Static read-through audit of plugins/sector-textile — the first design-partner pilot sector. Three verified findings.
1. Fibre-sum check bypasses the richer per-fibre validator
Location: src/fibre_composition.rs:20-32
Issue: fibre_sum_ok reimplements only the sum check and drops non-numeric/missing pct entries via filter_map instead of failing on them — bypassing dpp_rules::textiles::fibre::validate_fibre_composition, which enforces each fibre's pct is finite and in [0,100].
Failure scenario: [{"fibre":"cotton","pct":150.0},{"fibre":"wool","pct":-50.0}] sums to 100 and is marked Compliant despite neither percentage being physically valid. [{"fibre":"cotton"},{"fibre":"wool","pct":100.0}] (one entry missing pct entirely) is silently reduced to [100.0] and marked Compliant — an incomplete declaration passes as complete.
2. Three metric fields have zero range validation
Location: src/lib.rs:78-83
Issue: Unlike every sibling plugin (electronics, construction, furniture, aluminium, tyre all validate their equivalent field), the fibre-branch validate_input never calls optional_pct/require_pct on recycledContentPct, nor bounds-checks carbonFootprintKgCo2e or repairScore.
Failure scenario: "recycledContentPct": -9999 or 1e9 is accepted and published as a compliance metric with no range check at all.
3. Whitespace-only string satisfies the justification length gate
Location: src/unsold_goods.rs:19
Issue: justification.len() < 10 counts raw bytes without trimming, unlike Validator::require_str used elsewhere in this same crate.
Failure scenario: destination: "exempt_destruction" with destructionJustification: " " (10 spaces) yields Compliant with detail "exempt destruction with valid justification" despite no substantive justification being provided.
Static read-through audit of
plugins/sector-textile— the first design-partner pilot sector. Three verified findings.1. Fibre-sum check bypasses the richer per-fibre validator
Location:
src/fibre_composition.rs:20-32Issue:
fibre_sum_okreimplements only the sum check and drops non-numeric/missingpctentries viafilter_mapinstead of failing on them — bypassingdpp_rules::textiles::fibre::validate_fibre_composition, which enforces each fibre'spctis finite and in[0,100].Failure scenario:
[{"fibre":"cotton","pct":150.0},{"fibre":"wool","pct":-50.0}]sums to 100 and is markedCompliantdespite neither percentage being physically valid.[{"fibre":"cotton"},{"fibre":"wool","pct":100.0}](one entry missingpctentirely) is silently reduced to[100.0]and markedCompliant— an incomplete declaration passes as complete.2. Three metric fields have zero range validation
Location:
src/lib.rs:78-83Issue: Unlike every sibling plugin (electronics, construction, furniture, aluminium, tyre all validate their equivalent field), the fibre-branch
validate_inputnever callsoptional_pct/require_pctonrecycledContentPct, nor bounds-checkscarbonFootprintKgCo2eorrepairScore.Failure scenario:
"recycledContentPct": -9999or1e9is accepted and published as a compliance metric with no range check at all.3. Whitespace-only string satisfies the justification length gate
Location:
src/unsold_goods.rs:19Issue:
justification.len() < 10counts raw bytes without trimming, unlikeValidator::require_strused elsewhere in this same crate.Failure scenario:
destination: "exempt_destruction"withdestructionJustification: " "(10 spaces) yieldsCompliantwith detail "exempt destruction with valid justification" despite no substantive justification being provided.