From 7216185044d78e8de5e6ca7a4d4971fb393f3513 Mon Sep 17 00:00:00 2001 From: memosr Date: Fri, 5 Jun 2026 00:04:37 +0300 Subject: [PATCH] fix: verify caller is beneficiary before processing refund --- app/api/contracts/escrow/refund/route.ts | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/app/api/contracts/escrow/refund/route.ts b/app/api/contracts/escrow/refund/route.ts index 82475d6..a820ebd 100644 --- a/app/api/contracts/escrow/refund/route.ts +++ b/app/api/contracts/escrow/refund/route.ts @@ -95,6 +95,17 @@ export async function POST(req: NextRequest) { return NextResponse.json({ error: "Could not find a profile linked to the given wallet ID" }, { status: 500 }); } + // Verify the caller is the beneficiary of this agreement + const isBeneficiary = + contractTransaction.beneficiary_wallet_id === depositorWallet.id; + + if (!isBeneficiary) { + return NextResponse.json( + { error: "Forbidden: Only the beneficiary can initiate a refund" }, + { status: 403 } + ); + } + // Retrieves contract data from Circle's SDK const contractData = await circleContractSdk.getContract({ id: contractTransaction.circle_contract_id