affaan-m/ECC · error

Invalid recipient

Error message

Invalid recipient

What it means

Illustrative Solana/web3 check from the security-review skill: verifyTransaction compares transaction.to against the expected recipient and throws when they differ. It guards against a substituted destination address before any balance or signing steps run.

Source

Thrown at skills/security-review/SKILL.md:376

  try {
    const isValid = verify(
      Buffer.from(message),
      Buffer.from(signature, 'base64'),
      Buffer.from(publicKey, 'base64')
    )
    return isValid
  } catch (error) {
    return false
  }
}
```

#### Transaction Verification
```typescript
async function verifyTransaction(transaction: Transaction) {
  // Verify recipient
  if (transaction.to !== expectedRecipient) {
    throw new Error('Invalid recipient')
  }

  // Verify amount
  if (transaction.amount > maxAmount) {
    throw new Error('Amount exceeds limit')
  }

  // Verify user has sufficient balance
  const balance = await getBalance(transaction.from)
  if (balance < transaction.amount) {
    throw new Error('Insufficient balance')
  }

  return true
}
```

#### Verification Steps

View on GitHub (pinned to d8409a4b08)

Solutions

1. Derive the recipient from a trusted config rather than user input
2. Re-verify the recipient immediately before signing
3. Halt the pipeline and alert on any recipient mismatch

When it happens

Trigger: Thrown at skills/security-review/SKILL.md:376 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of affaan-m/ECC@d8409a4b08 (2026-08-26). Data as JSON: /api/errors/f13053297ea7d80c. Report an issue: GitHub.