fix(station): make asset ledger canister id immutable after creation

[MRmarioruci]

Change

An asset's ledger_canister_id identifies the token that asset represents. It is resolved from asset metadata at call time by both transfer paths and by account_balance, icrc1_balance_of, transfer_fee and icrc1_fee, so changing it on an existing asset changes which token all of those operations act on.

AssetService::edit() now rejects an edit that repoints or removes it once set. Setting one that was previously absent is still allowed, since an asset without a ledger cannot transact.

To point an asset at a different ledger, detach it from its accounts, remove it, and create a new one. That is the correct handling regardless: balances do not follow the pointer, so an in-place repoint would leave the station reporting holdings that live on the previous ledger.

Tests

• repointing the ledger canister id is rejected and the stored value is unchanged
• removing the key is rejected
• unrelated metadata edits still succeed

cargo test -p station --lib passes (392). Clippy and cargo fmt clean.

Note

AssetService::create takes an optional with_asset_id, which is not reachable from AddAssetOperationInput and is used only by init and migrations. Worth keeping it that way.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 553a402.

Security Overview

• 🔎 Scanned files: 2 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/5243341a-e7d7-47de-848a-f52264761c93?scanId=21da2937-b5ae-4c28-8e94-15a83df0e620&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type

Relevant files

Enhancement

► core/station/impl/src/errors/asset.rs     Add ImmutableLedgerCanisterId error variant ► core/station/impl/src/services/asset.rs     Prevent changing ledger canister id after asset creation, add validation against re-pointing ledger     Preserve original ledger canister id when edit attempts to change it ► core/station/impl/src/services/asset.rs     Add tests: cannot repoint ledger canister id, cannot remove ledger canister id, allow other metadata changes

[Copilot]

Pull request overview

This PR makes an asset’s ledger_canister_id effectively immutable after the asset has been created, preventing previously-approved transfers (and balance/fee lookups) from being redirected to a different ledger by later metadata edits.

Changes:

• In AssetService::edit(), capture the pre-edit ledger_canister_id and reject edits that remove or change it once it has been set.
• Introduce AssetError::ImmutableLedgerCanisterId for the new rejection case.
• Add unit tests covering repointing/removal rejection and allowing unrelated metadata edits.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
core/station/impl/src/services/asset.rs	Enforces immutability of ledger_canister_id during asset edits and adds regression tests.
core/station/impl/src/errors/asset.rs	Adds a dedicated error variant for attempted ledger canister id changes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.