fix: sanitize erc20 token metadata

[CarsonRoscoe]

Description

Fixes indirect prompt injection via malicious ERC20 token metadata. Anyone can deploy an ERC20 contract with an arbitrary name()/symbol() string, and that string was being passed straight through into text returned to the agent; a malicious token could embed prompt-injection payloads (e.g. zero-width characters, bidi overrides, control characters) that get interpreted as part of the agent's context.

The fix adds a shared sanitizeOnchainMetadata / sanitize_onchain_metadata helper that strips unsafe Unicode categories (control, format/zero-width/ bidi-override, private-use, surrogate) and truncates to 50 characters. On a match, the value is sanitized and truncated silently rather than rejecting the call; this is metadata display, not something that should fail an otherwise-valid transaction.

Length-capping alone was considered and rejected: short injection payloads still fit under a length cap, and it doesn't address the underlying issue of untrusted bytes being treated as trusted context.

Applied at every call site where onchain name/symbol data flows into agent-facing text:

• erc20 (TS + Python) — arbitrary token address
• cdp/swapUtils.ts, zeroX/utils.ts — arbitrary swap token addresses
• flaunch (buy/sell) — arbitrary permissionless-launched coin address
• compound/utils.ts, compound/utils.py, aave/utils.py — allowlisted asset addresses, fixed for defense-in-depth

Tests

Added Typescript and Python unit tests

Checklist

A couple of things to include in your PR for completeness:

• Added documentation to all relevant README.md files
• Added a changelog entry

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 1/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[cb-heimdall]

Review Error for phdargen @ 2026-09-03 16:00:47 UTC
User failed mfa authentication, see go/mfa-help