Add support for inline extension nodes in TrieProof

[ernestognw]

Fixes #????

PR Checklist

• Tests
• Documentation
• Changeset entry (run npx changeset add)

[openzeppelin-security-agent]

The latest updates on your security scan. Learn more about OpenZeppelin Platform.

Project	Scan	Issues	Details	Updated
Openzeppelin Contracts	🟡 Queued	—	View	Feb 12, 2026, 10:20 PM (UTC)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 285c922

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Walkthrough

This pull request refactors the core trie traversal logic in the TrieProof contract by converting the branching conditional flow into a perpetual for-loop structure. The rewrite enables iterative descent through trie nodes with early exits. Key changes include replacing per-iteration RLP processing branches with a single loop that repeatedly decodes the current node, handling branch nodes via Memory.Slice child slices and _getNodeId calls, and updating leaf/extension node logic with explicit path remainder validation. Error handling is refined with updated error messages (UNPARSEABLE_NODE replacing UNKNOWN_NODE_PREFIX, and new conditions for INVALID_PATH_REMAINDER and EMPTY_EXTENSION_PATH_REMAINDER). A new private helper function _isExtensionChild is introduced to support traversal decisions. The final leaf validation is preserved through existing _validateLastItem logic.

Possibly related PRs

• Add TrieProof library #5826: Introduces the TrieProof library implementation that this PR modifies through core trie traversal refactoring and helper function additions.

🚥 Pre-merge checks | ✅ 2 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Merge Conflict Detection	⚠️ Warning	❌ Merge conflicts detected (27 files): ⚔️ CHANGELOG.md (content) ⚔️ contracts/account/utils/draft-ERC7579Utils.sol (content) ⚔️ contracts/crosschain/ERC7786Recipient.sol (content) ⚔️ contracts/metatx/ERC2771Forwarder.sol (content) ⚔️ contracts/token/ERC1155/ERC1155.sol (content) ⚔️ contracts/token/ERC20/extensions/ERC4626.sol (content) ⚔️ contracts/utils/Arrays.sol (content) ⚔️ contracts/utils/Bytes.sol (content) ⚔️ contracts/utils/LowLevelCall.sol (content) ⚔️ contracts/utils/Memory.sol (content) ⚔️ contracts/utils/RLP.sol (content) ⚔️ contracts/utils/RelayedCall.sol (content) ⚔️ contracts/utils/Strings.sol (content) ⚔️ contracts/utils/cryptography/TrieProof.sol (content) ⚔️ contracts/utils/cryptography/WebAuthn.sol (content) ⚔️ contracts/utils/draft-InteroperableAddress.sol (content) ⚔️ contracts/utils/introspection/ERC165Checker.sol (content) ⚔️ contracts/utils/structs/Accumulators.sol (content) ⚔️ docs/modules/ROOT/pages/utilities.adoc (content) ⚔️ package-lock.json (content) ⚔️ package.json (content) ⚔️ scripts/generate/templates/Arrays.js (content) ⚔️ test/utils/Memory.t.sol (content) ⚔️ test/utils/Memory.test.js (content) ⚔️ test/utils/Strings.test.js (content) ⚔️ test/utils/cryptography/TrieProof.test.js (content) ⚔️ test/utils/draft-InteroperableAddress.test.js (content) These conflicts must be resolved before merging into master.	Resolve conflicts locally and push changes to this branch.
Description check	❓ Inconclusive	The description is a standard contribution template with no substantive content about the changes; it lacks meaningful information about the implementation beyond unchecked checklist items.	Provide a detailed description of the changes, including what inline extension nodes support enables and why this change was necessary for TrieProof.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding support for inline extension nodes in TrieProof, which aligns with the core functionality rewrite described in the summary.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

⚔️ Resolve merge conflicts (beta)

• Auto-commit resolved conflicts to branch trieproof/inline-extension-nodes
• Post resolved changes as copyable diffs in a comment

Tip

Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@contracts/utils/cryptography/TrieProof.sol`:
- Around line 145-148: The code calls _isExtensionChild(childSlice, proof[i +
1], proofLength, i) and accesses proof[i+1] without ensuring i+1 < proofLength,
which can revert for the final index; add an explicit bounds guard (e.g. if (i +
1 >= proofLength) break;) before any proof[i + 1] indexing or change
_isExtensionChild to accept an optional/conditional next-slice (move the proof
indexing into _isExtensionChild and first check i + 1 < proofLength there).
Apply the same fix to the other occurrence around the encoded/childSlice
handling (the block that currently uses proof[i + 1] at ~180-183) so both call
sites never index out of bounds.

[ernestognw]

The previous implementation using childNode.readList() directly didn't account for RLP encoding semantics. When child nodes are embedded inline in their parent (rather than referenced by hash), they're stored as RLP-encoded strings within the parent's RLP list structure. For example, an inline leaf might be encoded as 0x89c882203484deadbeef, where 0x89 is the RLP string wrapper and 0xc8... is the actual list content.

Calling readList() directly on this data fails because it expects list-prefixed data (>= 0xC0), not string-prefixed data. This caused RLPInvalidEncoding reverts instead of proper error handling through TrieProofTraversalError. I made RLP.decodeLength() internal to enable memory-efficient inline node processing in TrieProof.

I'm using decodeLength() to unwrap the RLP string encoding without memory allocation, fetching a Memory.Slice pointing to the actual content and then safely using readList.

[Amxx]

I pushed ernestognw@ab19efc that github is not seeing :/