Skip to content

bug: wallet address not checksum-validated before provider calls #429

Description

@nanaf6203-bit

Summary

fetchWalletBalance in src/utils/walletHelpers.ts accepts an address with no checksum or EIP-55 validation.

Affected area

src/utils/walletHelpers.ts and consumers: useWalletConnector, src/components/WalletConnectedView.tsx

Steps to reproduce / impact

Sending an invalid or mixed-case address may produce balance lookups against wrong accounts. Worse, in some chains EIP-55 checksum mismatch can indicate a typo-targeted phishing attempt.

Expected behaviour

Before reusing the address for any provider call, validate with viem getAddress or ethers utils.getAddress, which normalises and validates the checksum.

Acceptance criteria

  • Introduce a helper assertValidAddress(addr: string): string in walletHelpers.ts.
  • Throw on invalid input — convert caller error messages to user-safe copy.
  • Add unit tests using well-known checksums and adversarial examples.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave programbugSomething isn't working correctlypriority/p1P1 — high priority, fix soonsecuritySecurity issue or hardening opportunity

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions