTY27fOCorQW7EryeQ/U
1717
github.com/decred/dcrd/crypto/blake256 v1.1.0/go.mod h1:2OfgNZ5wDpcsFmHmCK5gZTPcCXqlm2ArzUIkw9czNJo=
1818
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc=
1919
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0/go.mod h1:ZXNYxsqcloTdSy/rNShjYzMhyjf0LaoftYK0p+A3h40=
20-
github.com/ethereum/go-ethereum v1.17.0 h1:2D+1Fe23CwZ5tQoAS5DfwKFNI1HGcTwi65/kRlAVxes=
21-
github.com/ethereum/go-ethereum v1.17.0/go.mod h1:2W3msvdosS/MCWytpqTcqgFiRYbTH59FxDJzqah120o=
20+
github.com/ethereum/go-ethereum v1.17.1 h1:IjlQDjgxg2uL+GzPRkygGULPMLzcYWncEI7wbaizvho=
21+
github.com/ethereum/go-ethereum v1.17.1/go.mod h1:7UWOVHL7K3b8RfVRea022btnzLCaanwHtBuH1jUCH/I=
2222
github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
2323
github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
2424
github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
@@ -70,10 +70,10 @@ github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQD
7070
github.com/scylladb/termtables v0.0.0-20191203121021-c4c0b6d42ff4/go.mod h1:C1a7PQSMz9NShzorzCiG2fk9+xuCgLkPeCvMHYR2OWg=
7171
github.com/shengdoushi/base58 v1.0.0 h1:tGe4o6TmdXFJWoI31VoSWvuaKxf0Px3gqa3sUWhAxBs=
7272
github.com/shengdoushi/base58 v1.0.0/go.mod h1:m5uIILfzcKMw6238iWAhP4l3s5+uXyF3+bJKUNhAL9I=
73-
github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
74-
github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
75-
github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
76-
github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
73+
github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
74+
github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
75+
github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
76+
github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
7777
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
7878
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
7979
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
@@ -96,8 +96,10 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
9696
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
9797
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
9898
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
99-
go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
100-
go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
99+
go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
100+
go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
101+
go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
102+
go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
101103
golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
102104
golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
103105
golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=

‎pkg/client/transaction/controller.go‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -119,17 +119,6 @@ func (C *Controller) hardwareSignTxForSending() {
119119
return
120120
}
121121

122-
/* TODO: validate signature
123-
if strings.Compare(signerAddr, address.ToBech32(C.sender.account.Address)) != 0 {
124-
C.executionError = ErrBadTransactionParam
125-
errorMsg := "signature verification failed : sender address doesn't match with ledger hardware address"
126-
C.transactionErrors = append(C.transactionErrors, &Error{
127-
ErrMessage: &errorMsg,
128-
TimestampOfRejection: time.Now().Unix(),
129-
})
130-
return
131-
}
132-
*/
133122
// add signature
134123
C.tx.Signature = append(C.tx.Signature, signature)
135124
}

‎pkg/common/numeric/numeric.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -414,6 +414,18 @@ func (d Dec) String() string {
414414
return string(bzStr)
415415
}
416416

417+
// Display returns a human-readable string with trailing zeros removed.
418+
// Unlike String(), which preserves full precision for serialization,
419+
// Display() is intended for user-facing output.
420+
func (d Dec) Display() string {
421+
s := d.String()
422+
if strings.Contains(s, ".") {
423+
s = strings.TrimRight(s, "0")
424+
s = strings.TrimRight(s, ".")
425+
}
426+
return s
427+
}
428+
417429
// ____
418430
// __| |__ "chop 'em
419431
// ` \ round!"

‎pkg/common/numeric/numeric_test.go‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -958,3 +958,33 @@ func TestBankersRounding(t *testing.T) {
958958
})
959959
}
960960
}
961+
962+
// ---------------------------------------------------------------------------
963+
// Display
964+
// ---------------------------------------------------------------------------
965+
966+
func TestDisplay(t *testing.T) {
967+
tests := []struct {
968+
name string
969+
dec numeric.Dec
970+
want string
971+
wantStr string // String() should preserve trailing zeros
972+
}{
973+
{"zero", numeric.ZeroDec(), "0", "0.000000000000000000"},
974+
{"one", numeric.OneDec(), "1", "1.000000000000000000"},
975+
{"smallest", numeric.SmallestDec(), "0.000000000000000001", "0.000000000000000001"},
976+
{"integer", numeric.NewDec(42), "42", "42.000000000000000000"},
977+
{"with decimals", numeric.NewDecWithPrec(1500, 3), "1.5", "1.500000000000000000"},
978+
{"precise", numeric.NewDecWithPrec(123456, 6), "0.123456", "0.123456000000000000"},
979+
{"negative", numeric.NewDec(-7), "-7", "-7.000000000000000000"},
980+
{"negative decimal", numeric.NewDecWithPrec(-2500, 3), "-2.5", "-2.500000000000000000"},
981+
{"large", numeric.NewDec(1000000), "1000000", "1000000.000000000000000000"},
982+
}
983+
984+
for _, tt := range tests {
985+
t.Run(tt.name, func(t *testing.T) {
986+
assert.Equal(t, tt.want, tt.dec.Display(), "Display()")
987+
assert.Equal(t, tt.wantStr, tt.dec.String(), "String() unchanged")
988+
})
989+
}
990+
}

‎pkg/standards/trc20enc/encode.go‎

Lines changed: 10 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -26,31 +26,19 @@ const (
2626
SelectorAllowance = "dd62ed3e"
2727
)
2828

29-
// Pre-decoded selector bytes, cached at init to avoid repeated hex decoding.
29+
// Pre-computed selector bytes — no init() or hex decoding needed.
3030
var (
31-
selectorNameBytes []byte
32-
selectorSymbolBytes []byte
33-
selectorDecimalsBytes []byte
34-
selectorTotalSupplyBytes []byte
35-
selectorBalanceOfBytes []byte
36-
selectorTransferBytes []byte
37-
selectorApproveBytes []byte
38-
selectorTransferFromBytes []byte
39-
selectorAllowanceBytes []byte
31+
selectorNameBytes = []byte{0x06, 0xfd, 0xde, 0x03}
32+
selectorSymbolBytes = []byte{0x95, 0xd8, 0x9b, 0x41}
33+
selectorDecimalsBytes = []byte{0x31, 0x3c, 0xe5, 0x67}
34+
selectorTotalSupplyBytes = []byte{0x18, 0x16, 0x0d, 0xdd}
35+
selectorBalanceOfBytes = []byte{0x70, 0xa0, 0x82, 0x31}
36+
selectorTransferBytes = []byte{0xa9, 0x05, 0x9c, 0xbb}
37+
selectorApproveBytes = []byte{0x09, 0x5e, 0xa7, 0xb3}
38+
selectorTransferFromBytes = []byte{0x23, 0xb8, 0x72, 0xdd}
39+
selectorAllowanceBytes = []byte{0xdd, 0x62, 0xed, 0x3e}
4040
)
4141

42-
func init() {
43-
selectorNameBytes, _ = hex.DecodeString(SelectorName)
44-
selectorSymbolBytes, _ = hex.DecodeString(SelectorSymbol)
45-
selectorDecimalsBytes, _ = hex.DecodeString(SelectorDecimals)
46-
selectorTotalSupplyBytes, _ = hex.DecodeString(SelectorTotalSupply)
47-
selectorBalanceOfBytes, _ = hex.DecodeString(SelectorBalanceOf)
48-
selectorTransferBytes, _ = hex.DecodeString(SelectorTransfer)
49-
selectorApproveBytes, _ = hex.DecodeString(SelectorApprove)
50-
selectorTransferFromBytes, _ = hex.DecodeString(SelectorTransferFrom)
51-
selectorAllowanceBytes, _ = hex.DecodeString(SelectorAllowance)
52-
}
53-
5442
// SelectorBytes returns a copy of the pre-decoded bytes for the given hex selector.
5543
// Returns nil if the selector is not recognized.
5644
func SelectorBytes(selector string) []byte {

0 commit comments

Comments
 (0)