feat: add SVG icon support (V2)

[devin-ai-integration]

feat: add SVG icon support (V2)

Summary

This PR implements SVG icon support for the IconRegistry contract (V2), addressing issue #8. The contract now supports both PNG and SVG icons with a "best icon" API that prefers SVG when available.

Contract changes:

• Added svgIcons and svgIconVersions storage mappings (reduced __gap from 50 to 48)
• Added IconFormat enum (None, PNG, SVG) for format discrimination
• Added setSvgIcon() and setSvgIconsBatch() admin functions with 32KB max size limit
• Added SVG validation via _validateSVG() - checks for <svg tag in first 1KB
• Updated mapToken, mapTokensBatch, mapChain to accept slugs with PNG OR SVG icons
• Added SVG getters: getSvgIcon, getSvgIconBySlug, getSvgIconByToken, getSvgChainIcon, etc.
• Added best-icon helpers: getBestIcon, getBestIconDataURI, getBestIconByToken, getBestChainIcon
• Added getAvailableFormats() to check PNG/SVG availability for a slug

Off-chain tooling:

• Added sync-web3icons.ts script to fetch SVGs from web3icons CDN

Tests:

• Added 26 new tests covering SVG validation, versioning, getters, mappings, and best-icon selection

Review & Testing Checklist for Human

• Storage layout upgrade safety: Verify that adding 2 new mappings (svgIcons, svgIconVersions) and reducing __gap from 50 to 48 maintains correct storage layout for UUPS upgrade from current mainnet deployment
• Breaking error type change: mapToken, mapTokensBatch, mapChain now throw NoIconAvailable instead of IconNotFound - confirm no existing integrations depend on catching the old error
• SVG validation security: The _containsSvgTag function only searches the first 1KB for <svg tag - verify this is sufficient or if malicious SVGs could bypass this check
• Sanitization gap: The sync-web3icons.ts script uses basic regex sanitization, not SVGO as documented in README - decide if this is acceptable or needs SVGO integration before use

Recommended test plan:

1. Run forge test to verify all 61 tests pass
2. Deploy to a local anvil fork and test upgrade from current mainnet implementation
3. Test SVG upload and retrieval manually with a sample SVG

Notes

Closes #8

Link to Devin run: https://app.devin.ai/sessions/2e14a5bf03404cd487480690545ac356
Requested by: @igor53627

[devin-ai-integration]

Original prompt from Player 53627

can you analyze current stage of the project, make a mini audit


You only need to look in the following repo: igor53627/iconregistry.eth

[changeset-bot]

⚠️ No Changeset found

Latest commit: d2448c3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

📚 Contract Documentation Generated

Contract documentation has been generated from NatSpec comments.

Artifacts available: Download from the Actions artifacts tab

Contracts documented:

• IconRegistry.sol
• IIconRegistry.sol

Generated by forge doc and NatSpec extraction

[devin-ai-integration]

Closing due to inactivity for more than 30 days. Configure here.