feedback

app/scripts/controllers/preferences.js

@@ -867,7 +867,7 @@ export default class PreferencesController {
         `Invalid decimals "${decimals}": must be 0 <= 36.`,
       );
     }
-    if (!isValidHexAddress(address, false)) {
+    if (!isValidHexAddress(address, { allowNonPrefixed: false })) {
       throw ethErrors.rpc.invalidParams(`Invalid address "${address}".`);
     }
   }

app/scripts/lib/typed-message-manager.js

@@ -160,7 +160,8 @@ export default class TypedMessageManager extends EventEmitter {
     assert.ok('data' in params, 'Params must include a "data" field.');
     assert.ok('from' in params, 'Params must include a "from" field.');
     assert.ok(
-      typeof params.from === 'string' && isValidHexAddress(params.from, false),
+      typeof params.from === 'string' &&
+        isValidHexAddress(params.from, { allowNonPrefixed: false }),
       '"from" field must be a valid, lowercase, hexadecimal Ethereum address string.',
     );
 

shared/modules/hexstring-utils.js

@@ -11,7 +11,24 @@ export function isBurnAddress(address) {
   return address === BURN_ADDRESS;
 }
 
-export function isValidHexAddress(possibleAddress, allowNonPrefixed = true) {
+/**
+ * Validates that the input is a hex address. This utility method is a thin
+ * wrapper around ethereumjs-util.isValidAddress, with the exception that it
+ * does not throw an error when provided values that are not hex strings. In
+ * addition, and by default, this method will return true for hex strings that
+ * meet the length requirement of a hex address, but are not prefixed with `0x`
+ * Finally, if a mixed case string is provided this method assumes the address
+ * is a checksum address and will validate it as such.
+ * @param {string} possibleAddress - Input parameter to check against
+ * @param {Object} [options] - options bag
+ * @param {boolean} [options.allowNonPrefixed] - If true will first ensure '0x' is
+ *  prepended to the string
+ * @returns {boolean} whether or not the input is a valid hex address
+ */
+export function isValidHexAddress(
+  possibleAddress,
+  { allowNonPrefixed = true } = {},
+) {
   const addressToCheck = allowNonPrefixed
     ? addHexPrefix(possibleAddress)
     : possibleAddress;

shared/modules/hexstring-utils.test.js

@@ -16,6 +16,12 @@ describe('hexstring utils', function () {
       assert.equal(result, true);
     });
 
+    it('should NOT allow 40-char non-prefixed hex when allowNonPrefixed is false', function () {
+      const address = 'fdea65c8e26263f6d9a1b5de9555d2931a33b825';
+      const result = isValidHexAddress(address, { allowNonPrefixed: false });
+      assert.equal(result, false);
+    });
+
     it('should NOT allow any length of non hex-prefixed string', function () {
       const address = 'fdea65c8e26263f6d9a1b5de9555d2931a33b85';
       const result = isValidHexAddress(address);

ui/helpers/utils/icon-factory.js

@@ -19,7 +19,7 @@ function IconFactory(jazzicon) {
 IconFactory.prototype.iconForAddress = function (address, diameter) {
   let addr = address;
 
-  if (isValidHexAddress(address, false)) {
+  if (isValidHexAddress(address, { allowNonPrefixed: false })) {
     addr = checksumAddress(address);
   }
 

ui/pages/add-token/add-token.component.js

@@ -165,7 +165,9 @@ class AddToken extends Component {
       autoFilled: false,
     });
 
-    const addressIsValid = isValidHexAddress(customAddress, false);
+    const addressIsValid = isValidHexAddress(customAddress, {
+      allowNonPrefixed: false,
+    });
     const standardAddress = addHexPrefix(customAddress).toLowerCase();
 
     switch (true) {