From 5ec5d4759196d83b0a233a0d64a2c74241e08270 Mon Sep 17 00:00:00 2001
From: Filipp Makarov <fmc@Filipps-MacBook-Pro.local>
Date: Tue, 21 Oct 2025 11:34:49 +0300
Subject: [PATCH] fix add length check

---
 contracts/ComposableExecutionLib.sol | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/contracts/ComposableExecutionLib.sol b/contracts/ComposableExecutionLib.sol
index fad226c..ed13823 100644
--- a/contracts/ComposableExecutionLib.sol
+++ b/contracts/ComposableExecutionLib.sol
@@ -96,11 +96,16 @@ library ComposableExecutionLib {
             address tokenAddr;
             address account;
             bytes calldata paramData = param.paramData;
+
             // expect paramData to be abi.encodePacked(address token, address account)
+            // Validate exact length requirement
+            require(paramData.length == 40, 
+                     InvalidParameterEncoding("Invalid paramData length"));
             assembly {
                 tokenAddr := shr(96, calldataload(paramData.offset))
                 account := shr(96, calldataload(add(paramData.offset, 0x14)))
             }
+
             uint256 balance;
             if (tokenAddr == address(0)) {
                 balance = account.balance;