From d370f6063d2e131b514838db5989823919bd5304 Mon Sep 17 00:00:00 2001
From: ak68a <a@ak68a.co>
Date: Wed, 25 Mar 2026 07:08:53 -0500
Subject: [PATCH] fix(caip): add input validation to createCaip10AccountId

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 packages/caip/src/caips/caip-10.test.ts | 15 +++++++++++++++
 packages/caip/src/caips/caip-10.ts      |  7 +++++++
 2 files changed, 22 insertions(+)

diff --git a/packages/caip/src/caips/caip-10.test.ts b/packages/caip/src/caips/caip-10.test.ts
index a16e841..211a6ab 100644
--- a/packages/caip/src/caips/caip-10.test.ts
+++ b/packages/caip/src/caips/caip-10.test.ts
@@ -20,4 +20,19 @@ describe("createCaip10AccountId", () => {
       "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp:FNoGHiv7DKPLXHfuhiEWpJ8qYitawGkuaYwfYkuvFk1P",
     )
   })
+
+  it("throws for invalid chain ID", () => {
+    expect(() =>
+      createCaip10AccountId(
+        "bad" as any,
+        "0x1234567890123456789012345678901234567890",
+      ),
+    ).toThrow("Invalid CAIP-2 chain ID")
+  })
+
+  it("throws for invalid account address", () => {
+    expect(() => createCaip10AccountId("eip155:1", "")).toThrow(
+      "Invalid CAIP-10 account address",
+    )
+  })
 })
diff --git a/packages/caip/src/caips/caip-10.ts b/packages/caip/src/caips/caip-10.ts
index 22a06fe..b5ecfc3 100644
--- a/packages/caip/src/caips/caip-10.ts
+++ b/packages/caip/src/caips/caip-10.ts
@@ -1,5 +1,6 @@
 import {
   caip2ChainIdPattern,
+  caip2ChainIdRegex,
   type Caip2ChainId,
   type Caip2ChainIdParts,
 } from "./caip-2"
@@ -37,6 +38,12 @@ export function createCaip10AccountId(
   chainId: Caip2ChainId,
   address: string,
 ): Caip10AccountId {
+  if (!caip2ChainIdRegex.test(chainId)) {
+    throw new Error(`Invalid CAIP-2 chain ID: ${chainId}`)
+  }
+  if (!caip10AccountAddressRegex.test(address)) {
+    throw new Error(`Invalid CAIP-10 account address: ${address}`)
+  }
   return `${chainId}:${address}`
 }