Add logging

[llbartekll]

• add debug logging
• fix structured message signing

[claude]

Claude finished @llbartekll's task in 1m 32s —— View job

---

PR Review Complete

Tasks

• Read and analyze Rust changes in pay/mod.rs
• Read and analyze Rust changes in uniffi_compat/evm_signing/mod.rs
• Analyze Swift bindings changes
• Run automated security checks
• Compile and report findings

---

Review Summary

Analyzed PR adding debug logging and fixing structured message signing. Found 2 issues requiring attention.

---

Issue 1: Debug logging uses stdout instead of proper logging framework

ID: pay-stdout-logging-8a3c
File: crates/yttrium/src/pay/mod.rs:500
Severity: MEDIUM
Category: code_quality

Debug logging implementation uses println! directly to stdout instead of the existing tracing crate already used elsewhere in the codebase (line 197-201). This creates inconsistent logging behavior and makes it harder to manage log output in production environments.

Recommendation: Use the tracing framework for consistency:

fn log(&self, message: &str) {
    if self.debug_enabled.load(Ordering::Relaxed) {
        tracing::debug!("[WalletConnectPay] {}", message);
    }
}

fn log_error(&self, context: &str, error: &impl std::fmt::Debug) {
    if self.debug_enabled.load(Ordering::Relaxed) {
        tracing::error!("[WalletConnectPay] {}: {:?}", context, error);
    }
}

---

Issue 2: Missing input validation for hex string parsing

ID: evm-signing-parse-validation-c2f1
File: crates/yttrium/src/uniffi_compat/evm_signing/mod.rs:21
Severity: LOW
Category: code_quality

The parse_hex_or_decimal function accepts hex strings with case-insensitive prefixes (0x or 0X) but doesn't validate the actual hex digits, which could lead to confusing error handling when invalid hex characters are present.

Recommendation: Add explicit validation for hex characters:

fn parse_hex_or_decimal(s: &str) -> Option<u64> {
    let s = s.trim();
    if s.starts_with("0x") || s.starts_with("0X") {
        let hex_part = &s[2..];
        // Validate hex characters explicitly
        if hex_part.chars().all(|c| c.is_ascii_hexdigit()) {
            u64::from_str_radix(hex_part, 16).ok()
        } else {
            None
        }
    } else {
        s.parse::<u64>().ok()
    }
}

---

Automated Checks

External Domain URLs

All detected URLs are from UniFFI code generation comments (github.com/mozilla/uniffi-rs) which is expected and acceptable.

---

Additional Notes

Cannot verify: Linting/compilation/tests cannot be run in review-only mode. Recommend running:

• cargo clippy --all-targets --all-features -- -D warnings
• cargo +nightly fmt --check
• cargo test

Swift changes: The yttrium.swift file contains auto-generated UniFFI bindings (2283 additions) reflecting the Rust API changes - no manual review needed for generated code.

[github-actions]

🤖 Auto Review Issue: Debug logging uses stdout instead of proper logging framework

Severity: MEDIUM
Category: code_quality
Tool: Claude Auto Review

Recommendation: Use the tracing framework for consistency:

fn log(&self, message: &str) {
    if self.debug_enabled.load(Ordering::Relaxed) {
        tracing::debug!("[WalletConnectPay] {}", message);
    }
}

fn log_error(&self, context: &str, error: &impl std::fmt::Debug) {
    if self.debug_enabled.load(Ordering::Relaxed) {
        tracing::error!("[WalletConnectPay] {}: {:?}", context, error);
    }
}

[github-actions]

🤖 Auto Review Issue: Missing input validation for hex string parsing

Severity: LOW
Category: code_quality
Tool: Claude Auto Review

Recommendation: Add explicit validation for hex characters:

fn parse_hex_or_decimal(s: &str) -> Option<u64> {
    let s = s.trim();
    if s.starts_with("0x") || s.starts_with("0X") {
        let hex_part = &s[2..];
        // Validate hex characters explicitly
        if hex_part.chars().all(|c| c.is_ascii_hexdigit()) {
            u64::from_str_radix(hex_part, 16).ok()
        } else {
            None
        }
    } else {
        s.parse::<u64>().ok()
    }
}

[jakubuid]

We already have a global logger, we don't need that boolean

Check registerLogger method, use it in Swift, it will log all messages from Yttrium

[llbartekll]

@cloude review