Check that GetAddressUtxos only returns UTXOs for addresses we requested

[str4d]

zcash-android-wallet-sdk/lightwallet-client-lib/src/main/java/co/electriccoin/lightwallet/client/internal/LightWalletClientImpl.kt

Lines 150 to 181 in e37a35a

	override suspend fun fetchUtxos(
	tAddresses: List<String>,
	startHeight: BlockHeightUnsafe
	): Flow<Response<GetAddressUtxosReplyUnsafe>> {
	require(tAddresses.isNotEmpty() && tAddresses.all { it.isNotBlank() }) {
	"${Constants.ILLEGAL_ARGUMENT_EXCEPTION_MESSAGE_EMPTY} array of addresses contains invalid item." // NON-NLS
	}
	val getUtxosBuilder =
	Service.GetAddressUtxosArg.newBuilder().apply {
	addAllAddresses(tAddresses)
	setStartHeight(startHeight.value)
	}
	val request = getUtxosBuilder.build()
	return try {
	requireChannel().createStub(streamingRequestTimeout)
	.getAddressUtxosStream(request)
	.map {
	val response: Response<GetAddressUtxosReplyUnsafe> =
	Response.Success(GetAddressUtxosReplyUnsafe.new(it))
	response
	}.catch {
	val failure: Response.Failure<GetAddressUtxosReplyUnsafe> =
	GrpcStatusResolver.resolveFailureFromStatus(it)
	emit(failure)
	}
	} catch (e: StatusException) {
	flowOf(GrpcStatusResolver.resolveFailureFromStatus(e))
	}
	}

This code passes tAddresses to lightwalletd, but does not check that the response from lightwalletd only contains addresses that were in tAddresses, which means any bugs in lightwalletd (or its backing node) would result in unexpected transparent addresses making their way into the wallet DB.

We should check that for each response, utxo.address exists in tAddresses. If we get a UTXO that doesn't match, we should log a warning containing the unexpected UTXO, and then skip it (not include it in the returned stream).