fix(managed-wallet): enforce warn<=block config and match bid owner

Address review: validate WARN_MULTIPLIER <= BLOCK_MULTIPLIER in the config schema so a
misconfiguration can't silently disable the warn tier, and include the deployment owner in the
accepted-bid match so a lease referencing a foreign owner is rejected.

Author: baktun14

apps/api/src/billing/config/env.config.ts

@@ -5,62 +5,67 @@ import { AUDITOR } from "@src/deployment/config/provider.config";
 
 dotenv.config({ path: "env/.env.funding-wallet-index" });
 
-export const envSchema = z.object({
-  OLD_MASTER_WALLET_MNEMONIC: z.string().optional(),
-  FUNDING_WALLET_MNEMONIC: z.string().optional(),
-  FUNDING_WALLET_MNEMONIC_V1: z.string().optional(),
-  FUNDING_WALLET_MNEMONIC_V2: z.string().optional(),
-  DERIVATION_WALLET_MNEMONIC: z.string().optional(),
-  DERIVATION_WALLET_MNEMONIC_V1: z.string().optional(),
-  DERIVATION_WALLET_MNEMONIC_V2: z.string().optional(),
-  NETWORK: z.enum(["mainnet", "testnet", "sandbox"]),
-  RPC_NODE_ENDPOINT: z.string(),
-  TRIAL_ALLOWANCE_EXPIRATION_DAYS: z.number({ coerce: true }).default(30),
-  TRIAL_DEPLOYMENT_ALLOWANCE_AMOUNT: z.number({ coerce: true }),
-  TRIAL_FEES_ALLOWANCE_AMOUNT: z.number({ coerce: true }),
-  TRIAL_DEPLOYMENT_CLEANUP_HOURS: z.number({ coerce: true }).default(24),
-  DEPLOYMENT_GRANT_DENOM: z.enum(["uakt", "uact"]),
-  GAS_SAFETY_MULTIPLIER: z.number({ coerce: true }).default(1.8),
-  AVERAGE_GAS_PRICE: z.number({ coerce: true }).default(0.025),
-  FEE_ALLOWANCE_REFILL_THRESHOLD: z.number({ coerce: true }),
-  FEE_ALLOWANCE_REFILL_AMOUNT: z.number({ coerce: true }),
-  DEPLOYMENT_ALLOWANCE_REFILL_AMOUNT: z.number({ coerce: true }),
-  ALLOWANCE_REFILL_BATCH_SIZE: z.number({ coerce: true }).default(10),
-  WALLET_BATCHING_INTERVAL_MS: z.number().optional().default(1000),
-  STRIPE_SECRET_KEY: z.string(),
-  STRIPE_PRODUCT_ID: z.string(),
-  STRIPE_WEBHOOK_SECRET: z.string(),
-  STRIPE_ENABLE_COUPONS: z.enum(["true", "false"]).default("false"),
-  CONSOLE_WEB_PAYMENT_LINK: z.string(),
-  MANAGED_WALLET_LEASE_ALLOWED_AUDITORS: z
-    .string()
-    .default(AUDITOR)
-    .transform(val => (val ? val.split(",").map(addr => addr.trim()) : [])),
-  MANAGED_WALLET_TRIAL_MIN_TOP_UP_AMOUNT: z.number({ coerce: true }).min(20).default(100),
-  MANAGED_WALLET_TRIAL_BLOCKED_GPU_MODELS: z
-    .string()
-    .default("nvidia/b300,nvidia/b200,nvidia/h200,nvidia/h100,nvidia/pro6000se,nvidia/pro6000we,nvidia/a100,nvidia/rtx5090,nvidia/rtx4090,nvidia/rtx3090")
-    .transform(val =>
-      val
-        ? val
-            .split(",")
-            .map(entry => entry.trim().toLowerCase())
-            .filter(Boolean)
-        : []
-    )
-    .refine(entries => entries.every(entry => /^[a-z0-9._-]+\/[a-z0-9._-]+$/.test(entry)), {
-      message: "MANAGED_WALLET_TRIAL_BLOCKED_GPU_MODELS entries must be in 'vendor/model' format"
-    }),
-  MASTER_WALLET_TARGET_ACT_BALANCE: z.number({ coerce: true }).default(10_000_000_000),
-  MANAGED_WALLET_BID_PRICE_GUARD_ENABLED: z
-    .enum(["true", "false"])
-    .default("true")
-    .transform(val => val === "true"),
-  MANAGED_WALLET_BID_PRICE_WARN_MULTIPLIER: z.number({ coerce: true }).positive().default(5),
-  MANAGED_WALLET_BID_PRICE_BLOCK_MULTIPLIER: z.number({ coerce: true }).positive().default(10),
-  MANAGED_WALLET_BID_PRICE_ABSOLUTE_MAX_UAKT: z.number({ coerce: true }).positive().optional(),
-  MANAGED_WALLET_BID_PRICE_ABSOLUTE_MAX_UACT: z.number({ coerce: true }).positive().optional(),
-  TX_SIGNER_BASE_URL: z.string()
-});
+export const envSchema = z
+  .object({
+    OLD_MASTER_WALLET_MNEMONIC: z.string().optional(),
+    FUNDING_WALLET_MNEMONIC: z.string().optional(),
+    FUNDING_WALLET_MNEMONIC_V1: z.string().optional(),
+    FUNDING_WALLET_MNEMONIC_V2: z.string().optional(),
+    DERIVATION_WALLET_MNEMONIC: z.string().optional(),
+    DERIVATION_WALLET_MNEMONIC_V1: z.string().optional(),
+    DERIVATION_WALLET_MNEMONIC_V2: z.string().optional(),
+    NETWORK: z.enum(["mainnet", "testnet", "sandbox"]),
+    RPC_NODE_ENDPOINT: z.string(),
+    TRIAL_ALLOWANCE_EXPIRATION_DAYS: z.number({ coerce: true }).default(30),
+    TRIAL_DEPLOYMENT_ALLOWANCE_AMOUNT: z.number({ coerce: true }),
+    TRIAL_FEES_ALLOWANCE_AMOUNT: z.number({ coerce: true }),
+    TRIAL_DEPLOYMENT_CLEANUP_HOURS: z.number({ coerce: true }).default(24),
+    DEPLOYMENT_GRANT_DENOM: z.enum(["uakt", "uact"]),
+    GAS_SAFETY_MULTIPLIER: z.number({ coerce: true }).default(1.8),
+    AVERAGE_GAS_PRICE: z.number({ coerce: true }).default(0.025),
+    FEE_ALLOWANCE_REFILL_THRESHOLD: z.number({ coerce: true }),
+    FEE_ALLOWANCE_REFILL_AMOUNT: z.number({ coerce: true }),
+    DEPLOYMENT_ALLOWANCE_REFILL_AMOUNT: z.number({ coerce: true }),
+    ALLOWANCE_REFILL_BATCH_SIZE: z.number({ coerce: true }).default(10),
+    WALLET_BATCHING_INTERVAL_MS: z.number().optional().default(1000),
+    STRIPE_SECRET_KEY: z.string(),
+    STRIPE_PRODUCT_ID: z.string(),
+    STRIPE_WEBHOOK_SECRET: z.string(),
+    STRIPE_ENABLE_COUPONS: z.enum(["true", "false"]).default("false"),
+    CONSOLE_WEB_PAYMENT_LINK: z.string(),
+    MANAGED_WALLET_LEASE_ALLOWED_AUDITORS: z
+      .string()
+      .default(AUDITOR)
+      .transform(val => (val ? val.split(",").map(addr => addr.trim()) : [])),
+    MANAGED_WALLET_TRIAL_MIN_TOP_UP_AMOUNT: z.number({ coerce: true }).min(20).default(100),
+    MANAGED_WALLET_TRIAL_BLOCKED_GPU_MODELS: z
+      .string()
+      .default("nvidia/b300,nvidia/b200,nvidia/h200,nvidia/h100,nvidia/pro6000se,nvidia/pro6000we,nvidia/a100,nvidia/rtx5090,nvidia/rtx4090,nvidia/rtx3090")
+      .transform(val =>
+        val
+          ? val
+              .split(",")
+              .map(entry => entry.trim().toLowerCase())
+              .filter(Boolean)
+          : []
+      )
+      .refine(entries => entries.every(entry => /^[a-z0-9._-]+\/[a-z0-9._-]+$/.test(entry)), {
+        message: "MANAGED_WALLET_TRIAL_BLOCKED_GPU_MODELS entries must be in 'vendor/model' format"
+      }),
+    MASTER_WALLET_TARGET_ACT_BALANCE: z.number({ coerce: true }).default(10_000_000_000),
+    MANAGED_WALLET_BID_PRICE_GUARD_ENABLED: z
+      .enum(["true", "false"])
+      .default("true")
+      .transform(val => val === "true"),
+    MANAGED_WALLET_BID_PRICE_WARN_MULTIPLIER: z.number({ coerce: true }).positive().default(5),
+    MANAGED_WALLET_BID_PRICE_BLOCK_MULTIPLIER: z.number({ coerce: true }).positive().default(10),
+    MANAGED_WALLET_BID_PRICE_ABSOLUTE_MAX_UAKT: z.number({ coerce: true }).positive().optional(),
+    MANAGED_WALLET_BID_PRICE_ABSOLUTE_MAX_UACT: z.number({ coerce: true }).positive().optional(),
+    TX_SIGNER_BASE_URL: z.string()
+  })
+  .refine(config => config.MANAGED_WALLET_BID_PRICE_WARN_MULTIPLIER <= config.MANAGED_WALLET_BID_PRICE_BLOCK_MULTIPLIER, {
+    message: "MANAGED_WALLET_BID_PRICE_WARN_MULTIPLIER must be less than or equal to MANAGED_WALLET_BID_PRICE_BLOCK_MULTIPLIER",
+    path: ["MANAGED_WALLET_BID_PRICE_WARN_MULTIPLIER"]
+  });
 
 export type BillingConfig = z.infer<typeof envSchema>;

apps/api/src/billing/lib/lease-messages/lease-messages.ts

@@ -50,7 +50,12 @@ export async function resolveLeaseBids(messages: EncodeObject[], owner: string,
   return leaseBidIds.map(bidId => {
     const orderBids = bidsByDseq.get(bidId.dseq.toString()) ?? [];
     const accepted = orderBids.find(
-      b => b.bid.id.gseq === bidId.gseq && b.bid.id.oseq === bidId.oseq && b.bid.id.provider === bidId.provider && b.bid.id.bseq === bidId.bseq
+      b =>
+        b.bid.id.owner === bidId.owner &&
+        b.bid.id.gseq === bidId.gseq &&
+        b.bid.id.oseq === bidId.oseq &&
+        b.bid.id.provider === bidId.provider &&
+        b.bid.id.bseq === bidId.bseq
     );
     assert(
       accepted,

apps/api/src/billing/services/lease-bid-price-guard/lease-bid-price-guard.service.spec.ts

@@ -14,6 +14,7 @@ import { mockConfigService } from "@test/mocks/config-service.mock";
 import { createBid } from "@test/seeders/bid.seeder";
 import { createUserWallet } from "@test/seeders/user-wallet.seeder";
 
+const OWNER = "akash1owner";
 const ACCEPTED = { dseq: "111", gseq: 1, oseq: 1, bseq: 1, provider: "akash1prov" };
 
 describe(LeaseBidPriceGuardService.name, () => {
@@ -125,6 +126,17 @@ describe(LeaseBidPriceGuardService.name, () => {
     });
   });
 
+  it("rejects with 403 when the bid owner does not match the lease message owner", async () => {
+    const foreignBid = createBid({ owner: "akash1someoneelse", ...ACCEPTED });
+    foreignBid.bid.price = { denom: "uakt", amount: "100" };
+    const { service } = setup({ bids: [foreignBid] });
+
+    await expect(service.validateLeaseBidPrices([leaseMessage(ACCEPTED)], createUserWallet())).rejects.toMatchObject({
+      status: 403,
+      message: expect.stringContaining("Referenced lease bid not found")
+    });
+  });
+
   it("evaluates each order independently and blocks the offending one", async () => {
     const cheapOrder = { dseq: "111", gseq: 1, oseq: 1, bseq: 1, provider: "akash1prov" };
     const absurdOrder = { dseq: "111", gseq: 2, oseq: 1, bseq: 1, provider: "akash1prov" };
@@ -144,15 +156,15 @@ describe(LeaseBidPriceGuardService.name, () => {
   });
 
   function pricedBid(ids: { dseq: string; gseq: number; oseq: number; bseq: number; provider: string }, amount: number, denom = "uakt"): Bid {
-    const bid = createBid(ids);
+    const bid = createBid({ owner: OWNER, ...ids });
     bid.bid.price = { denom, amount: amount.toString() };
     return bid;
   }
 
   function leaseMessage(bidId: { dseq: string; gseq: number; oseq: number; bseq: number; provider: string }): EncodeObject {
     return {
       typeUrl: `/${MsgCreateLease.$type}`,
-      value: MsgCreateLease.fromPartial({ bidId: { owner: "akash1owner", ...bidId } })
+      value: MsgCreateLease.fromPartial({ bidId: { owner: OWNER, ...bidId } })
     };
   }
 

apps/api/src/billing/services/trial-validation/trial-validation.service.spec.ts

@@ -175,7 +175,7 @@ describe(TrialValidationService.name, () => {
     model: string,
     ids: { dseq: string; gseq: number; oseq: number; bseq: number; provider: string }
   ): ReturnType<typeof createBid> {
-    const bid = createBid({ dseq: ids.dseq, gseq: ids.gseq, oseq: ids.oseq, bseq: ids.bseq, provider: ids.provider });
+    const bid = createBid({ owner: "akash1owner", dseq: ids.dseq, gseq: ids.gseq, oseq: ids.oseq, bseq: ids.bseq, provider: ids.provider });
     bid.bid.resources_offer[0].resources.gpu = {
       units: { val: "1" },
       attributes: [{ key: `vendor/${vendor}/model/${model}`, value: "true" }]