Crypto address checksum validation where applicable

Ethereum EIP-55 mixed-case checksum and Bitcoin Base58Check both exist to catch single-character typos that would otherwise route funds to a valid-looking but incorrect address. A format-only regex (/^0x[0-9a-fA-F]{40}$/) accepts thousands of invalid checksummed Ethereum addresses — funds sent to those addresses are irreversibly lost. OWASP A03 applies: crypto wallet addresses are untrusted user input that requires structural validation, not just length checks.

Add checksum validation for each crypto address type accepted by the application. For Ethereum, implement EIP-55 in src/lib/validators.ts.

// src/lib/validators.ts (Ethereum EIP-55)
export function isValidEthAddress(address: string): boolean {
  if (!/^0x[0-9a-fA-F]{40}$/.test(address)) return false;
  // All-lowercase or all-uppercase passes (no checksum to verify)
  const stripped = address.slice(2);
  if (stripped === stripped.toLowerCase() || stripped === stripped.toUpperCase()) return true;
  const hash = keccak256(stripped.toLowerCase());
  return stripped.split('').every((c, i) =>
    parseInt(hash[i], 16) >= 8 ? c === c.toUpperCase() : c === c.toLowerCase()
  );
}

Apply as a Zod .refine() in src/lib/schemas.ts and validate server-side in the relevant API route.