Routing number ABA check digit validated

ABA routing numbers embed a mod-10 checksum across all nine digits — a format-only regex like /^\d{9}$/ accepts the vast majority of structurally invalid routing numbers that would fail at the ACH network. Invalid routing numbers cause failed or misdirected ACH transactions, NSF fees, and customer support costs. NACHA Operating Rules require validation of routing-number integrity before origination, and OWASP A03 names improper input validation among the top application-security failure modes. The fix is a 10-line checksum function, not a library dependency.

Add the ABA mod-10 checksum algorithm to src/lib/validators.ts and wire it into the Zod schema used by the server route. The digit weighting pattern is 3-7-1 repeated across three digit groups.

// src/lib/validators.ts
export function isValidABARoutingNumber(r: string): boolean {
  if (!/^\d{9}$/.test(r)) return false;
  const d = r.split('').map(Number);
  const sum =
    3 * (d[0] + d[3] + d[6]) +
    7 * (d[1] + d[4] + d[7]) +
    1 * (d[2] + d[5] + d[8]);
  return sum % 10 === 0;
}

In src/lib/schemas.ts, add .refine(isValidABARoutingNumber, 'Invalid routing number') to the routing number field and apply the schema in the server-side API route handler.