2026 02 17 audit by thedavidmeister · Pull Request #429 · rainlanguage/rain.interpreter

thedavidmeister · 2026-02-17T19:44:25Z

Motivation

Solution

Checks

By submitting this for review, I'm confirming I've done the following:

made this PR as small as possible
unit-tested any new functionality
linked any relevant issues or PRs
included screenshots (if this involves a front-end change)

Uncomments 4 disabled test groups (testCallTraceOuterAndInner, testCallTraceOuterAndTwoInner, testOpCallRunNoIO, testOpCallRunRecursive) and updates them from old uint256/1e18 encoding to StackItem/Float. Uses LibDecimalFloat.eq for stack comparisons and LibDecimalFloat.add with FLOAT_ONE/FLOAT_TWO constants for trace expected values. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Findings only in agent task output are lost on context compaction. Each run gets an ISO 8601 date namespace to preserve history. The file is the record of truth. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…quirements - Add precedence statement: CLAUDE.md takes priority over session summaries - Define "test" step explicitly: write tests for new paths + run full suite - Require new code from fixes to meet AUDIT.md requirements Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Prevents silent mstore8 truncation when column or row exceeds uint8. All current callers pass hardcoded constants (0 or 1) but the guard makes the contract defensive against future misuse. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Tests valid context bytecode generation for all uint8 column/row values, and verifies revert on column or row overflow. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…coded pass count - Add Pass 0 for reviewing process documents before code audit - Change directory naming to <YYYY-MM-DD>-<NN> for multi-run disambiguation - Use <M> for pass number distinct from <NN> run number - Replace hardcoded "four passes" with "passes defined below" Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…ation rule Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Build (pointer regeneration) must complete before tests can compile, so the cycle is understand -> fix -> build -> test -> verify. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CRITICAL/HIGH/MEDIUM/LOW/INFO with definitions so agents use a consistent scheme across passes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The 16-bit pointer invariant is owned by the parse library, so the overflow check belongs there. RainterpreterParser modifier now delegates to LibParseState.checkParseMemoryOverflow(). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Introduces PARSE_STATE_TOP_LEVEL0_OFFSET, PARSE_STATE_TOP_LEVEL0_DATA_OFFSET, PARSE_STATE_PAREN_TRACKER0_OFFSET, and PARSE_STATE_LINE_TRACKER_OFFSET in LibParseState.sol. Replaces all magic numbers (0x20, 0x21, 0x60, 0xa0) in assembly blocks across LibParseState.sol and LibParse.sol with block-scoped local variables loading from these constants. Adds offset validation tests. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…ToSource Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add early `cursor >= end` check before reading the final character via `mload(cursor)`, preventing a read past the logical end of parse data when no closing `]` is found. Test proves a `]` in memory just past `end` is correctly rejected. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Document why LibParseStackTracker.pop subtracts directly from the packed word while push must extract-modify-repack (push needs to update max). Change highwater ParseStackOverflow check from == to >= for defensive robustness. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add stable agent ID ordering (A01, A02, ...) and triage section to AUDIT.md so finding progress survives context compaction. Create triage.md with disposition of all 51 pass 1 LOW+ findings. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add testRainterpreterReferenceExternExternDirect to cover the BaseRainterpreterExtern.extern() happy path via direct call. Regenerate deploy constants cascading from prior parser changes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Fuzz test verifies that out-of-range opcodes wrap via mod to a valid function pointer rather than reverting at runtime. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Fuzz test calls externIntegrity() on RainterpreterReferenceExtern and verifies the dispatch result matches the library-level function. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Fuzz test verifies opcode == fsCount - 1 does not revert with ExternOpcodeOutOfRange, confirming the bounds check boundary. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Removes audit directory from .gitignore and commits all audit findings from passes 1 (security), 2 (test coverage), and 3 (documentation), along with triage tracking files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…ults fork_block_number and fork_url both used short = 'i', which would cause a clap panic at runtime. Changed fork_block_number to short = 'b'. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

… LibParse These two file-level constants were defined but never referenced anywhere in the codebase. FSM_ACTIVE_SOURCE_MASK (imported from LibParseState) is the constant actually used. Test file changes are formatting only. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The NatSpec documented 5 bits with wrong positions and two phantom bits (LHS/RHS, interstitial) that have no corresponding constants. Corrected to match the 4 actual FSM constants: YANG(0), WORD_END(1), ACCEPTING_INPUTS(2), ACTIVE_SOURCE(3). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

selectLiteralParserByIndex loaded function pointers via assembly and typed them as pure, but parseSubParseable is view. Corrected the return type to view and cascaded through all callers: parseLiteral, tryParseLiteral, parseOperand, pushLiteral, parsePragma, parseRHS, and parsePragma1. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

A26-1: Change From<ForkTypedReturn<eval4Call>> to TryFrom with MissingTraces error instead of panicking unwrap(). A26-4: Fix search_trace_by_path loop to search by current_source_index and advance parent correctly for 3+ level paths. Add 3-level test. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

A27-3: Update parser and dispair crates from edition 2021 to 2024 to match workspace. A27-13: Move parse_pragma_text from inherent method on ParserV2 to default method on Parser2 trait. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

coderabbitai · 2026-02-17T19:44:36Z

Important

Review skipped

Too many files!

This PR contains 208 files, which is 58 over the limit of 150.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch 2026-02-17-audit

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tests serialize/deserialize round-trip, all passthrough fields (sourceIndex, namespace, store, context, fs), and stack allocation for single and multi-source bytecode. Uses external wrapper contract to avoid stack-too-deep. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Tests push overflow, pop underflow, pushInputs overflow, successful push/pop/pushInputs, and high watermark update/preserve behavior. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

A43-1 endLine: test files exist (endLine.t.sol, OpcodeIOOverflow.t.sol) A44-1 subParseWordSlice: all paths covered by integration tests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

github-actions · 2026-02-18T07:55:10Z

@coderabbitai assess this PR size classification for the totality of the PR with the following criterias and report it in your comment:

S/M/L PR Classification Guidelines:

This guide helps classify merged pull requests by effort and complexity rather than just line count. The goal is to assess the difficulty and scope of changes after they have been completed.

Small (S)

Characteristics:

Simple bug fixes, typos, or minor refactoring
Single-purpose changes affecting 1-2 files
Documentation updates
Configuration tweaks
Changes that require minimal context to review

Review Effort: Would have taken 5-10 minutes

Examples:

Fix typo in variable name
Update README with new instructions
Adjust configuration values
Simple one-line bug fixes
Import statement cleanup

Medium (M)

Characteristics:

Feature additions or enhancements
Refactoring that touches multiple files but maintains existing behavior
Breaking changes with backward compatibility
Changes requiring some domain knowledge to review

Review Effort: Would have taken 15-30 minutes

Examples:

Add new feature or component
Refactor common utility functions
Update dependencies with minor breaking changes
Add new component with tests
Performance optimizations
More complex bug fixes

Large (L)

Characteristics:

Major feature implementations
Breaking changes or API redesigns
Complex refactoring across multiple modules
New architectural patterns or significant design changes
Changes requiring deep context and multiple review rounds

Review Effort: Would have taken 45+ minutes

Examples:

Complete new feature with frontend/backend changes
Protocol upgrades or breaking changes
Major architectural refactoring
Framework or technology upgrades

Additional Factors to Consider

When deciding between sizes, also consider:

Test coverage impact: More comprehensive test changes lean toward larger classification
Risk level: Changes to critical systems bump up a size category
Team familiarity: Novel patterns or technologies increase complexity

Notes:

the assessment must be for the totality of the PR, that means comparing the base branch to the last commit of the PR
the assessment output must be exactly one of: S, M or L (single-line comment) in format of: SIZE={S/M/L}
do not include any additional text, only the size classification
your assessment comment must not include tips or additional sections
do NOT tag me or anyone else on your comment

thedavidmeister and others added 30 commits February 17, 2026 12:55

Require audit agents to write findings to dated files

c29c937

Findings only in agent task output are lost on context compaction. Each run gets an ISO 8601 date namespace to preserve history. The file is the record of truth. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add tests for ContextGridOverflow in subParserContext

f441f02

Tests valid context bytecode generation for all uint8 column/row values, and verifies revert on column or row overflow. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove Pass 0 same-conversation instruction to match separate convers…

9674e36

…ation rule Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Reorder jidoka cycle: build before test

d608204

Build (pointer regeneration) must complete before tests can compile, so the cycle is understand -> fix -> build -> test -> verify. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Define severity classification scale for audit findings

752cad9

CRITICAL/HIGH/MEDIUM/LOW/INFO with definitions so agents use a consistent scheme across passes. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Document 8-bit opcode and 16-bit operand caller constraints on pushOp…

8d4fb62

…ToSource Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Document 16-bit pointer truncation risk in pushSubParser

8b86dc8

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Document unchecked addition safety constraints in push and pushInputs

141b962

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Document unchecked arithmetic safety in LibParseLiteralRepeat

63ec23c

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add audit/known-false-positives.md to track triaged false positives

7f21958

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Document LibOpCall integrity and run functions

031fba2

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add LibOpExtern tests for BadOutputsLength and zero inputs/outputs

624781b

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Document ASCII-only input constraint in LibParse

116023d

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Document sub-parser trust model in LibSubParse

d1fc0c6

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add BadSubParserResult tests for wrong-length sub-parser bytecode

3b36dea

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Document checkParseMemoryOverflow dependency in newActiveSourcePointer

8f0c57c

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Document ioByte and opcodeIndex range constraints in subParserExtern

f7b254b

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add test for extern() opcode mod-wrapping behavior

6575278

Fuzz test verifies that out-of-range opcodes wrap via mod to a valid function pointer rather than reverting at runtime. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add test for externIntegrity() happy path via direct call

da2c3ef

Fuzz test calls externIntegrity() on RainterpreterReferenceExtern and verifies the dispatch result matches the library-level function. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add boundary test for externIntegrity() at highest valid opcode

7f34586

Fuzz test verifies opcode == fsCount - 1 does not revert with ExternOpcodeOutOfRange, confirming the bounds check boundary. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

thedavidmeister and others added 20 commits February 17, 2026 21:26

Add test for ZeroLengthHexLiteral revert in parseHex

adc0f85

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add test for OddLengthHexLiteral revert in parseHex

66f2d6f

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add test for MalformedCommentStart revert in skipComment

18339c1

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add test for NotAcceptingInputs revert in endLine

2878c38

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add test for ParseStackOverflow revert in highwater

9ff8560

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add test for ParenOverflow revert in LibParse

fe69234

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add test for OpcodeIOOverflow revert in endLine

4cbcff6

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add test for literalParserFunctionPointers output length

8238969

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add test for operandHandlerFunctionPointers output length

c7e6530

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add test for authoringMetaV2 content correctness

efe2a7f

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add test for four-array ordering consistency in LibAllStandardOps

1efea00

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add test for InputsLengthMismatch too-few-inputs direction

5059421

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add audit pass 1-3 results and triage files

49bfd65

Removes audit directory from .gitignore and commits all audit findings from passes 1 (security), 2 (test coverage), and 3 (documentation), along with triage tracking files. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Fix duplicate -i short flag in CLI fork args and add pass 4 audit res…

789f04c

…ults fork_block_number and fork_url both used short = 'i', which would cause a clap panic at runtime. Changed fork_block_number to short = 'b'. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove unused serde and serde_bytes dependencies from CLI crate

5e688b0

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

thedavidmeister and others added 5 commits February 18, 2026 08:57

Add LibParseStackTracker unit tests for all error paths

3b1f508

Tests push overflow, pop underflow, pushInputs overflow, successful push/pop/pushInputs, and high watermark update/preserve behavior. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Format Rust CLI eval.rs

6060475

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Mark remaining Pass 2 HIGHs as fixed

a2f7b56

A43-1 endLine: test files exist (endLine.t.sol, OpcodeIOOverflow.t.sol) A44-1 subParseWordSlice: all paths covered by integration tests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Format LibInterpreterStateDataContract test file

48fb634

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

thedavidmeister closed this Feb 18, 2026

thedavidmeister reopened this Feb 18, 2026

thedavidmeister merged commit e6ba607 into main Feb 18, 2026
11 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

2026 02 17 audit#429

2026 02 17 audit#429
thedavidmeister merged 65 commits intomainfrom
2026-02-17-audit

thedavidmeister commented Feb 17, 2026

Uh oh!

coderabbitai bot commented Feb 17, 2026 •

edited

Loading

Review skipped

Uh oh!

Uh oh!

github-actions bot commented Feb 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Comments

Conversation

thedavidmeister commented Feb 17, 2026

Motivation

Solution

Checks

Uh oh!

coderabbitai bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

Uh oh!

github-actions bot commented Feb 18, 2026

S/M/L PR Classification Guidelines:

Small (S)

Medium (M)

Large (L)

Additional Factors to Consider

Notes:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Comments

coderabbitai bot commented Feb 17, 2026 •

edited

Loading