Skip to content

fix(wallet): match XLM and USDC balances with issuer verification (#49) - #82

Open
ghzhost wants to merge 1 commit into
StellarSend:mainfrom
ghzhost:fix/wallet-balance-asset-issuer-check
Open

ghzhost wants to merge 1 commit into
StellarSend:mainfrom
ghzhost:fix/wallet-balance-asset-issuer-check

Conversation

@ghzhost

@ghzhost ghzhost commented Sep 2, 2026

Copy link
Copy Markdown

Summary

Closes #49

Enforces strict asset issuer verification when deriving balances in useWallet, BalanceCard, and WalletInfo:

  • xlmBalance verifies asset.code === 'XLM' && asset.issuer === null, preventing any custom/spoofed token called "XLM" from shadowing native lumens.
  • usdcBalance verifies asset.code === 'USDC' && asset.issuer === expectedUsdcIssuer matching the pinned USDC_TESTNET or USDC_MAINNET issuer based on the active network.
  • BalanceCard and WalletInfo custom asset lists accurately exclude only native XLM and official USDC, cleanly surfacing any third-party or custom tokens.

Testing

  • Added comprehensive unit tests in src/hooks/useWallet.test.tsx checking native XLM priority, network-specific USDC verification, and spoofed asset resilience.
  • Ran test suite with 100% passing results (28 test files, 116 tests).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

useWallet matches XLM/USDC balances by asset code only (no issuer check) — a spoofed trustline reusing a trusted code can shadow the real balance

1 participant