[marcus-pousette-hp]

Co-authored with AI

[greptile-apps]

Confidence Score: 4/5

[Low impact] The change affects only proof upgrades with an empty range.

The PR appears safe to merge, with a non-blocking rejection gap for nonempty receivers.

Findings

1.  Zero-length proofs still pass ▶

Fix with agent prompt

### Issue 1
lib/merkle-tree.js:1070
`applyProof` can still accept a zero-length upgrade when the receiver already has data. With a receiver at length 1, the exact proof in the new test reaches `MerkleTree.refit` first. Refit removes the empty upgrade, so verification skips this check and returns `true`. Check the original upgrade length before refitting, and add a test with a nonempty receiver.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds a zero-length check in verifyUpgrade.

• Proof checks reject upgrades that cover zero blocks.

_{Reviews (1) · Last reviewed commit: "Reject upgrades of length 0" · Reviewed by Greptile}

[greptile-apps]

Zero-length proofs still pass

applyProof can still accept a zero-length upgrade when the receiver already has data. With a receiver at length 1, the exact proof in the new test reaches MerkleTree.refit first. Refit removes the empty upgrade, so verification skips this check and returns true. Check the original upgrade length before refitting, and add a test with a nonempty receiver.

Knowledge Base Used:

• Data integrity and Merkle verification
• Merkle tree operations

Prompt To Fix With AI

This is a comment left during a code review.
Path: lib/merkle-tree.js
Line: 1070

Comment:
**Zero-length proofs still pass**

`applyProof` can still accept a zero-length upgrade when the receiver already has data. With a receiver at length 1, the exact proof in the new test reaches `MerkleTree.refit` first. Refit removes the empty upgrade, so verification skips this check and returns `true`. Check the original upgrade length before refitting, and add a test with a nonempty receiver.

**Knowledge Base Used:**
- [Data integrity and Merkle verification](https://app.greptile.com/-/switch-tenant?tenant=tetherio&next=%2Fcustom-context%2Fknowledge-base%2Fholepunchto%2Fhypercore%2F-%2Fdocs%2Fdata-integrity.md)
- [Merkle tree operations](https://app.greptile.com/-/switch-tenant?tenant=tetherio&next=%2Fcustom-context%2Fknowledge-base%2Fholepunchto%2Fhypercore%2F-%2Fdocs%2Fmerkle-tree-operations.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.