Skip to content

fix(frontend): parse limit-order units safely#13289

Draft
cursor[bot] wants to merge 1 commit into
mainfrom
cursor/critical-correctness-bugs-dc1d
Draft

fix(frontend): parse limit-order units safely#13289
cursor[bot] wants to merge 1 commit into
mainfrom
cursor/critical-correctness-bugs-dc1d

Conversation

@cursor

@cursor cursor Bot commented Jun 30, 2026

Copy link
Copy Markdown
Contributor

Motivation

Limit-order submission converts the reviewed human base amount and price into candid bigint units. The merged helpers multiplied JavaScript number values by 10 ** decimals and passed .toFixed(0) into BigInt. For 18-decimal tokens, valid values such as 1000 scale to 1e+21, which BigInt rejects, and high-precision decimal values can also be rounded to a different smallest-unit amount than the UI reviewed.

Awareness checked before and after the fix: recent merged limit-order PRs #13253, #13254, #13255; open stacked limit-order PRs #13256-#13268 and staging branch #13220; related OISY TRADE stale-principal PR #13246; PR bodies, reviews/comments, commit messages, docs/spec docs/ai/spec-driven-development/specs/2026-06-04-feat-limit-orders.md, open/recent issues, and PR/issue searches for toQuantity, toPriceUnits, limit-order precision, and OISY TRADE conversion. No active or merged work was found that fixes this conversion trigger; the open stack makes the helpers reachable but does not cover this bug.

Changes

  • Convert limit-order quantity and price units through the existing decimal token parser instead of floating-point smallest-unit multiplication.
  • Round only to the token's declared decimals before parsing, avoiding binary artifacts while preserving the reviewed decimal value.
  • Add regression coverage for large 18-decimal values that previously produced exponential BigInt input and for decimal precision preservation.

Tests

  • PATH="/home/ubuntu/.nvm/versions/node/v24.18.0/bin:$PATH" npm run prepare
  • PATH="/home/ubuntu/.nvm/versions/node/v24.18.0/bin:$PATH" npm run test -- --run src/frontend/src/tests/lib/utils/oisy-trade.utils.spec.ts
  • PATH="/home/ubuntu/.nvm/versions/node/v24.18.0/bin:$PATH" npm run format
  • PATH="/home/ubuntu/.nvm/versions/node/v24.18.0/bin:$PATH" npm run lint -- --max-warnings 0
  • PATH="/home/ubuntu/.nvm/versions/node/v24.18.0/bin:$PATH" npm run check
  • PATH="/home/ubuntu/.nvm/versions/node/v24.18.0/bin:$PATH" npm run test (915 files passed, 1 skipped; 15685 tests passed, 10 skipped, 1 todo)
  • PATH="/home/ubuntu/.nvm/versions/node/v24.18.0/bin:$PATH" npm run lint:lockfile
Open in Web View Automation 

Co-authored-by: Antonio Ventilii <AntonioVentilii@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant