feat: prevent refunding to lockup address (#523)

* feat: invalid refund address when using lock address * Update src/components/RefundButton.tsx --------- Co-authored-by: michael1011 <me@michael1011.at>
BoltzExchange · Mar 20, 2024 · 0ea46d8 · 0ea46d8
1 parent 2808f16
commit 0ea46d8
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 2 deletions.
diff --git a/src/components/RefundButton.tsx b/src/components/RefundButton.tsx
@@ -100,6 +100,11 @@ const RefundButton = ({
     const refundAddressChange = (evt: InputEvent, asset: string) => {
         const input = evt.currentTarget as HTMLInputElement;
         const inputValue = input.value.trim();
+        if (inputValue === swap().address) {
+            log.debug("refunds to lockup address are blocked");
+            input.setCustomValidity("lockup address");
+            return false;
+        }
         try {
             getAddress(asset).toOutputScript(
                 inputValue,

diff --git a/tests/components/RefundButton.spec.tsx b/tests/components/RefundButton.spec.tsx
@@ -24,7 +24,6 @@ describe("RefundButton", () => {
         )) as HTMLInputElement;
         expect(input.disabled).not.toBeTruthy();
 
-        // paste a valid address
         fireEvent.input(input, {
             target: {
                 value: "2N4Q5FhU2497BryFfUgbqkAJE87aKHUhXMp",
@@ -37,6 +36,32 @@ describe("RefundButton", () => {
         expect(button.disabled).not.toBeTruthy();
     });
 
+    test("button should be inactive after pasting the lock address", async () => {
+        const lockupAddress = "2N4Q5FhU2497BryFfUgbqkAJE87aKHUhXMp";
+        const [swap] = createSignal({
+            asset: "BTC",
+            address: lockupAddress,
+        });
+        render(() => <RefundButton swap={swap} />, {
+            wrapper: contextWrapper,
+        });
+        const input = (await screen.findByTestId(
+            "refundAddress",
+        )) as HTMLInputElement;
+        expect(input.disabled).not.toBeTruthy();
+
+        fireEvent.input(input, {
+            target: {
+                value: lockupAddress,
+            },
+        });
+
+        const button = (await screen.findByTestId(
+            "refundButton",
+        )) as HTMLButtonElement;
+        expect(button.disabled).toBeTruthy();
+    });
+
     test("button should be inactive after pasting an invalid address", async () => {
         const [swap] = createSignal({
             asset: "BTC",
@@ -53,7 +78,6 @@ describe("RefundButton", () => {
             "refundButton",
         )) as HTMLButtonElement;
 
-        // paste a invalid address
         fireEvent.input(input, {
             target: {
                 value: "XXXQ5FhU2497BryFfUgbqkAJE87aKHUhXMp",