stellar_send/src/error.rs defines InvalidPath ("The payment path provided is empty or malformed") but stellar_send/src/lib.rs's send_path_payment never returns it — the path: Vec<Address> argument is only ever appended to full_path with no checks for duplicate hops, hops equal to send_token/dest_token, or a maximum path length.
Since Soroban has resource/instruction limits, an unbounded or malicious path could cause excessive gas usage or unexpected behavior once real DEX routing (see related issue on 1:1 simulation) is implemented. Add validation that rejects empty/duplicate/oversized paths and returns InvalidPath accordingly, with matching test coverage in stellar_send/src/test.rs.
stellar_send/src/error.rsdefinesInvalidPath("The payment path provided is empty or malformed") butstellar_send/src/lib.rs'ssend_path_paymentnever returns it — thepath: Vec<Address>argument is only ever appended tofull_pathwith no checks for duplicate hops, hops equal tosend_token/dest_token, or a maximum path length.Since Soroban has resource/instruction limits, an unbounded or malicious path could cause excessive gas usage or unexpected behavior once real DEX routing (see related issue on 1:1 simulation) is implemented. Add validation that rejects empty/duplicate/oversized paths and returns
InvalidPathaccordingly, with matching test coverage instellar_send/src/test.rs.