Cross-cutting: Validation logic is reimplemented in every subsystem with no shared source of truth

[Emmy123222]

Summary

Address formats, donation amount bounds, project field limits and status values are each defined independently in the backend schemas, the frontend, mobile and the extension. They disagree, and nothing detects it.

Details

The address validation split is the clearest instance, but the pattern is general: amount bounds enforced client-side may differ from what the server accepts and from what the contract enforces, so a donation can pass two layers and fail the third with an opaque error. Project status values are enumerated in the backend schema, again in the contract and again in client display logic. Field length limits differ between the client form and the server schema, so a user can type a description the server will reject. Each divergence surfaces as a confusing late failure rather than immediate inline feedback.

Suggested Approach

Define shared validation once and consume it everywhere. The genuine constraint is that four runtimes are involved — Node, browser, React Native and Rust — so a single shared module cannot cover all of them; the realistic approach is one machine-readable definition with generated or verified per-runtime implementations, plus a conformance suite every implementation must pass. The contract's rules are authoritative wherever they apply, since it is the layer that cannot be bypassed.

Acceptance Criteria

• Shared validation rules are defined once in a machine-readable form.
• Backend, frontend, mobile and extension derive their validation from it rather than reimplementing.
• A conformance suite of shared test vectors is executed by every implementation, including the contract.
• Where the contract enforces a rule, its bounds are authoritative and clients match exactly.
• CI fails when any implementation diverges from the shared definition.

Relevant Files

• backend/src/schemas
• frontend/lib/stellar.ts
• mobile/utils/stellarValidation.ts
• contracts

---

Filed from a second codebase-wide audit, run after the first round of issues was largely implemented. Every issue here is grounded in a specific, verified gap in the code as it stands today — a good number of them in the newer code itself. If anything no longer matches, please comment and we'll correct or close it.

[jchinedu]

let me work on this issue

[EmmanuelAdah]

I'd be glad to take up this issue. My prior open-source work on schema validation and smart contract integrations aligns well with this challenge. I propose extracting the authoritative constraints from the Rust contracts to establish a single, machine-readable JSON schema. Using code generation, I'll then distribute these rules seamlessly across the Node, browser, and React Native runtimes. Finally, I will implement a unified conformance test suite within the CI pipeline to ensure all environments remain strictly synchronized moving forward.

[grantfox-oss]

🦊 GrantFox — @EmmanuelAdah has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #385)
2. Your PR will be reviewed by the Stellar-Search maintainers

Good luck! Track your progress on GrantFox.