Harden input validation in NEAR serialization and Zcash signing

[nikhil-gupta-tw]

This pull request introduces a validation step for Zcash PCZT outputs to ensure that, if a user_address is provided, it matches the expected script_pubkey. It also adds comprehensive unit and integration tests for this behavior, and improves error handling in NEAR serialization. Additionally, it updates dependencies to include the Zcash crate for testing.

Zcash PCZT output validation and testing:

• Added a check in OutputPczt::build to verify that if user_address is present, it matches the script_pubkey by converting the address to a script and comparing it. This prevents mismatches and potential security issues.
• Introduced unit tests in output_pczt.rs to cover cases where the address matches, mismatches, or is invalid, ensuring robust validation logic.
• Added integration tests in zcash_sign.rs to verify end-to-end signing behavior for PCZT transactions with matching and mismatched user_address fields.

Dependency and test infrastructure updates:

• Added tw_zcash as a dependency in tw_tests/Cargo.toml to enable Zcash-related tests.
• Updated imports in the Zcash test suite to support new PCZT features and address encoding/decoding.

Error handling improvement in NEAR serialization:

• Replaced an assert with an exception in writeU128 to throw a clear error if the input is not exactly 16 bytes, improving robustness and error reporting. [1] [2]

[octane-security-app]

Summary by Octane

New Contracts

No new contracts were added.

Updated Contracts

• output_pczt.rs: Added Zcash address validation, script matching, error handling, and unit tests for user addresses in OutputPczt.
• Serialization.cpp: Enhanced error handling for a U128 number validation by replacing an assert with a thrown exception for incorrect input length.

---

🔗 Commit Hash: 16e3584

[github-actions]

Binary size comparison

➡️ aarch64-apple-ios:

- 14.31 MB
+ 14.31 MB 	 +5 KB

➡️ aarch64-apple-ios-sim:

- 14.31 MB
+ 14.32 MB 	 +5 KB

➡️ aarch64-linux-android:

- 18.73 MB
+ 18.74 MB 	 +8 KB

➡️ armv7-linux-androideabi:

- 16.17 MB
+ 16.18 MB 	 +6 KB

➡️ wasm32-unknown-emscripten:

- 13.66 MB
+ 13.67 MB 	 +6 KB

[sergei-boiko-trustwallet]

One change please

[sergei-boiko-trustwallet]

LGTM! Thanks for the fix

[BSCSecChef]

1. This is never used in the function, check once -

   wallet-core/rust/chains/tw_bitcoin/src/modules/compiler.rs

   Line 97 in 2657bd3

   _public_keys: Vec<PublicKeyBytes>,

2. Could you help to check on UI end too once. So send_amount is never used on UI end, it iterates on the output list and show each destination

3. Probably add in validation check (length) on these -

   wallet-core/src/NEAR/Serialization.cpp

   Line 177 in 2657bd3

   const auto& block_hash = input.block_hash();

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[nikhil-gupta-tw]

1. This is never used in the function, check once -

   wallet-core/rust/chains/tw_bitcoin/src/modules/compiler.rs

   Line 97 in 2657bd3

   _public_keys: Vec<PublicKeyBytes>,

Yes, it's the shared compile interface param, intentionally unused for Bitcoin.

2. Could you help to check on UI end too once. So send_amount is never used on UI end, it iterates on the output list and show each destination

I have checked and UI doesn't use send_amount. Tagging @sergei-boiko-trustwallet as well.

3. Probably add in validation check (length) on these -

   wallet-core/src/NEAR/Serialization.cpp

   Line 177 in 2657bd3

   const auto& block_hash = input.block_hash();

Already done in #4812 .

[BSCSecChef]

LGTM