Verify recipient's token address for solana token payments

src/services/solana.ts

@@ -7,6 +7,7 @@ import {
   createAssociatedTokenAccountInstruction,
   ASSOCIATED_TOKEN_PROGRAM_ID
 } from '@solana/spl-token';
+
 import { SolanaPaymentResult, SolanaWalletType, SolanaWalletState } from '../types';
 
 assert(process.env.NEXT_PUBLIC_SOLANA_TOKEN_MINT_ADDRESS, 'SOLANA_TOKEN_MINT_ADDRESS is required');

src/types/index.ts

@@ -69,4 +69,4 @@ export interface LaconicTransferResult {
   success: boolean;
   transactionHash?: string;
   error?: string;
-}
+}

src/utils/solanaVerify.ts

@@ -1,8 +1,8 @@
 import assert from 'assert';
 import BN from 'bn.js';
 
-import { Connection } from '@solana/web3.js';
-import { TOKEN_PROGRAM_ID } from '@solana/spl-token';
+import { Connection, PublicKey } from '@solana/web3.js';
+import { getAssociatedTokenAddressSync, TOKEN_PROGRAM_ID } from '@solana/spl-token';
 
 // Simplified transaction info extraction following reference implementation
 const extractTxInfo = async (connection: Connection, transactionSignature: string): Promise<{ authority: string; amount: string }> => {
@@ -87,6 +87,11 @@ export const verifyUnusedSolanaPayment = async (
       };
     }
 
+    const expectedTokenAccount = getAssociatedTokenAddressSync(
+      new PublicKey(process.env.NEXT_PUBLIC_SOLANA_TOKEN_MINT_ADDRESS!),
+      new PublicKey(process.env.NEXT_PUBLIC_SOLANA_TOKEN_RECIPIENT_ADDRESS!)
+    );
+
     // Verify recipient address by checking the transaction instructions
     let foundValidTransfer = false;
 
@@ -94,9 +99,8 @@ export const verifyUnusedSolanaPayment = async (
       if ('parsed' in instruction && instruction.programId.equals(TOKEN_PROGRAM_ID)) {
         const parsed = instruction.parsed;
         if (parsed.type === 'transferChecked' || parsed.type === 'transfer') {
-          // TODO: Check recipient address
-          // Verify amount
-          if (parsed.info.amount === amount ) {
+          // Verify amount and recipient's associated token address
+          if (parsed.info.amount === amount && parsed.info.destination === expectedTokenAccount.toBase58() ) {
             foundValidTransfer = true;
             break;
           }