Repository navigation
Fixed: three viem mismatches in native ABI coding, and moved to viem 2.56.3 - #1
Merged
Merged
Conversation
The tests also pin viem 2.56.3's handling of leading NUL bytes and zero-width types.
PetromirDev
marked this pull request as ready for review
October 6, 2026 12:52
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ambire's app moved to viem 2.56.3 (AmbireTech/ambire-app#8120), so this releases 1.0.1 pinned to it. Checking every viem change on the paths this package mirrors found nothing that needs new Rust, but it did find three older cases where the native path returns a value viem would not (since v1.0.0). The app never asks viem about those calls, so mobile can end up disagreeing with the extension.
How to reproduce
Address with a wrong checksum:
transfer(address,uint256)with the recipient0xD8DA6BF26964AF9D7EED9E03E53415D37AA96045, or with a checksummed address that has one letter's case flipped.Before, the native path built the calldata. Now it hands the call to viem, which throws
InvalidAddressErroras it always did, so a mistyped address is caught on mobile too.Small integer past JavaScript's safe range:
uint8result, or any type of 48 bits or fewer, whose word holds 2^53 or more, for example from a broken or malicious RPC.Before, the native path returned a rounded number. Now viem gets the call and throws
IntegerOutOfRangeError.String starting with a byte-order mark:
name()returns the bytesEF BB BFfollowed byUSDC.Before, mobile showed the name with an invisible character in front while the extension showed
USDC. Now both showUSDC.What we did
Encoding an address now goes through
parse_viem_strict_address, which holds a mixed-case address to its EIP-55 checksum the way viem's strictisAddressdoes.checksum_addresskeeps the lenient parse, matching viem'schecksumAddressandgetAddress.int_to_jsonrefused values pasti64but returned anything below that, so values between 2^53 and 2^63 came back rounded. It now refuses anything outsideJS_MAX_SAFE_INTEGERon either side.Decoded strings drop one leading
BYTE_ORDER_MARK, as viem'sTextDecoderdoes.Also: moved the
viempeer dependency to 2.56.3, added tests that pin its two behaviour changes on these paths (a string keeps its leading NUL bytes, and zero-width types such asuint256[0]still go to viem), and bumped the version to 1.0.1.