Fix: Start param validation

app/shared/api/telegram/__tests__/bot-api.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, test } from 'vitest';
+
+import { botApi } from '../bot-api';
+
+describe('shared/api/telegram/bot-api', () => {
+  test.each([
+    ['acbdeacbdeacbde12345_12_WND', true], // valid (with chainIndex)
+    ['acbdeacbdeacbde12345_wnd', true], // valid (no chainIndex)
+    ['acbdeacbdeacbdeabcde_12_wnd', true], // valid (no digits inside entropy)
+    ['acbdeacbdeacbde12345_12_23_wnd', false], // double chainIndex
+    ['qwertqwertqwert12345_12_wnd', false], // wrong letters inside entropy
+    ['acbdeacbdeacbde12345_12', false], // no asset symbol
+    ['', false], // no data at all
+  ])('should validate Telegram StartParam', (value, expectedResult) => {
+    const result = botApi.validateStartParam(value);
+
+    expect(result).toEqual(expectedResult);
+  });
+});

app/shared/api/telegram/bot-api.ts

@@ -7,6 +7,7 @@ const SUBMIT_WALLET_PATH = 'submit/wallet';
 export const botApi = {
   submitPublicKey,
   createTelegramLink,
+  validateStartParam,
 };
 
 async function submitPublicKey(publicKey: PublicKey, baseUrl: string): Promise<void> {
@@ -58,3 +59,7 @@ function createTelegramLink({ botUrl, appName, amount, secret, chainIndex, symbo
 
   return { url: url.toString(), text };
 }
+
+function validateStartParam(value: string): boolean {
+  return /^[a-f0-9]{20}_([0-9]+_)?[a-z]+$/i.test(value);
+}

app/ui/molecules/GiftClaim/GiftClaim.tsx

@@ -11,7 +11,7 @@ import { type BN, BN_ZERO } from '@polkadot/util';
 import { useGlobalContext } from '@/common/providers';
 import { networkModel } from '@/models/network';
 import { walletModel } from '@/models/wallet';
-import { TelegramApi, balancesFactory, transferFactory } from '@/shared/api';
+import { TelegramApi, balancesFactory, botApi, transferFactory } from '@/shared/api';
 import { getGiftInfo, toFormattedBalance } from '@/shared/helpers';
 import { type Asset } from '@/types/substrate';
 import { BigTitle, Icon, LottiePlayer, Shimmering } from '@/ui/atoms';
@@ -47,6 +47,7 @@ export const GiftClaim = () => {
 
   useEffect(() => {
     if (isGiftClaimed || !startParam || !wallet) return;
+    if (!botApi.validateStartParam(startParam)) return;
     setIsOpen(true);
 
     const giftInfo = getGiftInfo(Object.values(chains), wallet, startParam);