Repository navigation
fix: validate trading pairs on order submission and DEX offer assets - #156
Merged
akargi merged 6 commits intoNov 4, 2026
Merged
Conversation
POST /orders accepted any pair string, so orders for markets that do not exist were created and rested on the book with no possible counterparty. Validate the pair against the supported registry and return 400 with the valid alternatives, and require finite price and quantity values so NaN can no longer reach the matching engine. Closes Chulilee#59
buildDexOfferTx only checked that base and counter were not both native XLM. Malformed asset codes or issuer keys reached the SDK and surfaced as opaque submission failures. Validate the code shape (1-12 alphanumeric) and the issuer public key (G... base32) up front and throw descriptive errors naming the offending side. Closes Chulilee#58
|
@akargi is attempting to deploy a commit to the Akargi Team on Vercel. A member of the Team first needs to authorize it. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two validation gaps let malformed input reach deeper layers where it failed late and unclear:
Trading pair validation (API)
src/lib/trading-pairs.tswith theSUPPORTED_TRADING_PAIRSregistry andisSupportedTradingPairhelper.POST /api/v1/ordersnow rejects unknown pairs with 400 and returns the offending pair plus the list of valid markets indetails.valid.NaN/Infinitycan no longer reach the matching engine.DEX asset validation (Stellar)
src/lib/stellar/asset-validation.ts: asset code shape (1-12 alphanumeric after normalization) and issuer public key format (G+ 55 base32 characters), with descriptive messages.buildDexOfferTxvalidates base and counter assets before touching Horizon, so invalid references fail fast withBase asset invalid: .../Counter asset invalid: ...instead of opaque SDK submission errors.buildCancelOfferTxinherits the check via delegation.Testing
src/__tests__/api.test.ts: covers unsupported pair rejection (status, message,details.valid) and acceptance of another registry pair.src/lib/stellar/__tests__/asset-validation.test.ts: edge cases for key length/prefix/base32 charset, code length/charset, native XLM, missing issuer, lowercase normalization.src/lib/stellar/__tests__/dex.test.ts: happy-path offer builds (mocked Horizon), both-native guard, and per-side validation failures including the no-network-call-before-validation guarantee.npm run type-checkandnpm run lintpass.Closes #59
Closes #58