Chain ID parsing too lenient (parseInt)

[a6b8]

Classification

• Security hardening

Problem

parseInt() in evmNetworkParsing.mjs stops at the first non-digit character. "1_malicious_data" becomes 1, extra data is silently ignored.

Affected Files

• src/v2/exact/evm/evmNetworkParsing.mjs lines 21-29

Expected vs Actual

• Expected: Only pure numeric strings accepted
• Actual: parseInt("1abc") returns 1 without error

Recommendation

if( !/^\d+$/.test( chainIdString ) ) {
    throw new Error( 'Invalid chain ID format' )
}

Severity

MEDIUM