From e3d5b120d279a9b55078b2e262c34cb807ee3dba Mon Sep 17 00:00:00 2001 From: KutluhanETH Date: Mon, 7 Sep 2026 20:40:46 +0000 Subject: [PATCH] fix: authorize escrow refund callers --- app/api/contracts/escrow/refund/route.ts | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/app/api/contracts/escrow/refund/route.ts b/app/api/contracts/escrow/refund/route.ts index 82475d6..74c24bf 100644 --- a/app/api/contracts/escrow/refund/route.ts +++ b/app/api/contracts/escrow/refund/route.ts @@ -95,6 +95,17 @@ export async function POST(req: NextRequest) { return NextResponse.json({ error: "Could not find a profile linked to the given wallet ID" }, { status: 500 }); } + const isAgreementParty = + depositorWallet.id === contractTransaction.depositor_wallet_id || + depositorWallet.id === contractTransaction.beneficiary_wallet_id; + + if (!isAgreementParty) { + return NextResponse.json( + { error: "You are not authorized to refund this escrow agreement" }, + { status: 403 } + ); + } + // Retrieves contract data from Circle's SDK const contractData = await circleContractSdk.getContract({ id: contractTransaction.circle_contract_id