Tighten payment tx validation before submit

frontend/components/account/AccountCenter.tsx

@@ -1356,8 +1356,8 @@ export function AccountCenter() {
                               }
                               disabled={
                                 paymentBusy ||
-                                (txValidation.checked &&
-                                  !txValidation.valid)
+                                !(txValidation.checked &&
+                                  txValidation.valid === true)
                               }
                               className="w-full rounded-xl border border-emerald-700 bg-emerald-600 px-3 py-2 text-xs font-bold text-white transition-all hover:bg-emerald-700 disabled:opacity-50"
                             >

frontend/components/account/__tests__/paymentSecurity.test.ts

@@ -71,6 +71,23 @@ export function runTests() {
       paymentFlowSource.includes("assertExpectedPaymentReceiver"),
     "AccountCenter must validate backend-returned manual payment receiver before displaying it",
   );
+  assert(
+    /!\(\s*txValidation\.checked\s*&&\s*txValidation\.valid === true\s*\)/.test(
+      accountCenterSource,
+    ),
+    "manual payment submit button must require checked && valid === true",
+  );
+  assert(
+    paymentFlowSource.includes("validateTxHash") &&
+      paymentFlowSource.includes("/validate"),
+    "manual payment flow must validate tx hashes with the backend before submission",
+  );
+  assert(
+    paymentFlowSource.includes("await waitForReceipt(txHashNorm, eth)") &&
+      paymentFlowSource.indexOf("await waitForReceipt(txHashNorm, eth)") <
+        paymentFlowSource.indexOf("const submitRes = await fetch(`/api/payments/intents/${intentId}/submit`"),
+    "wallet payment flow must wait for the payment tx receipt before submitting tx hash to the backend",
+  );
   assert(
     accountCenterSource.includes("EXPECTED_PAYMENT_RECEIVER_ADDRESS") ||
       hookSource.includes("EXPECTED_PAYMENT_RECEIVER_ADDRESS") ||

frontend/components/account/usePaymentFlow.ts

@@ -549,6 +549,8 @@ export function usePaymentFlow(params: UsePaymentFlowParams) {
       const txHashNorm = String(txHash || "").toLowerCase();
       setLastTxHash(txHashNorm);
       setLastPaymentStartedAt(Date.now());
+      setPaymentInfo(`交易已提交: ${shortAddress(txHashNorm)}，等待链上回执...`);
+      await waitForReceipt(txHashNorm, eth);
 
       const submitRes = await fetch(`/api/payments/intents/${intentId}/submit`, {
         method: "POST", headers: authHeaders, body: JSON.stringify({ tx_hash: txHashNorm, from_address: payingWallet }),