fix: reject --oid values above 2^53-1 on perp cancel - #497
Conversation
Large Hyperliquid uint64 order IDs are silently rounded by JS Number, which could cancel the wrong order. Refuse at input for the same reason the response path withholds unsafe oids.
pr-reviewer Summary for #223a9d5✅ No issues found The code review completed successfully with no findings. Review effort: 1/5 (Trivial) SummaryThis PR correctly fixes a real trading-safety bug: Token usage: 828 input, 2,151 output, 163,103 cache read, 17,597 cache write | Usage Guide New pushes are reviewed automatically with a 10-minute cooldown between reviews. To request a review at any time, comment |
![nansen-pr-reviewer[bot]](https://avatars.githubusercontent.com/in/2987756?s=60&v=4){kind=small}
There was a problem hiding this comment.
Auto-approved
This PR was automatically approved because:
- Claude recommends approval
- Claude assessed this as a minimal effort change
- The effort level is within the auto-approval threshold of 2
- No high or critical issues were detected
If you have any concerns, please request a manual review.
|
Friendly ping. This is ready for review when you have a moment. Happy to address any feedback. @kome12 |
2 participants
Summary
perp cancel --oidparsed viaparseIntwhich silently rounds uint64 IDs above 2^53-1, potentially cancelling the wrong orderNumber.isSafeIntegerguard — same logic the response path already uses to withhold unsafe oids from outputTest plan
npx vitest run src/__tests__/perp.test.js -t cancel--oid 9007199254740992(2^53) → error: "exceeds safe integer precision"--oid 9007199254740991(2^53-1) → passes validation