Amount validation: negative/malformed BigInt possible

[a6b8]

Classification

• Security hardening

Problem

Amount strings are passed to BigInt() without strict validation. BigInt("-100") produces a negative value, BigInt(" 100 ") accepts whitespace.

Affected Files

• src/v2/exact/evm/ServerExact.mjs lines 344-353

Expected vs Actual

• Expected: Only positive integer strings accepted
• Actual: Negative values and whitespace pass through

Recommendation

Strict regex validation before BigInt conversion:

if( !/^[0-9]+$/.test( amountString ) ) { ... }

Severity

MEDIUM