Repository navigation
[BE-159] update-profile.dto.ts: walletAddress accepts any string — no Stellar public-key format validation #1547
Description
UpdateProfileDto.walletAddress is validated only with @IsString(). Everything downstream (PaymentsService.initiateFunding, StellarContractService.buildFundEscrowTransaction) assumes this value is a valid Stellar StrKey public key ('G' + 55 base32 chars) and passes it straight into new Address(...), which throws only at funding time — deep inside the escrow flow, long after the user saved their profile. Validating the format (e.g. a StrKey regex or the SDK's own StrKey.isValidEd25519PublicKey()) at the DTO level would surface the mistake immediately on PATCH /auth/profile instead of failing an unrelated payment initiation later.
Activity
MoisesSalva10 commentedon Sep 25, 2026
Hi! I'd like to work on this issue.
About me: I'm a junior developer from Costa Rica with a background in C#/.NET and SQL Server, and I've also built Next.js/TypeScript projects. Attribute-based DTO validation like class-validator is familiar to me from .NET data annotations. This would be one of my first open-source contributions, and I'm happy to follow the repo's conventions and review feedback.
Approach:
@IsStellarPublicKey()) that uses the SDK'sStrKey.isValidEd25519PublicKey(). The project already depends on the Stellar SDK fornew Address(...), so no new dependency is needed, and this also verifies the checksum, which a regex alone wouldn't.UpdateProfileDto.walletAddress, keeping@IsString()and the current optional behavior, with a clear error message (e.g. "walletAddress must be a valid Stellar public key (G...)").PATCH /auth/profilewith a bad address should now return 400 right away, and a valid one should save as before. I'll put these QA steps in the PR description.If you'd rather keep it simpler with a StrKey regex, or put the decorator in a specific shared folder, I'll follow your preference.
authenticeasy-sys commentedon Sep 25, 2026
@authenticeasy-sys has applied to work on this issue as part of the Stellar Wave Program's 9th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @authenticeasy-sys to this issue.
drips-wave commentedon Sep 25, 2026
Congratulations, @authenticeasy-sys! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on September 30, 2026.
🧑💻 @authenticeasy-sys: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
feat(auth): secure profile and certification validation (#1615)
grantfox-oss commentedon Sep 25, 2026
🎉 This issue has been marked as completed on GrantFox!
@authenticeasy-sys's PR #1615 was approved and merged by @mftee.
🏆 @authenticeasy-sys: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (990 total points). Track your full progress on GrantFox.
👏 Great work, @authenticeasy-sys! Keep contributing to CodeGirlsInc.
drips-wave commentedon Sep 25, 2026
This issue has been completed by @authenticeasy-sys as part of the Stellar Wave Program's 9th Wave 🥳
😎 @authenticeasy-sys: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.