Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
| import { type INodeDetails, TORUS_NETWORK_TYPE } from "@toruslabs/constants"; | ||
| import { NodeDetailManager } from "@toruslabs/fetch-node-details"; | ||
| import { utf8ToBytes } from "@toruslabs/metadata-helpers"; | ||
| import { keccak256, utf8ToBytes } from "@toruslabs/metadata-helpers"; |
There was a problem hiding this comment.
Possible keccak256 return format mismatch after import change
High Severity
keccak256 is now imported from @toruslabs/metadata-helpers instead of @toruslabs/torus.js. Both call sites use .slice(2) on the result, a pattern that assumes a 0x-prefixed hex string. The metadata-helpers v8.2.0 swapped its crypto backend from ethereum-cryptography to @noble/hashes + @scure/base, which could change the return format. If the new keccak256 returns a Uint8Array (as @noble/hashes natively does) or a hex string without 0x prefix, .slice(2) would silently produce an incorrect value — either a truncated byte array or a hash missing its first two hex characters — breaking both the aggregateIdToken computation and the getSessionId helper.
Additional Locations (1)
1 participant
Motivation and Context
Jira Link:
Description
@toruslabs/metadata-helpersfrom^8.1.0to^8.2.0How has this been tested?
Screenshots (if appropriate):
Types of changes
Checklist:
Note
Medium Risk
Medium risk because it upgrades a crypto-related dependency and changes the
keccak256implementation source used for login/session ID hashing, which could affect key/session derivation if outputs differ.Overview
Updates
@toruslabs/metadata-helpersfrom8.1.0to8.2.0and refreshespackage-lock.json, pulling in new transitive deps (notably@noble/hashesand@scure/base) and adjusting the resolved metadata helper tree.Refactors
src/login.tsto importkeccak256from@toruslabs/metadata-helpersinstead of@toruslabs/torus.js, keeping the existing hashing behavior used for grouped verifier token aggregation andSessionManagersession ID generation.Written by Cursor Bugbot for commit 4fd402a. This will update automatically on new commits. Configure here.