The IsValidAddr regex accepts 0-length and excessively long addresses

[crodriguezvega]

This issue was found by Trail of Bits during the audit of ICS27 Interchain Accounts

Problem Definition

The IsValidAddr regex accepts 0-length addresses and addresses longer than the DefaultMaxAddrLength, which are not valid. The ValidateAccountAddress function mitigates this issue by erroring out if the address string length is 0 or if it is longer than the DefaultMaxAddrLength; however, because the regex is a public variable, other developers could use this regex directly instead of calling the ValidateAccountAddress function, introducing data validation bugs into the software.

Proposal

Change the IsValidAddr regex to use a + quantifier instead of * so that it will match 1 or more characters, rather than 0 or more characters, from the [a-zA-Z0-9] range. Additionally, consider either modifying the regex so that it takes DefaultMaxAddrLength into account or lowercasing the regex’s name to make it a private variable. This will help prevent bugs in the future if someone uses the regex directly instead of through the ValidateAccountAddress function.

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged/assigned