decodeStealthMetaAddress accepts non-hex characters in the payload

[Jerryvic911]

Found while writing tests for the rescue tool (wraith-protocol/contracts#199).

On develop, decodeStealthMetaAddress('st:xlm:' + 'zz'.repeat(64)) does not throw, even though the payload is not hex. The prefix and length checks pass, and the decoder returns keys instead of an InvalidMetaAddressError.

Expected: a payload containing non-hex characters is rejected with InvalidMetaAddressError. A strict check such as /^[0-9a-fA-F]{128}$/ on the payload would do it.

Workaround: the rescue tool validates the format with a regex before calling the decoder.

[ravimahatonp]

Hi team,

Happy to tackle this. Here is how I plan to implement it:

Technical outline:

1. Audit storage layout and state invariants ensuring strict auth guards.
2. Implement deterministic state transitions with safe checked arithmetic.
3. Add hermetic unit and regression tests covering authorized, unauthorized, and boundary edge cases.
4. Profile instruction and CPU/gas limits under Soroban host environment.

Let me know if this aligns with the repository guidelines and assign when convenient.