Fix minor code review issues in NFTStorefrontV2#113
Open
joshuahannan wants to merge 5 commits intomainfrom
Open
Fix minor code review issues in NFTStorefrontV2#113joshuahannan wants to merge 5 commits intomainfrom
joshuahannan wants to merge 5 commits intomainfrom
Conversation
- Issue 2: borrowNFT() — replace force-unwrap on provider borrow() with if-let so a revoked capability returns nil instead of panicking - Issue 4: Listing.init — replace nft! force-unwrap of borrowNFT result with ?? panic(...) for a descriptive error when the NFT is absent - Issue 6: purchase() — assert commissionReceiver.check() before the allowlist loop so a revoked capability fails with a clear message - Issue 9: getDuplicateListingIDs / getExistingListingIDs — replace manual index loop with firstIndex(of:); mark getExistingListingIDs view in interface and implementation; update MaliciousStorefrontV2 to conform - Issue 10: createListing — remove force-unwrap anti-pattern on allowedCommissionReceivers, build addresses array directly - Issue 11: createListing — replace self.owner?.address! with self.owner!.address - Issue 12: cleanupExpiredListings — simplify index + UInt64(1) to index + 1 - Issue 13: setCustomID — add missing doc comment - Issue 14: burnCallback / ResourceDestroyed — add missing doc comments Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
AGENTS.md is a symlink to CLAUDE.md. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
joshuahannan
changed the title
Regenerate assets.go to embed the updated NFTStorefrontV2.cdc and MaliciousStorefrontV2.cdc after the report fix commits. Update CLAUDE.md to clarify that make ci (not make test) is the required pre-commit gate. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…tional difference Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses issues identified in a security and code quality review of
NFTStorefrontV2.cdc.borrowNFT()— replaceborrow()!force-unwrap withif-letso a revoked provider capability returnsnilinstead of panicking, honoring the documented return contractListing.init— replace silentnft!force-unwrap ofborrowNFTresult with?? panic(...)for a descriptive error when the NFT ID is absent from the collectionpurchase()— assertcommissionReceiver.check()before the allowlist loop so a revoked capability fails with a clear message rather than a confusingborrow()panicgetDuplicateListingIDs— replace manual index loop withfirstIndex(of:); markgetExistingListingIDsasviewin interface, implementation, andMaliciousStorefrontV2createListing— eliminateallowedCommissionReceivers!.append()force-unwrap anti-pattern by building a local array directlycreateListing— replaceself.owner?.address!optional-chain-then-force-unwrap withself.owner!.addresscleanupExpiredListings— simplifyindex + UInt64(1)toindex + 1setCustomIDburnCallbackandResourceDestroyedTest plan
make testpasses (all 17 Cadence tests + Go tests green)make cipasses🤖 Generated with Claude Code