Skip to content

fix: [FIND-070] _replaceTokenHolder Zero-Index Corruption#1187

Merged
jaime-iobermudez merged 2 commits into
developmentfrom
fix/find-070
May 25, 2026
Merged

fix: [FIND-070] _replaceTokenHolder Zero-Index Corruption#1187
jaime-iobermudez merged 2 commits into
developmentfrom
fix/find-070

Conversation

@jaime-iobermudez
Copy link
Copy Markdown
Contributor

This pull request adds an important audit fix to the ERC1410 token holder management logic by ensuring that replaceTokenHolder correctly checks for the existence of the old token holder before attempting replacement. It also introduces a mock contract to facilitate direct testing of internal storage wrapper functions and adds comprehensive tests to verify the new guard logic.

Audit fix and testing improvements:

  • Added a guard in ERC1410StorageWrapper.replaceTokenHolder to revert with TokenHolderNotFound if the oldTokenHolder does not exist (i.e., its index is zero), preventing accidental corruption of the token holder registry.
  • Introduced the TokenHolderNotFound custom error to the IERC1410Types interface for clearer revert reasons.

Testing infrastructure:

  • Created MockERC1410StorageWrapper, a test-only contract that exposes internal functions of ERC1410StorageWrapper for direct unit testing, bypassing the diamond infrastructure.
  • Updated integration tests in SecurityHolders.test.ts to use the new mock contract and added tests that verify the new existence guard in replaceTokenHolder, including cases where the holder was never registered or was removed. [1] [2]

Type of change

  • Bug fix 🐞
  • New feature ✨
  • Breaking change 💥
  • Documentation update 📖
  • Refactor 🔧

Testing

Node version:

  • 20
  • 22
  • 24

Checklist

  • Style Guidelines followed ✅
  • Documentation Updated 📚
  • Linters - No New Warnings ⚠️
  • Local Tests Pass ✅
  • Effective Tests Added ✔️
  • No reduction of Coverage

Signed-off-by: jaime-iobermudez <jaime.bermudez@io.builders>
Signed-off-by: jaime-iobermudez <jaime.bermudez@io.builders>
@jaime-iobermudez jaime-iobermudez self-assigned this May 22, 2026
@jaime-iobermudez jaime-iobermudez requested review from a team as code owners May 22, 2026 10:19
@github-actions github-actions Bot added the hash-change PR modifies @custom:hash annotations or codegen formula — review on-chain impact carefully label May 22, 2026
@MiguelLZPF MiguelLZPF removed the hash-change PR modifies @custom:hash annotations or codegen formula — review on-chain impact carefully label May 25, 2026
@github-actions github-actions Bot added the hash-change PR modifies @custom:hash annotations or codegen formula — review on-chain impact carefully label May 25, 2026
@MiguelLZPF MiguelLZPF removed the hash-change PR modifies @custom:hash annotations or codegen formula — review on-chain impact carefully label May 25, 2026
@jaime-iobermudez jaime-iobermudez merged commit 5d553af into development May 25, 2026
24 checks passed
@jaime-iobermudez jaime-iobermudez deleted the fix/find-070 branch May 25, 2026 09:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants