[#961] Add contract address validation to indexer endpoints

package.json

@@ -1,6 +1,6 @@
 {
   "name": "plotlink",
-  "version": "0.1.49",
+  "version": "0.1.50",
   "private": true,
   "workspaces": [
     "packages/*"

src/app/api/index/donation/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 import { type Hex, decodeEventLog, encodeEventTopics } from "viem";
 import { publicClient, getReceiptWithRetry } from "../../../../../lib/rpc";
 import { createServerClient } from "../../../../../lib/supabase";
 import { validateRecentTx } from "../../../../../lib/index-auth";
 import {
@@ -43,6 +43,10 @@
     return error("Donation event not found in receipt");
   }
 
+  if (donationLog.address.toLowerCase() !== STORY_FACTORY.toLowerCase()) {
+    return error("Event not from StoryFactory", 400);
+  }
+
   // 3. Decode event
   let decoded;
   try {

src/app/api/index/plot/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 import { type Hex, decodeEventLog, encodeEventTopics } from "viem";
 import { publicClient, getReceiptWithRetry } from "../../../../../lib/rpc";
 import { createServerClient } from "../../../../../lib/supabase";
 import { validateRecentTx } from "../../../../../lib/index-auth";
 import {
@@ -49,6 +49,10 @@
     return error("PlotChained event not found in receipt");
   }
 
+  if (plotChainedLog.address.toLowerCase() !== STORY_FACTORY.toLowerCase()) {
+    return error("Event not from StoryFactory", 400);
+  }
+
   // 3. Decode event
   let decoded;
   try {

src/app/api/index/storyline/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 import { type Hex, decodeEventLog, encodeEventTopics } from "viem";
 import { publicClient, getReceiptWithRetry } from "../../../../../lib/rpc";
 import { createServerClient } from "../../../../../lib/supabase";
 import { validateRecentTx } from "../../../../../lib/index-auth";
 import {
@@ -56,6 +56,10 @@
     return error("StorylineCreated event not found in receipt");
   }
 
+  if (storylineLog.address.toLowerCase() !== STORY_FACTORY.toLowerCase()) {
+    return error("Event not from StoryFactory", 400);
+  }
+
   // 3. Decode event
   let decoded;
   try {

src/app/api/index/trade/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 import { type Hex, decodeEventLog, formatUnits } from "viem";
 import { publicClient, getReceiptWithRetry } from "../../../../../lib/rpc";
 import { createServerClient } from "../../../../../lib/supabase";
 import { mcv2BondEventAbi } from "../../../../../lib/contracts/abi";
 import { MCV2_BOND, ZAP_PLOTLINK } from "../../../../../lib/contracts/constants";
@@ -55,6 +55,14 @@
     }
   }
 
+  // Fail fast if no logs from MCV2_BOND in this receipt
+  const hasBondLog = receipt.logs.some(
+    (log) => log.address.toLowerCase() === MCV2_BOND.toLowerCase()
+  );
+  if (!hasBondLog) {
+    return error("Event not from MCV2_Bond", 400);
+  }
+
   // Fetch current PLOT/USD rate for this trade batch
   const reserveUsdRate = await getReserveUsdRate();