test: mutation-harden LibFixedPointDecimalParse coverage

audit/mutation-test-scans.json

@@ -0,0 +1,19 @@
+[
+  {
+    "timestamp": "2026-06-15T00:00:00Z",
+    "commit": "dc85846152e2fd42f8f2c07feb72cc1abc708674",
+    "publishedTag": "v0.2.0",
+    "commitsAheadOfTag": 0,
+    "scope": "LibFixedPointDecimalParse.decimalStringTofixedPoint",
+    "tool": "adversarial-mutation-test",
+    "skillVersion": "0.24.0",
+    "summary": {
+      "behaviours": 15,
+      "survivingMutantsVsExisting": 2,
+      "gapsFilled": 2,
+      "equivalentMutants": 2,
+      "newTests": 2,
+      "filed": []
+    }
+  }
+]

src/lib/parse/LibFixedPointDecimalParse.sol

@@ -13,7 +13,9 @@ library LibFixedPointDecimalParse {
     /// Converts a decimal string to a fixed point decimal. Returns error
     /// selector if the string is not a valid fixed point decimal string. Fails
     /// on overflow and precision loss, as well as invalid characters in any
-    /// position. DOES NOT support scientific notation.
+    /// position. A decimal point MUST be followed by at least one digit; an
+    /// empty fraction such as "1." is invalid. DOES NOT support scientific
+    /// notation.
     /// Caller MUST check the error selector is 0 before using the value.
     /// @param str The string to convert.
     /// @return errorSelector 0 if successful, otherwise the error selector.
@@ -49,6 +51,12 @@ library LibFixedPointDecimalParse {
                 uint256 fracStart = cursor;
                 cursor = LibParseChar.skipMask(cursor, end, CMASK_NUMERIC_0_9);
 
+                // The decimal point MUST be followed by at least one digit.
+                // An empty fraction is malformed.
+                if (cursor == fracStart) {
+                    return (ParseDecimalInvalidString.selector, 0);
+                }
+
                 // Ensure there's no unprocessed garbage.
                 if (cursor < end) {
                     return (ParseDecimalInvalidString.selector, 0);

test/src/lib/parse/LibFixedPointDecimalParse.decimalStringToFixedPoint.t.sol

@@ -112,4 +112,88 @@ contract LibFixedPointDecimalParseTest is Test {
             ParseDecimalOverflow.selector
         );
     }
+
+    /// Failure because the FRACTIONAL part itself overflows a `uint256` while
+    /// being parsed by `unsafeDecimalStringToInt`, before the digit-count
+    /// precision-loss check is reached. A frac of 78 nines cannot fit in a
+    /// `uint256` so the inner integer parse returns `ParseDecimalOverflow`, and
+    /// that selector is propagated unchanged from the fractional-parse error
+    /// branch.
+    function testDecimalStringToFixedPointFailureFractionalPartOverflow() external pure {
+        // 78 nines after the point. 1e78 > type(uint256).max so the inner
+        // unsafeDecimalStringToInt overflows.
+        checkDecimalStringToFixedPointFailure(
+            "0.999999999999999999999999999999999999999999999999999999999999999999999999999999",
+            ParseDecimalOverflow.selector
+        );
+        // 79 digits, leading non-zero, also overflows the inner integer parse.
+        checkDecimalStringToFixedPointFailure(
+            "0.9000000000000000000000000000000000000000000000000000000000000000000000000000009",
+            ParseDecimalOverflow.selector
+        );
+    }
+
+    /// A character immediately after the integer part that is NOT a decimal
+    /// point must be rejected as an invalid string by the decimal-point gate.
+    /// Critically, `"1x"` has no further input after the bad character, so if
+    /// the decimal-point gate is bypassed the parse wrongly SUCCEEDS as `1e18`
+    /// rather than erroring; this is what distinguishes the decimal-point gate
+    /// from the downstream trailing-garbage gate (which the pre-existing corrupt
+    /// integer tests already reach via inputs whose garbage is caught later).
+    function testDecimalStringToFixedPointInvalidAfterInteger() external pure {
+        // Non-point character directly after the integer, with nothing after it,
+        // so the decimal-point gate is the only thing that can reject it.
+        checkDecimalStringToFixedPointFailure("1x", ParseDecimalInvalidString.selector);
+        checkDecimalStringToFixedPointFailure("10x", ParseDecimalInvalidString.selector);
+        // A bare trailing decimal point with no fractional digits is a
+        // malformed empty fraction and is rejected.
+        checkDecimalStringToFixedPointFailure("1.", ParseDecimalInvalidString.selector);
+    }
+
+    /// An empty fraction is invalid. The decimal point MUST be followed by at
+    /// least one digit, so every integer prefix with a bare trailing point is
+    /// rejected as an invalid string.
+    function testDecimalStringToFixedPointEmptyFraction() external pure {
+        checkDecimalStringToFixedPointFailure("0.", ParseDecimalInvalidString.selector);
+        checkDecimalStringToFixedPointFailure("1.", ParseDecimalInvalidString.selector);
+        checkDecimalStringToFixedPointFailure("123.", ParseDecimalInvalidString.selector);
+        checkDecimalStringToFixedPointFailure("00.", ParseDecimalInvalidString.selector);
+        checkDecimalStringToFixedPointFailure(
+            "115792089237316195423570985008687907853269984665640564039457.", ParseDecimalInvalidString.selector
+        );
+        // Scientific notation is unsupported, so nothing following the bare
+        // point can make the empty fraction parseable.
+        checkDecimalStringToFixedPointFailure("1.e5", ParseDecimalInvalidString.selector);
+        // A lone point also has an empty integer part, which is rejected
+        // before the fraction is considered.
+        checkDecimalStringToFixedPointFailure(".", ParseEmptyDecimalString.selector);
+        // A point-led fraction has an empty integer part, which is rejected
+        // before the fraction is considered.
+        checkDecimalStringToFixedPointFailure(".5", ParseEmptyDecimalString.selector);
+    }
+
+    /// Any integer with a bare trailing decimal point appended is an invalid
+    /// string. The integer is bounded so it cannot overflow the fixed point
+    /// representation, leaving the empty fraction as the only rejection.
+    function testDecimalStringToFixedPointEmptyFractionFuzz(uint256 value) external pure {
+        value = bound(value, 0, type(uint256).max / 1e18);
+        checkDecimalStringToFixedPointFailure(
+            string.concat(vm.toString(value), "."), ParseDecimalInvalidString.selector
+        );
+    }
+
+    /// The valid forms adjacent to the rejected empty fractions parse to the
+    /// values given by decimal semantics: the same digits with an explicit
+    /// fractional digit, and the bare integer without the point.
+    function testDecimalStringToFixedPointEmptyFractionAdjacentValid() external pure {
+        checkDecimalStringToFixedPoint("0", 0);
+        checkDecimalStringToFixedPoint("0.0", 0);
+        checkDecimalStringToFixedPoint("1", 1e18);
+        checkDecimalStringToFixedPoint("1.0", 1e18);
+        checkDecimalStringToFixedPoint("123", 123e18);
+        checkDecimalStringToFixedPoint("123.0", 123e18);
+        checkDecimalStringToFixedPoint(
+            "115792089237316195423570985008687907853269984665640564039457.584007913129639935", type(uint256).max
+        );
+    }
 }