From 0ea46d8cd315099b95f6b9b45d792405ee0bb135 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?dni=20=E2=9A=A1?= <office@dnilabs.com>
Date: Wed, 20 Mar 2024 18:30:23 +0100
Subject: [PATCH] feat: prevent refunding to lockup address (#523)

* feat: invalid refund address when using lock address

* Update src/components/RefundButton.tsx

---------

Co-authored-by: michael1011 <me@michael1011.at>
---
 src/components/RefundButton.tsx        |  5 +++++
 tests/components/RefundButton.spec.tsx | 28 ++++++++++++++++++++++++--
 2 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/src/components/RefundButton.tsx b/src/components/RefundButton.tsx
index 09d8c0ed..fade43e7 100644
--- a/src/components/RefundButton.tsx
+++ b/src/components/RefundButton.tsx
@@ -100,6 +100,11 @@ const RefundButton = ({
     const refundAddressChange = (evt: InputEvent, asset: string) => {
         const input = evt.currentTarget as HTMLInputElement;
         const inputValue = input.value.trim();
+        if (inputValue === swap().address) {
+            log.debug("refunds to lockup address are blocked");
+            input.setCustomValidity("lockup address");
+            return false;
+        }
         try {
             getAddress(asset).toOutputScript(
                 inputValue,
diff --git a/tests/components/RefundButton.spec.tsx b/tests/components/RefundButton.spec.tsx
index 0504859b..7bcaa13a 100644
--- a/tests/components/RefundButton.spec.tsx
+++ b/tests/components/RefundButton.spec.tsx
@@ -24,7 +24,6 @@ describe("RefundButton", () => {
         )) as HTMLInputElement;
         expect(input.disabled).not.toBeTruthy();
 
-        // paste a valid address
         fireEvent.input(input, {
             target: {
                 value: "2N4Q5FhU2497BryFfUgbqkAJE87aKHUhXMp",
@@ -37,6 +36,32 @@ describe("RefundButton", () => {
         expect(button.disabled).not.toBeTruthy();
     });
 
+    test("button should be inactive after pasting the lock address", async () => {
+        const lockupAddress = "2N4Q5FhU2497BryFfUgbqkAJE87aKHUhXMp";
+        const [swap] = createSignal({
+            asset: "BTC",
+            address: lockupAddress,
+        });
+        render(() => <RefundButton swap={swap} />, {
+            wrapper: contextWrapper,
+        });
+        const input = (await screen.findByTestId(
+            "refundAddress",
+        )) as HTMLInputElement;
+        expect(input.disabled).not.toBeTruthy();
+
+        fireEvent.input(input, {
+            target: {
+                value: lockupAddress,
+            },
+        });
+
+        const button = (await screen.findByTestId(
+            "refundButton",
+        )) as HTMLButtonElement;
+        expect(button.disabled).toBeTruthy();
+    });
+
     test("button should be inactive after pasting an invalid address", async () => {
         const [swap] = createSignal({
             asset: "BTC",
@@ -53,7 +78,6 @@ describe("RefundButton", () => {
             "refundButton",
         )) as HTMLButtonElement;
 
-        // paste a invalid address
         fireEvent.input(input, {
             target: {
                 value: "XXXQ5FhU2497BryFfUgbqkAJE87aKHUhXMp",