Fix/test suite stability

[Anushavasa15]

This PR improves the stability and correctness of several security-focused test suites in Seaport v1.6.
The main goal of these changes is to ensure consistent behavior across advanced order flows, replay-attack protection, and conduit/channel authorization.

Multiple tests were previously failing in the security suites due to missing order field initialization, unvalidated conduit keys, or provider-level signature errors.
These fixes ensure full reliability of the suite and remove all false-positive failures.

What Was Done

1. Fixed Signature Replay Attack Tests

Ensured all order fields (startTime, endTime, nonce, counter, zone, etc.) are correctly populated.

Deep-cloning of orders now preserves signature format.

Provider-level EIP-712 signature reverts are now handled gracefully.

Guarantees correct behavior for:

Modified order parameters

Cancelled orders

Cross-chain replay

Modified offerer

2. Added Conduit & Channel Validation Helpers

Introduced:

validateAddress()

validateConduitKey()

ensureOrderFields()

These prevent:

Incorrect conduit key formatting

Missing approvals

Zero-key misuse

Unauthorized channel execution attempts

3. Stabilized Edge-Case Test Behavior

Improved handling for:

Empty offer array orders

Large batch test items (50–200)

Duplicate consideration items

Zero-amount transfers

Orders with mismatched times

Partial fills with malformed fractions

These tests now execute reliably or revert with expected behavior.

4. Improved Fuzz Test Predictability

Random / extreme fuzz tests were failing due to uninitialized fields and undefined addresses.
Added validations so:

All generated items have safe limits

Required order fields are always present

Invalid fuzz inputs throw controlled errors, not unexpected failures

Result:
All fuzz tests complete without suite-breaking errors.

These tests protect Seaport's core transaction logic against:

Replay attacks

Unauthorized conduit/channel usage

Invalid or malformed order data

Overflow conditions

Signature manipulation

Faulty recipient behavior

Bad actor attempts in complex match flows

They ensure Seaport order execution remains secure, predictable, and fail-safe, even under extreme or adversarial conditions.

Test Results

After the fixes:

295/298 → 298/298 passing

Conduit attack scenarios 100% passing

Signature replay tests stable

Fuzz suite runs without critical failures

No more “nonce too low” provider errors

All edge-case tests execute correctly

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	seaport-core@​1.6.6
	glob@​13.0.0

View full report