Fix: detect_address unconditionally defaults bare 64-hex account hashes to Masterchain (-1:)

[rylaix]

1. Summary

The detect_address utility in toncenter/pytonlib unconditionally prepends Masterchain (-1:) when provided with a 64-character hexadecimal account hash. Because the vast majority of user wallets, smart contracts, Jettons, and NFTs reside on Basechain (0:), this assumption silently causes downstream consumers and API endpoints to query and return state from the wrong workchain without raising any validation error.

2. Target Component & Commit Hash

• Repository: https://github.com/toncenter/pytonlib
• Branch: master
• Commit: 391861fec0602f0f0ddd86312089eb28e07246f2
• Affected File & Function: pytonlib/utils/address.py, detect_address

3. Defect Description

In pytonlib/utils/address.py:

def detect_address(unknown_form):
    if is_hex(unknown_form):
        return account_forms("-1:"+unknown_form)
    elif (":" in unknown_form) and is_int(unknown_form.split(":")[0]) and is_hex(unknown_form.split(":")[1]):
        return account_forms(unknown_form)
    else:
        return read_friendly_address(unknown_form)

When a user or application passes a raw 256-bit hexadecimal hash without an explicit workchain prefix (e.g. 0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef), is_hex() returns True. The function automatically assigns it to workchain -1.

Consequently, Toncenter HTTP API endpoints importing this function (/getAddressInformation, /getWalletInformation, /getTokenData, /detectAddress) resolve -1:<hash> instead of 0:<hash>, returning balance and transaction data for the wrong on-chain entity.

4. Severity & Impact Assessment

• Severity: Low / Data Integrity & SDK Correctness.
• Impact: Downstream callers querying raw hex strings receive valid-looking checksummed friendly addresses that point to Masterchain rather than Basechain, leading to desynchronized client views and potential misrouting if explicit workchains are omitted.

5. Deterministic Proof of Concept (Python / Pytest)

from pytonlib.utils.address import detect_address

def test_bare_256_bit_hash_defaults_to_basechain():
    account_id = "0123456789abcdef" * 4
    assert len(account_id) == 64

    resolved = detect_address(account_id)

    # Expected default workchain for bare hash is Basechain (0:)
    assert resolved["raw_form"] == "0:" + account_id

Test Output on Commit 391861fe:

E   AssertionError: assert '-1:0123456789abcdef...' == '0:0123456789abcdef...'

6. Proposed Remediation (Exact Patch)

diff --git a/pytonlib/utils/address.py b/pytonlib/utils/address.py
index c3b0322..0000000 100644
--- a/pytonlib/utils/address.py
+++ b/pytonlib/utils/address.py
@@ -100,7 +100,7 @@ def read_friendly_address(address):
 
 def detect_address(unknown_form):
     if is_hex(unknown_form):
-        return account_forms("-1:"+unknown_form)
+        return account_forms("0:"+unknown_form)
     elif (":" in unknown_form) and is_int(unknown_form.split(":")[0]) and is_hex(unknown_form.split(":")[1]):
         return account_forms(unknown_form)
     else:

[rylaix]

"Closed in favor of PR #90