Electric-Coin-Company / zcash-android-wallet-sdk

Native Android SDK for Zcash
MIT License
5 stars 9 forks source link

[SDK audit] Recommendation: Hard-coded currency decimal separator character #1455

Closed HonzaR closed 4 months ago

HonzaR commented 4 months ago

Is your feature request related to a problem? Please describe.

The following code in CurrencyFormatter.kt converts a string to a BigDecimal:

Screenshot 2024-04-23 at 13 55 51

Describe the solution you'd like

Hard-coding the currency decimal separator “.” is potentially problematic, since for example if a user from a country that uses “,” instead of “.” tries to send “1,23” ZEC, this will send 123 ZEC rather than the intended 1.23 ZEC.

Alternatives you've considered

Additional context