graphprotocol / indexer-rs / 21485319913

68%

push

github

fix(service): add PayerCheck to validate V2 receipt payer field (#915)

Add validation to ensure V2 receipt's claimed `payer` field matches the
on-chain recovered sender (from signer → payer escrow mapping).

Without this check, an attacker could submit receipts with a mismatched
payer field that would pass balance checks but be stored with the wrong
payer, causing receipts to never be aggregated by tap-agent (which
queries by the recovered sender).

This prevents:
- Database bloat from orphaned receipts
- Potential DoS via flooding DB with invalid receipts

Similar to TRST-H-1 fix for service_provider validation.

92 of 95 new or added lines in 2 files covered. (96.84%)

10388 of 15174 relevant lines covered (68.46%)

81.66 hits per line