[actpool] reject invalid transfer address (#4453)

action/action.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/ethereum/go-ethereum/common"
 	"github.com/iotexproject/go-pkgs/crypto"
+	"github.com/iotexproject/iotex-address/address"
 	"github.com/iotexproject/iotex-proto/golang/iotextypes"
 	"github.com/pkg/errors"
 )
@@ -119,3 +120,15 @@ func IsSystemAction(act *SealedEnvelope) bool {
 		return false
 	}
 }
+
+func CheckTransferAddress(act Action) error {
+	switch act := act.(type) {
+	case *Transfer:
+		if _, err := address.FromString(act.recipient); err != nil {
+			return errors.Wrapf(err, "invalid address %s", act.recipient)
+		}
+	default:
+		// other actions have this check in their SanityCheck
+	}
+	return nil
+}

actpool/actpool.go

@@ -334,7 +334,7 @@ func checkSelpData(act *action.SealedEnvelope) error {
 	if act.SrcPubkey() == nil {
 		return action.ErrAddress
 	}
-	return nil
+	return action.CheckTransferAddress(act.Action())
 }
 
 func (ap *actPool) checkSelpWithoutState(ctx context.Context, selp *action.SealedEnvelope) error {

actpool/actpool_test.go

@@ -201,6 +201,12 @@ func TestActPool_AddActs(t *testing.T) {
 	pNonce2, _ = ap.GetPendingNonce(_addr2)
 	require.Equal(uint64(4), pNonce2)
 	// Error Case Handling
+	// case 0: invalid transfer address
+	for _, addr := range []string{"", "wrongaddress", "io18743s33zmsvmvyynfxu5sy2f80e2g5mzk3y5uf"} {
+		tsf, err := action.SignedTransfer(addr, _priKey1, uint64(1), big.NewInt(10), []byte{}, uint64(100000), big.NewInt(0))
+		require.NoError(err)
+		require.ErrorIs(ap.Add(ctx, tsf), address.ErrInvalidAddr)
+	}
 	// Case I: Action source address is blacklisted
 	bannedTsf, err := action.SignedTransfer(_addr6, _priKey6, uint64(1), big.NewInt(0), []byte{}, uint64(100000), big.NewInt(0))
 	require.NoError(err)