tlock: reject invalid characters in fromHex

[karagozemin]

Summary

Make fromHex in packages/tlock/src/commitment.ts reject malformed hexadecimal input instead of silently converting invalid byte pairs to zero.

Why this matters

parseInt("zz", 16) returns NaN, and assigning that value to a Uint8Array produces 0. Today an invalid value such as "zz" can therefore be accepted as a different byte sequence, which is risky in commitment and nonce tooling.

Scope

• Validate the full input after removing an optional 0x prefix.
• Preserve support for uppercase and lowercase hex.
• Keep the existing odd-length rejection.
• Add focused tests in packages/tlock/src/commitment.test.ts.
• Do not change seal or commitment encoding.

Acceptance criteria

• Invalid characters are rejected with a clear error.
• Odd-length input is rejected.
• Valid uppercase, lowercase, and 0x-prefixed values decode correctly.
• Empty-input behavior is explicitly tested and documented by the test name.
• pnpm --filter @sub-rosa/tlock test and typecheck pass.

[rexx010]

Hi, I’m interested in working on this issue. I’ve worked on validation and security-sensitive encoding logic before, so I’d update fromHex to validate the complete input after removing an optional 0x prefix, while preserving odd-length rejection and case-insensitive valid hex support. I’d also add focused tests covering invalid characters, odd-length input, uppercase/lowercase and prefixed values, and explicitly document the empty-input behavior through the test name.

[emrekayat]

Can I have this issue pls

[grantfox-oss]

🦊 GrantFox — @emrekayat has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #175)
2. Your PR will be reviewed by the Sub-Rosa-Issue maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!

@emrekayat's PR #179 was approved and merged by @karagozemin.

🏆 @emrekayat: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (153 total points). Track your full progress on GrantFox.

👏 Great work, @emrekayat! Keep contributing to Sub-Rosa-Issue.