harden: validate slab magic in parseEngine and parseConfig

[0x-SquidSol]

Summary

• parseEngine and parseConfig can be called directly without going through parseHeader (which validates the PERCOLAT magic bytes)
• adl.ts calls both functions directly — isAdlTriggered, rankAdlPositions
• Without magic validation, a malicious RPC returning arbitrary bytes of a known slab size would be silently parsed, producing garbage vault balances, PnL, oracle addresses, and config values
• Fix: Added PERCOLAT magic byte check (readU64LE(data, 0) !== MAGIC) at the top of both functions
• Cheap (one u64 read), zero false positives — valid slab data always starts with PERCOLAT magic

Test plan

• No new test failures (729 passed, same 16 pre-existing)
• Verify non-slab data of matching size throws with "invalid slab magic"

🤖 Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@0x-SquidSol has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 6 minutes and 25 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 6 minutes and 25 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5ebbc06a-b949-45b3-b193-a3dd2ce1b829

📥 Commits

Reviewing files that changed from the base of the PR and between 2f80d79 and 1511ad7.

📒 Files selected for processing (1)

• src/solana/slab.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}