tck/param/topic.py (2)

23-28: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Reject malformed fixedFee.amount during parsing.

When amount is a non-numeric value (e.g., "bad"), to_int() returns None instead of raising an error. This allows invalid input to pass parameter validation and fail later during transaction construction, producing an internal error instead of a proper invalid params response at the JSON-RPC boundary.

🛡️ Proposed fix

 `@classmethod`
 def parse_json_params(cls, params: dict) -> CreateTopicFixedFeeParams:
+    amount = to_int(params.get("amount"))
+    if amount is None:
+        raise ValueError("fixedFee.amount must be an integer")
     return cls(
-        amount=to_int(params.get("amount")),
+        amount=amount,
         denominatingTokenId=non_empty_string_or_none(params.get("denominatingTokenId")),
     )

---

39-51: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Validate fixedFee structure when present.

If the caller provides {"fixedFee": "bad"} (a non-dict value), line 50's isinstance check fails and the method silently assigns None instead of raising a validation error. This masks malformed input that should be rejected at the parameter boundary.

🛡️ Proposed fix

 `@classmethod`
 def parse_json_params(cls, params: dict) -> CreateTopicCustomFeeParams:
     fixed_fee = params.get("fixedFee")
+    if fixed_fee is not None and not isinstance(fixed_fee, dict):
+        raise ValueError("fixedFee must be an object")

     fee_collector_account_id = params.get("feeCollectorAccountId")
     if isinstance(fee_collector_account_id, str):
         fee_collector_account_id = fee_collector_account_id.strip()

     return cls(
         feeCollectorAccountId=fee_collector_account_id,
         feeCollectorsExempt=to_bool(params.get("feeCollectorsExempt")),
         fixedFee=(CreateTopicFixedFeeParams.parse_json_params(fixed_fee) if isinstance(fixed_fee, dict) else None),
     )

tck/handlers/topic.py (1)

70-82: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Fail fast when the session does not resolve to a client.

get_client() at line 72 can return None, but lines 80 and 82 use client without validation. An unrecognized sessionId will surface as an internal error (likely AttributeError or SDK exception) instead of a deterministic JSON-RPC error.

🛡️ Proposed fix

 `@rpc_method`("createTopic")
 def create_topic(params: CreateTopicParams) -> CreateTopicResponse:
     client = get_client(params.sessionId)
+    if client is None:
+        raise ValueError("Unknown session ID")

     transaction = _build_create_topic_transaction(params)