Fix isHash accepting odd-length hex strings

[Wagalidoom]

isHash returns true for hex strings of 65 characters, one short of a valid
32-byte hash. The most common way to produce one is truncating a real hash by a
single character, so the false positive lands exactly where validation matters.

isHash('0x' + 'a'.repeat(63)) // true — expected false

Cause

isHash is isHex(hash) && size(hash) === 32. isHex in strict mode accepts an
odd number of nibbles, and size rounds up: Math.ceil(63 / 2) === 32. So 63
nibbles report as 32 bytes and pass the check.

Impact

Validation passes client-side and the value fails later, further down the stack.
A node rejects it with -32602 invalid params, so the error surfaces from inside
a query or a receipt wait rather than at the input boundary. For comparison,
ethers rejects the same string: isHexString(value, 32) returns false and
getBytes throws.

Note
The same pattern (size(value) === N used as a validator on untrusted input) appears at several other call sites.

[changeset-bot]

🦋 Changeset detected

Latest commit: 5c5a192

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
viem	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

@Wagalidoom is attempting to deploy a commit to the Wevm Team on Vercel.

A member of the Team first needs to authorize it.