strkey: enforce SEP-23 payload lengths in Decode and DecodeAny

[karthikiyer56]

TL;DR

• strkey.Decode/DecodeAny now validate the payload length against the version byte per SEP-23. Breaking: inputs with a valid checksum but a wrong-length payload — previously accepted by Decode, DecodeAny, and every IsValid* helper — are now rejected.
• Signed payloads are validated structurally per CAP-40; NewSignedPayload rejects empty payloads.
• Length re-checks that Decode now subsumes were removed from keypair, xdr, and txnbuild callers; keypair.ParseAddress wraps decode failures with ErrInvalidKey so errors.Is matching keeps working.

Details

• checkPayloadLength inside Decode/DecodeAny: exact 32 bytes for account ID/seed/contract/liquidity pool/hashTx/hashX, 33 for claimable balance, 40 for muxed account.
• Signed payloads validated structurally: 32-byte signer key + 4-byte declared length in 1–64 + payload zero-padded to a multiple of four. Empty payloads are rejected (matching CAP-40's SET_OPTIONS_BAD_SIGNER/txMALFORMED treatment and js-stellar-base).
• NewSignedPayload rejects empty payloads so SignedPayload.Encode output stays decodable; DecodeSignedPayload drops its now-unreachable short-payload check and redundant XDR re-parse.
• Now-dead caller-level length re-checks removed: xdr.AccountId.SetAddress, xdr.MuxedAccount.SetAddress, xdr.SignerKey.SetAddress, xdr.ClaimableBalanceId.DecodeFromStrkey, strkey.DecodeMuxedAccount/SetAccountID, txnbuild contract-address parsing. For wrong-length inputs, the xdr and txnbuild callers now return strkey's invalid payload length error; the strkey muxed-account helpers keep their generic messages; xdr.MuxedAccount.SetAddress is unchanged (it rejects on encoded string length before decoding).
• keypair: ParseAddress wraps every decode failure with ErrInvalidKey (via %w), so the sentinel keeps matching wrong-length keys — and now also matches checksum/encoding failures, which previously returned the bare strkey error. Parse's seed fallback compares against strkey.ErrInvalidVersionByte with errors.Is instead of != so it survives the wrapping.
• Tests: per-version wrong-length rejection for Decode/DecodeAny and the IsValid* helpers, signed-payload boundaries (1/64 valid; 0/65, truncated header, declared-vs-actual mismatch, nonzero padding invalid), and the SEP-23 invalid signed-payload vectors asserted directly on Decode.
• Changelog entry under Breaking Changes in CHANGELOG.md.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Consolidates liquidity-pool ordering checks and adds canonical SEP-23 payload-length validation.

Changes:

• Delegates pool ordering validation to XDR after asset conversion.
• Validates fixed-length and signed-payload StrKeys centrally.
• Removes redundant checks and updates tests and changelogs.

Reviewed changes

Copilot reviewed 27 out of 27 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
xdr/signer_key.go	Removes redundant signer length check.
xdr/muxed_account.go	Removes redundant account length checks.
xdr/claimable_balance_id.go	Delegates payload length validation.
xdr/claimable_balance_id_test.go	Updates expected validation error.
xdr/asset.go	Removes unreachable error branches.
xdr/account_id.go	Removes redundant address length check.
txnbuild/restore_footprint.go	Delegates contract length validation.
txnbuild/restore_footprint_test.go	Updates expected error.
txnbuild/liquidity_pool_withdraw.go	Removes premature ordering check.
txnbuild/liquidity_pool_withdraw_test.go	Tests malformed asset errors.
txnbuild/liquidity_pool_id.go	Delegates ordering to XDR.
txnbuild/liquidity_pool_deposit.go	Removes premature ordering check.
txnbuild/liquidity_pool_deposit_test.go	Tests malformed asset errors.
txnbuild/invoke_host_function.go	Delegates contract length validation.
txnbuild/invoke_host_function_test.go	Updates expected error.
txnbuild/CHANGELOG.md	Documents ordering behavior.
strkey/signed_payload.go	Centralizes structural validation.
strkey/signed_payload_test.go	Covers nonempty payload boundaries.
strkey/muxed_account.go	Removes redundant checks.
strkey/main.go	Adds version-specific payload validation.
strkey/isvalid_length_test.go	Tests validation helpers.
strkey/decode_length_test.go	Tests canonical lengths and padding.
keypair/main.go	Deprecates ErrInvalidKey.
keypair/from_address.go	Delegates key length validation.
keypair/from_address_test.go	Updates expected errors.
ingest/producer_test.go	Simplifies datastore mock setup.
CHANGELOG.md	Documents breaking StrKey changes; error-propagation wording needs correction.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.