Fix: Reject Invalid Stellar Asset Codes During Upload Validation

[jahrulezfrancis]

Problem

Payment rows with an invalid asset code pass upload validation and only
fail later, during actual transaction construction — turning what should be
a clear pre-submission rejection into a confusing mid-batch failure.

Severity: Medium
Location: lib/stellar/validator.ts:124-153, lib/stellar/utils.ts:155-169

Description

The asset validator checks that the code portion of CODE:ISSUER is
non-empty and at most 12 characters, and that the issuer address checksum is
valid — but never checks that the code is alphanumeric, which Stellar
requires. A value like "BAD CODE" (8 characters, including a space) passes
validation as valid: true. Later, new Asset(code, issuer) in
stellar-sdk throws when actually building the payment operation, turning a
row that should have been rejected at upload into a failure during batch
execution.

Steps to Reproduce

1. Upload a row with asset BAD CODE:<valid issuer address>.
2. Validation reports the row as valid.
3. Submit the batch.
4. stellar-sdk throws "Asset code is invalid" while constructing the
   payment operation, failing that row at execution time instead of upload.

Expected Behavior

Any asset accepted by pre-submission validation should be guaranteed
constructible by stellar-sdk — invalid codes should be rejected at upload.

Suggested Fix Approach

Require the code to match Stellar's alphanumeric rule directly in the
validator, or construct a stellar-sdk Asset inside validation itself and
convert any thrown exception into a row-level validation error.

Acceptance Criteria

• Asset codes with non-alphanumeric characters are rejected at
  validation time, not execution time
• Test covers a code with a space, and a code with other invalid
  characters
• Valid alphanumeric codes of length 1-12 continue to pass

---

[liukaisweetsmile-pixel]

I audited lib/stellar/validator.ts and the existing parseAsset/stellar-sdk construction path. I can make upload validation use the SDK's accepted asset-code rules as the source of truth, convert constructor failures into stable row-level validation errors, and keep XLM plus valid 1-12 character alphanumeric codes unchanged. I'll add focused Vitest coverage for spaces, punctuation, boundary lengths, valid mixed-case/alphanumeric codes, and the invariant that every accepted issued asset is constructible by stellar-sdk. I will run the targeted validator tests, full npm test, typecheck, lint, and production build, and can deliver within 24 hours of assignment.

[vic-Gray]

I'd like to work on this issue.

I'll update the asset validation logic to enforce Stellar's asset code requirements during pre-submission validation, ensuring only valid alphanumeric asset codes (1–12 characters) are accepted. This will prevent malformed asset codes from reaching transaction construction, allowing invalid rows to be rejected early with clear validation errors instead of failing during batch execution.

I'll also add tests covering asset codes with spaces and other invalid characters, while verifying that valid alphanumeric codes continue to pass validation and remain fully compatible with stellar-sdk.

[grantfox-oss]

🦊 GrantFox — @vic-Gray has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #701)
2. Your PR will be reviewed by the Batch-Pay maintainers

Good luck! Track your progress on GrantFox.