From d3949614c6f7f18c98b1d3835045bbab73c9d11d Mon Sep 17 00:00:00 2001
From: napoly <napolytan@protonmail.com>
Date: Tue, 15 Nov 2022 12:25:16 +0100
Subject: [PATCH] reject creating crypto payment account with invalid currency
 code or address

---
 .../core/api/CorePaymentAccountsService.java  | 34 ++++++++++++++++---
 1 file changed, 29 insertions(+), 5 deletions(-)

diff --git a/core/src/main/java/bisq/core/api/CorePaymentAccountsService.java b/core/src/main/java/bisq/core/api/CorePaymentAccountsService.java
index e1ad09b59a..456e9f745d 100644
--- a/core/src/main/java/bisq/core/api/CorePaymentAccountsService.java
+++ b/core/src/main/java/bisq/core/api/CorePaymentAccountsService.java
@@ -30,6 +30,10 @@ import bisq.core.payment.PaymentAccount;
 import bisq.core.payment.PaymentAccountFactory;
 import bisq.core.payment.payload.PaymentMethod;
 import bisq.core.user.User;
+
+import bisq.asset.Asset;
+import bisq.asset.AssetRegistry;
+
 import javax.inject.Inject;
 import javax.inject.Singleton;
 
@@ -43,6 +47,8 @@ import java.util.stream.Collectors;
 
 import lombok.extern.slf4j.Slf4j;
 
+import static bisq.common.config.Config.baseCurrencyNetwork;
+import static bisq.core.locale.CurrencyUtil.findAsset;
 import static bisq.core.locale.CurrencyUtil.getCryptoCurrency;
 import static java.lang.String.format;
 
@@ -74,7 +80,7 @@ class CorePaymentAccountsService {
                 paymentAccount.getPaymentAccountPayload().getPaymentMethodId());
         return paymentAccount;
     }
-    
+
     private static void setSelectedTradeCurrency(PaymentAccount paymentAccount) {
         TradeCurrency singleTradeCurrency = paymentAccount.getSingleTradeCurrency();
         List<TradeCurrency> tradeCurrencies = paymentAccount.getTradeCurrencies();
@@ -125,16 +131,15 @@ class CorePaymentAccountsService {
                                                       String address,
                                                       boolean tradeInstant) {
         accountService.checkAccountOpen();
-        if (currencyCode == null) throw new RuntimeException("Cryptocurrency code is null");
-        var cryptoCurrencyAccount = tradeInstant
+        verifyCryptoCurrencyAddress(currencyCode.toUpperCase(), address);
+        AssetAccount cryptoCurrencyAccount = tradeInstant
                 ? (InstantCryptoCurrencyAccount) PaymentAccountFactory.getPaymentAccount(PaymentMethod.BLOCK_CHAINS_INSTANT)
                 : (CryptoCurrencyAccount) PaymentAccountFactory.getPaymentAccount(PaymentMethod.BLOCK_CHAINS);
         cryptoCurrencyAccount.init();
         cryptoCurrencyAccount.setAccountName(accountName);
         cryptoCurrencyAccount.setAddress(address);
         Optional<CryptoCurrency> cryptoCurrency = getCryptoCurrency(currencyCode.toUpperCase());
-        if (!cryptoCurrency.isPresent()) throw new RuntimeException("Unsupported cryptocurrency code: " + currencyCode.toUpperCase());
-        cryptoCurrencyAccount.setSingleTradeCurrency(cryptoCurrency.get());
+        cryptoCurrency.ifPresent(cryptoCurrencyAccount::setSingleTradeCurrency);
         user.addPaymentAccount(cryptoCurrencyAccount);
         if (!(cryptoCurrencyAccount instanceof AssetAccount)) accountAgeWitnessService.publishMyAccountAgeWitness(cryptoCurrencyAccount.getPaymentAccountPayload()); // TODO (woodser): applies to Haveno?
         log.info("Saved crypto payment account with id {} and payment method {}.",
@@ -164,6 +169,25 @@ class CorePaymentAccountsService {
         paymentAccount.validateFormField(form, fieldId, value);
     }
 
+    private void verifyCryptoCurrencyAddress(String cryptoCurrencyCode, String address) {
+        Asset asset = getAsset(cryptoCurrencyCode);
+
+        if (!asset.validateAddress(address).isValid())
+            throw new IllegalArgumentException(
+                    format("%s is not a valid %s address",
+                            address,
+                            cryptoCurrencyCode.toLowerCase()));
+    }
+
+    private Asset getAsset(String cryptoCurrencyCode) {
+        return findAsset(new AssetRegistry(),
+                cryptoCurrencyCode,
+                baseCurrencyNetwork())
+                .orElseThrow(() -> new IllegalStateException(
+                        format("crypto currency with code '%s' not found",
+                                cryptoCurrencyCode.toLowerCase())));
+    }
+
     private void verifyPaymentAccountHasRequiredFields(PaymentAccount paymentAccount) {
         if (!paymentAccount.hasMultipleCurrencies() && paymentAccount.getSingleTradeCurrency() == null)
             throw new IllegalArgumentException(format("no trade currency defined for %s payment account",