fix: normalize operator addresses before uniqueness check

[aly-obol]

Summary

• Fixes case-sensitive operator uniqueness bypass in validateUniqueAddresses (src/ajv.ts) by lowercasing addresses before Set comparison.
• Without this, the same Ethereum address with different casing (e.g. 0xAbCd... vs 0xabcd...) could pass client-side validation as two distinct operators.

Context

Reported via bug bounty (OBL-01). The server-side API already normalizes via getAddress() and the updateClusterDef flow blocks duplicate operators from completing DKG, so this was not exploitable end-to-end. Applied as defense-in-depth.

Test plan

• Verify existing tests pass (yarn test)
• Confirm that operators with same address but different casing are now rejected by validatePayload with definitionSchema

Summary by CodeRabbit

• Bug Fixes
  • Address validation now correctly identifies duplicate addresses regardless of capitalization.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5f30010b-4665-46e6-8aa0-4ff7b8b01db5

📥 Commits

Reviewing files that changed from the base of the PR and between b802a5a and 5e5df93.

📒 Files selected for processing (1)

• src/ajv.ts

---

📝 Walkthrough

Walkthrough

The PR modifies address uniqueness validation in the Ajv keyword validator. A single line change makes address uniqueness checks case-insensitive by lowercasing each address before computing the uniqueness set, preventing addresses that differ only in casing from being treated as distinct.

Changes

Address Validation

Layer / File(s)	Summary
Case-insensitive address uniqueness src/ajv.ts	validateUniqueAddresses lowercases each operator address before building the uniqueness set, changing validation from case-sensitive to case-insensitive address comparison.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested reviewers

• HananINouman

Poem

🐰 A case-insensitive hop,
Addresses unified, no more flop!
Lowercase the way, duplicates stay,
Validation flows true, hip-hop-hooray! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: normalizing operator addresses before the uniqueness check in validateUniqueAddresses to treat case-variant addresses as identical.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/case-insensitive-operator-uniqueness

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
1 Accepted issue

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube Cloud