Skip to content

[CT-21] Build SignatureVerificationService #553

@mftee

Description

@mftee

Problem

There is no way to verify that a Stellar transaction recorded in the system was actually signed by a specific keypair. An attacker who knows a transaction hash could claim authorship without having signed it.

Proposed Solution

Create a SignatureVerificationService inside contract/module/signature/ that queries Stellar Horizon to verify transaction signers.

Acceptance Criteria

  • verify_signature(tx_hash: &str, expected_public_key: &str) async function queries the Stellar Horizon transaction endpoint for the given tx_hash
  • Returns Ok(true) if the expected_public_key appears in the transaction's signers list
  • Returns Ok(false) if the transaction exists but the public key is not among its signers
  • Returns Err if the transaction is not found on Stellar (404 from Horizon) or if Horizon is unreachable
  • GET /module/signature/verify accepts tx_hash and public_key query parameters and returns { verified: bool, signers: [string] }
  • Unit tests mock the Horizon HTTP response to cover: signer found, signer not found, transaction not found, and Horizon error
  • Implementation files live inside contract/module/signature/

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions