copy pasta

Don't split twice, it's expensive

There is a lot of sanitizing that is missing here:

• You should trim the address and amount (+test)
• If the amount is expected to be a float (missing test), the decimal point can be a comma depending on the user locale ? This will conflict with the CSV comma separator
• There is no satoshi rounding nor decimal check, so your function will accept 550.442 as an amount
• There might be a buffer overflow vulnerability, if I set the amount to be close to the max js integer the multiply will overflow.

You should trim the address and amount (+test)

Cashtab rejects any input with extra spaces, this will fail address validation in isValidMultiSendUserInput. Arguably we should change to accept the spaces and trim them, will address in a separate diff.

If the amount is expected to be a float (missing test), the decimal point can be a comma depending on the user locale ? This will conflict with the CSV comma separator

good point + existing issue in multisend validation. Will address and rebase this diff on that fix.

There is no satoshi rounding nor decimal check, so your function will accept 550.442 as an amount

This is handled in isValidMultiSendUserInput

There might be a buffer overflow vulnerability, if I set the amount to be close to the max js integer the multiply will overflow.

Existing issue, will patch and rebase this diff on the patch. Currently "handled" by impossibility of user having more than XEC supply worth of satoshis to spend.