T09 · Insecure Skill Coding Practices
Error
- Location
scripts/batch-test.js:43- Finding
Batch Test Signs and Broadcasts Real Blockchain Transactions Contrary to Documentation
- Content
View full analysis
{ const tx = { to: cfg.contract.address, data: calldata, value: 0n, chainId: cfg.chainId, type: 2, maxFeePerGas: ethers.parseUnits(cfg.gas.maxFeePerGas, "gwei"), maxPriorityFeePerGas: ethers.parseUnits(cfg.gas.maxPriorityFeePerGas, "gwei"), gasLimit: cfg.gas.gasLimit, nonce: nonces[i], }; return s.signTransaction(tx); })); const signMs = Number(process.hrtime.bigint() - signStart) / 1e6; log("⚡ All " + signed.length + " txs signed in " + signMs.toFixed(0) + "ms"); // Batched broadcast const fireStart = process.hrtime.bigint(); log("🔥 FIRING in batches of " + BATCH_SIZE + "..."); let success = 0, fail = 0; const rpcUrls = cfg.rpcUrls || [cfg.rpcUrl]; for (let b = 0; b < signed.length; b += BATCH_SIZE) { const batchNum = Math.floor(b / BATCH_SIZE) + 1; const totalBatches = Math.ceil(signed.length / BATCH_SIZE); const batch = signed.slice(b, b + BATCH_SIZE); const labels = cfg.wallets.slice(b, b + BATCH_SIZE).map(w => w.label); const results = await Promise.allSettled(batch.map((raw, i) => { // Send to first RPC only to avoid rate limits return fetch(rpcUrls[0], { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "eth_sendRawTransaction", params: [raw] }), }).then(r => r.json()).then(j => { ...[truncated 2292 chars]- Remediation
View remediation