fix(world): check namespace exists before balance transfer [L-03]

.changeset/seven-carpets-develop.md

@@ -0,0 +1,5 @@
+---
+"@latticexyz/world": patch
+---
+
+Namespace balances can no longer be transferred to non-existent namespaces.

packages/world/src/modules/core/implementations/BalanceTransferSystem.sol

@@ -2,6 +2,7 @@
 pragma solidity >=0.8.21;
 
 import { ResourceId, ResourceIdInstance } from "@latticexyz/store/src/ResourceId.sol";
+import { ResourceIds } from "@latticexyz/store/src/codegen/tables/ResourceIds.sol";
 
 import { System } from "../../../System.sol";
 import { revertWithBytes } from "../../../revertWithBytes.sol";
@@ -37,6 +38,9 @@ contract BalanceTransferSystem is System, IWorldErrors {
       revert World_InvalidResourceType(RESOURCE_NAMESPACE, toNamespaceId, toNamespaceId.toString());
     }
 
+    // Require the namespace to exist
+    AccessControl.requireExistence(toNamespaceId);
+
     // Require caller to have access to the namespace
     AccessControl.requireAccess(fromNamespaceId, _msgSender());
 

packages/world/test/WorldBalance.t.sol

@@ -276,6 +276,32 @@ contract WorldBalanceTest is Test, GasReporter {
     assertEq(Balances.get(invalidNamespace), 0);
   }
 
+  function testTransferBalanceToNamespaceRevertResourceNotFound() public {
+    bytes14 toNamespace = "not_registered";
+    ResourceId toNamespaceId = WorldResourceIdLib.encodeNamespace(toNamespace);
+
+    uint256 value = 1 ether;
+
+    // Expect the root namespace to have no balance
+    assertEq(Balances.get(ROOT_NAMESPACE_ID), 0);
+
+    // Send balance to root namespace
+    vm.deal(caller, value);
+    vm.prank(caller);
+    (bool success, bytes memory data) = address(world).call{ value: value }("");
+    assertTrue(success);
+    assertEq(data.length, 0);
+
+    // Expect the root namespace to have the value as balance
+    assertEq(Balances.get(ROOT_NAMESPACE_ID), value);
+
+    // Expect revert when attempting to transfer to a non-existent namespace
+    vm.expectRevert(
+      abi.encodeWithSelector(IWorldErrors.World_ResourceNotFound.selector, toNamespaceId, toNamespaceId.toString())
+    );
+    world.transferBalanceToNamespace(ROOT_NAMESPACE_ID, toNamespaceId, value);
+  }
+
   function testTransferBalanceToAddress() public {
     uint256 value = 1 ether;