Constrain token payment by auth entries

src/helper/error.ts

@@ -0,0 +1,7 @@
+export const ERROR = {
+  ACCOUNT_NOT_SOURCE:
+    "Transfer contains authorization entry for a different account",
+  FOREIGN_CONTRACT_AUTH:
+    "Transfer contains authorization entry for another contract",
+  SUB_INVOCATIONS: "Transfer contains sub-invocations to another contract",
+};

src/helper/horizon-rpc.ts

@@ -248,7 +248,7 @@ export const submitTransaction = async (
       error: null,
     };
   } catch (e: any) {
-    if (e.response.status === 504) {
+    if (e.response?.status === 504) {
       // in case of 504, keep retrying this tx until submission succeeds or we get a different error
       // https://developers.stellar.org/api/errors/http-status-codes/horizon-specific/timeout
       // https://developers.stellar.org/docs/encyclopedia/error-handling

src/route/index.ts

@@ -25,8 +25,10 @@ import {
   Transaction,
   TransactionBuilder,
   XdrLargeInt,
+  xdr,
 } from "stellar-sdk";
 import { buildTransfer, simulateTx } from "../helper/soroban-rpc";
+import { ERROR } from "../helper/error";
 
 const API_VERSION = "v1";
 
@@ -545,17 +547,37 @@ export async function initApiServer(
             const simulationResponse = (await server.simulateTransaction(
               tx
             )) as SorobanRpc.Api.SimulateTransactionSuccessResponse;
+
             const preparedTransaction = SorobanRpc.assembleTransaction(
               tx,
               simulationResponse
             );
+
+            const built = preparedTransaction.build();
+            const sorobanOp = built
+              .operations[0] as Operation.InvokeHostFunction;
+            const auths = sorobanOp.auth || [];
+
+            for (const auth of auths) {
+              if (
+                auth.credentials().switch() !==
+                xdr.SorobanCredentialsType.sorobanCredentialsSourceAccount()
+              ) {
+                throw new Error(ERROR.ACCOUNT_NOT_SOURCE);
+              }
+
+              if (auth.rootInvocation().subInvocations().length) {
+                throw new Error(ERROR.SUB_INVOCATIONS);
+              }
+            }
+
             const data = {
               simulationResponse,
-              preparedTransaction: preparedTransaction.build().toXDR(),
+              preparedTransaction: built.toXDR(),
             };
             reply.code(200).send(data);
           } catch (error) {
-            reply.code(400).send(JSON.stringify(error));
+            reply.code(400).send(error);
           }
         },
       });