From aaaefdb94eb1831468bc3f9bf518ea01255bcfdb Mon Sep 17 00:00:00 2001
From: leanworld7-netizen <leanworld7-netizen@users.noreply.github.com>
Date: Sat, 1 Aug 2026 00:11:18 +0000
Subject: [PATCH] fix #48: add provider auth to apply_liveness_slash

apply_liveness_slash was callable by anyone, allowing griefing attacks on stream buffer balances. Added flow.provider.require_auth() to ensure only the stream provider can trigger liveness slashes.
---
 contracts/utility_contracts/src/lib.rs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/contracts/utility_contracts/src/lib.rs b/contracts/utility_contracts/src/lib.rs
index d8ebf43..5808c64 100644
--- a/contracts/utility_contracts/src/lib.rs
+++ b/contracts/utility_contracts/src/lib.rs
@@ -8272,6 +8272,9 @@ impl UtilityContract {
         meter_id: u64,
         stale_threshold_ledgers: u32,
     ) -> i128 {
+        // Fix #48: Require provider auth before slashing stream buffer
+        let flow = get_continuous_flow_or_panic(&env, stream_id);
+        flow.provider.require_auth();
         crate::enterprise::liveness_check_and_slash(
             &env,
             stream_id,