Least Authority Initial Audit Suggestion 4

[ianconsolata]

Suggestion 4: Assert Deeper on Tests

Location

• power-oracle-node/backend/contract/contract_test.go
• power-oracle-node/backend/config/config_test.go
• power-oracle-node/backend/service/contract_mapping_test.go
• power-oracle-node/backend/service/developer_test.go
• power-oracle-node/backend/service/get_data_test.go
• power-oracle-node/backend/service/verify_ucan_test.go
• power-oracle-node/backend/utils/contract_test.go
• power-oracle-node/backend/utils/lotus_rpc_test.go
• power-voting-contracts/test/PowerVoting.t.sol
• power-voting-backend/db/mysql_test.go

  Synopsis

  Tests in the above files do not assert deeply on the results of method calls. Although they currently function as success path tests, strong assertions should be made on the results of the calls.

  Mitigation

  We recommend adding stronger assertions to the results from methods in the listed tests.

[Huang-Zexiang]

@ianconsolata done.

[ianconsolata]

When the issue mentions asserting more deeply, I think they meant use assert.DeepEqual (https://pkg.go.dev/gotest.tools/assert#DeepEqual) where appropriate. I don't see any DeepEqual uses here in those PRs (though you did add many more test cases, thanks!). Are there any situations where DeepQual should be used in the tests?

[mor9x00]

The assert.Equal (https://github.com/stretchr/testify) function used in these PRs can determine whether two targets have equal types and values, which aligns with the functionality of assert.DeepEqual you mentioned (https://pkg.go.dev/gotest.tools/assert#DeepEqual). Additionally, the github.com/stretchr/testify/assert library is more powerful, actively maintained, and is also the testing library used by Lotus. @ianconsolata

[ianconsolata]

Ah, I see! If you feel like the tests thoroughly cover testing deep equality then I'll trust your judgement.