fix: guard against undefined RPC provider in Safe signature validation

[aly-obol]

Summary

• validateSmartContractSignature now rejects the "undefined" string (produced by PROVIDER_MAP template literals when RPC env vars are unset) before passing it to Safe.init(), matching the existing guard in getProvider().
• Hardens against a configuration-dependent DoS where valid Safe-signed cluster locks are rejected because the fallback RPC URL is the literal string "undefined".

Context

Reported via bug bounty (OBL-08, Low severity). When RPC_MAINNET / RPC_HOODI etc. are not set, PROVIDER_MAP[chainId] evaluates to the string "undefined" rather than undefined. getProvider() already checks for this; validateSmartContractSignature did not.

Test plan

• npm run build passes
• npm test passes
• Manual: unset RPC_MAINNET, call validateSmartContractSignature with chainId=1 and no safeRpcUrl — should throw "No RPC provider configured for chain 1" instead of passing "undefined" to Safe SDK

[coderabbitai]

Warning

Review limit reached

@aly-obol, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 4 minutes and 59 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 59120f97-2adf-4e65-a76f-aa73e6acae94

📥 Commits

Reviewing files that changed from the base of the PR and between b802a5a and 364e498.

📒 Files selected for processing (1)

• src/verification/signature-validator.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/safe-provider-undefined-guard

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud