stack_orchestrator/deploy/webapp/util.py

@@ -882,6 +882,21 @@ def confirm_auction(laconic: LaconicRegistryClient, record, deployer_lrn, paymen
     auction_id = record.attributes.auction
     auction = laconic.get_auction(auction_id)
 
+    # Fetch auction record for given auction
+    auction_records_by_id = laconic.app_deployment_auctions({"auction": auction_id})
+    if len(auction_records_by_id) == 0:
+        logger.log(f"{record.id}: unable to locate record for auction {auction_id}")
+        return False
+
+    # Cross check app against application in the auction record
+    requested_app = record.attributes.application
+    auction_app = auction_records_by_id[0].attributes.application
+    if requested_app != auction_app:
+        logger.log(
+            f"{record.id}: requested application {requested_app} does not match application from auction record {auction_app}"
+        )
+        return False
+
     if not auction:
         logger.log(f"{record.id}: unable to locate auction {auction_id}")
         return False