Description
In NewBuilderBids, big.Int.SetString() returns (value, ok) where ok indicates success, but the return value is completely ignored. If any Redis-stored bid value contains invalid characters for base-10 parsing (e.g., malformed data, corruption, or malicious input), SetString will fail silently - the bid value will remain at its zero-initialized big.Int (0) instead of the actual value. This corrupts auction calculations since zero bids will be considered, potentially causing invalid block selections or fund loss.
Severity: high
File: datastore/utils.go
Expected Behavior
The code should handle this case properly to avoid unexpected errors or degraded quality.
Description
In
NewBuilderBids,big.Int.SetString()returns(value, ok)where ok indicates success, but the return value is completely ignored. If any Redis-stored bid value contains invalid characters for base-10 parsing (e.g., malformed data, corruption, or malicious input),SetStringwill fail silently - the bid value will remain at its zero-initializedbig.Int(0) instead of the actual value. This corrupts auction calculations since zero bids will be considered, potentially causing invalid block selections or fund loss.Severity:
highFile:
datastore/utils.goExpected Behavior
The code should handle this case properly to avoid unexpected errors or degraded quality.