From 0219c01b33f2e24da7305d42fbfe93d237dfa465 Mon Sep 17 00:00:00 2001
From: yinyiqian1 <yqian@ripple.com>
Date: Tue, 22 Sep 2026 17:02:59 +0000
Subject: [PATCH] fix: Check zero object id in SponsorshipTransfer preflight
 (#8254)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .../sponsor/SponsorshipTransfer.cpp           |  8 ++++++++
 src/test/app/Sponsor_test.cpp                 | 19 +++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/src/libxrpl/tx/transactors/sponsor/SponsorshipTransfer.cpp b/src/libxrpl/tx/transactors/sponsor/SponsorshipTransfer.cpp
index c3131714f8..642a415be7 100644
--- a/src/libxrpl/tx/transactors/sponsor/SponsorshipTransfer.cpp
+++ b/src/libxrpl/tx/transactors/sponsor/SponsorshipTransfer.cpp
@@ -2,6 +2,7 @@
 
 #include <xrpl/basics/Log.h>
 #include <xrpl/basics/base_uint.h>
+#include <xrpl/beast/utility/Zero.h>
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/core/ServiceRegistry.h>
 #include <xrpl/ledger/ApplyView.h>
@@ -206,6 +207,13 @@ SponsorshipTransfer::preflight(PreflightContext const& ctx)
         return temMALFORMED;
     }
 
+    if (auto const objectID = ctx.tx[~sfObjectID];
+        ctx.rules.enabled(fixCleanup3_5_0) && objectID && *objectID == beast::kZero)
+    {
+        JLOG(ctx.j.debug()) << "preflight: sfObjectID must not be zero";
+        return temMALFORMED;
+    }
+
     return tesSUCCESS;
 }
 
diff --git a/src/test/app/Sponsor_test.cpp b/src/test/app/Sponsor_test.cpp
index 71d968014f..22b5d0bcdc 100644
--- a/src/test/app/Sponsor_test.cpp
+++ b/src/test/app/Sponsor_test.cpp
@@ -1163,6 +1163,25 @@ public:
                     sponsor::SponseeAcc(alice),
                     Ter(temMALFORMED));
             }
+
+            // Post-fixCleanup3_5_0, a zero ObjectID is malformed.
+            // Pre-fixCleanup3_5_0 path is unreachable so it is not testable.
+            if (features[fixCleanup3_5_0])
+            {
+                uint256 const zeroObjectID{};
+
+                env(sponsor::transfer(alice, tfSponsorshipEnd, zeroObjectID), Ter(temMALFORMED));
+
+                env(sponsor::transfer(alice, tfSponsorshipCreate, zeroObjectID),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor),
+                    Ter(temMALFORMED));
+
+                env(sponsor::transfer(alice, tfSponsorshipReassign, zeroObjectID),
+                    sponsor::As(sponsor, spfSponsorReserve),
+                    Sig(sfSponsorSignature, sponsor),
+                    Ter(temMALFORMED));
+            }
         }
 
         {