fix: validate account Ids from args

engine-tests/src/tests/contract_call.rs

@@ -30,6 +30,14 @@ fn setup_test() -> (AuroraRunner, Signer, Address, Tester) {
     (runner, signer, token, tester)
 }
 
+#[test]
+#[should_panic]
+fn test_deploy_erc20_token_with_invalid_account_id() {
+    let mut runner = AuroraRunner::new();
+    let invalid_nep141 = "_";
+    runner.deploy_erc20_token(invalid_nep141);
+}
+
 #[test]
 fn hello_world_solidity() {
     let (mut runner, mut signer, _token, tester) = setup_test();

engine-types/src/account_id.rs

@@ -2,8 +2,8 @@
 //!
 //! Inspired by: `https://github.com/near/nearcore/tree/master/core/account-id`
 
-use crate::{fmt, str, str::FromStr, Box, String, Vec};
-use borsh::{BorshDeserialize, BorshSerialize};
+use crate::{fmt, str, str::FromStr, Box, String, ToString, Vec};
+use borsh::{maybestd::io, BorshDeserialize, BorshSerialize};
 use serde::{Deserialize, Serialize};
 
 pub const MIN_ACCOUNT_ID_LEN: usize = 2;
@@ -13,11 +13,10 @@ pub const MAX_ACCOUNT_ID_LEN: usize = 64;
 ///
 /// This guarantees all properly constructed `AccountId`'s are valid for the NEAR network.
 #[derive(
+    Default,
     BorshSerialize,
-    BorshDeserialize,
     Serialize,
     Deserialize,
-    Default,
     Eq,
     Ord,
     Hash,
@@ -96,6 +95,20 @@ impl AccountId {
     }
 }
 
+impl BorshDeserialize for AccountId {
+    fn deserialize(buf: &mut &[u8]) -> io::Result<Self> {
+        let account: String = BorshDeserialize::deserialize(buf)?;
+
+        // It's for saving backward compatibility.
+        if account.is_empty() {
+            return Ok(Self::default());
+        }
+
+        AccountId::new(&account)
+            .map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e.to_string()))
+    }
+}
+
 impl TryFrom<String> for AccountId {
     type Error = ParseAccountError;