Description
src/pools/dto/donate-pool.dto.ts's amount field only has @IsNumberString() and @IsNotEmpty(). class-validator's IsNumberString accepts negative numbers and "0" by default, so POST /pools/:id/donate with { "amount": "-100" } or { "amount": "0" } currently passes validation and reaches ContractService.buildDonateTransaction, which will build a nonsensical unsigned transaction for the caller to sign.
Deliverables
Description
src/pools/dto/donate-pool.dto.ts'samountfield only has@IsNumberString()and@IsNotEmpty().class-validator'sIsNumberStringaccepts negative numbers and"0"by default, soPOST /pools/:id/donatewith{ "amount": "-100" }or{ "amount": "0" }currently passes validation and reachesContractService.buildDonateTransaction, which will build a nonsensical unsigned transaction for the caller to sign.Deliverables
@Matches(/^[1-9][0-9]*$/)) toDonatePoolDto.amountthat rejects zero, negative, and non-integer valuesamount: "0"andamount: "-5"are rejected with 400