M api/txspool.go → api/txspool.go

@@ -163,6 +163,11 @@ account, err := s.GetAccount(poolTx.FromIdx)
 	if err != nil {
 		return err
 	}
+	// Validate feeAmount
+	_, err = common.CalcFeeAmount(poolTx.Amount, poolTx.Fee)
+	if err != nil {
+		return err
+	}
 	// Check signature
 	if !poolTx.VerifySignature(account.PublicKey) {
 		return errors.New("wrong signature")

M api/txspool_test.go → api/txspool_test.go

@@ -205,12 +205,21 @@ )
 		assert.Equal(t, tx.TxID, fetchedTxID)
 	}
 	// 400
-	// Wrong signature
+	// Wrong fee
 	badTx := tc.poolTxsToSend[0]
-	badTx.FromIdx = "hez:foo:1000"
+	badTx.Amount = "99999999999999999999999"
+	badTx.Fee = 255
 	jsonTxBytes, err := json.Marshal(badTx)
 	assert.NoError(t, err)
 	jsonTxReader := bytes.NewReader(jsonTxBytes)
+	err = doBadReq("POST", endpoint, jsonTxReader, 400)
+	assert.NoError(t, err)
+	// Wrong signature
+	badTx = tc.poolTxsToSend[0]
+	badTx.FromIdx = "hez:foo:1000"
+	jsonTxBytes, err = json.Marshal(badTx)
+	assert.NoError(t, err)
+	jsonTxReader = bytes.NewReader(jsonTxBytes)
 	err = doBadReq("POST", endpoint, jsonTxReader, 400)
 	assert.NoError(t, err)
 	// Wrong to