Summary
networkToChainId currently uses loose numeric parsing for CAIP-style and plain numeric network strings. Because of that, invalid network IDs such as eip155:1abc, eip155:1.5, or 1abc can be parsed as chain ID 1 instead of being rejected.
Why this matters
Nexus uses the parsed chain ID for payment network handling. If a malformed network identifier is partially accepted, a bad request can be routed as a valid chain instead of failing fast with a clear invalid-network error.
Reproduction
networkToChainId("eip155:1abc") // currently returns 1
networkToChainId("1abc") // currently returns 1
networkToChainId("eip155:1.5") // currently returns 1Expected behavior
Only fully numeric positive safe integer chain IDs should be accepted for eip155:<chainId> and plain numeric network IDs. Partially numeric strings should throw Invalid network: ....
Proposed fix
Use strict chain ID parsing before falling back to named networks, and add unit coverage for malformed numeric inputs.
Summary
networkToChainIdcurrently uses loose numeric parsing for CAIP-style and plain numeric network strings. Because of that, invalid network IDs such aseip155:1abc,eip155:1.5, or1abccan be parsed as chain ID1instead of being rejected.Why this matters
Nexus uses the parsed chain ID for payment network handling. If a malformed network identifier is partially accepted, a bad request can be routed as a valid chain instead of failing fast with a clear invalid-network error.
Reproduction
Expected behavior
Only fully numeric positive safe integer chain IDs should be accepted for
eip155:<chainId>and plain numeric network IDs. Partially numeric strings should throwInvalid network: ....Proposed fix
Use strict chain ID parsing before falling back to named networks, and add unit coverage for malformed numeric inputs.