feat: Ensure claimer is owner of the note in claim contract

noir-projects/noir-contracts/contracts/claim_contract/src/main.nr

@@ -35,12 +35,13 @@ contract Claim {
     }
 
     #[aztec(private)]
-    fn claim(proof_note: ValueNote) {
-        // 1) Check that the note corresponds to the target contract
+    fn claim(proof_note: ValueNote, recipient: AztecAddress) {
+        // 1) Check that the note corresponds to the target contract and belongs to the sender
         let target_address = storage.target_contract.read_private();
         assert(
             target_address == proof_note.header.contract_address, "Note does not correspond to the target contract"
         );
+        assert_eq(proof_note.owner, context.msg_sender(), "Note does not belong to the sender");
 
         // 2) Prove that the note hash exists in the note hash tree
         prove_note_inclusion(proof_note, context);
@@ -53,6 +54,6 @@ contract Claim {
 
         // 4) Finally we mint the reward token to the sender of the transaction
         let reward_token = Token::at(storage.reward_token.read_private());
-        reward_token.mint_public(&mut context, context.msg_sender(), proof_note.value);
+        reward_token.mint_public(&mut context, recipient, proof_note.value);
     }
 }

yarn-project/end-to-end/src/e2e_crowdfunding_and_claim.test.ts

@@ -236,7 +236,11 @@ describe('e2e_crowdfunding_and_claim', () => {
 
     // 3) We claim the reward token via the Claim contract
     {
-      await claimContract.withWallet(donorWallets[0]).methods.claim(valueNote).send().wait();
+      await claimContract
+        .withWallet(donorWallets[0])
+        .methods.claim(valueNote, donorWallets[0].getAddress())
+        .send()
+        .wait();
     }
 
     // Since the RWT is minted 1:1 with the DNT, the balance of the reward token should be equal to the donation amount
@@ -261,7 +265,9 @@ describe('e2e_crowdfunding_and_claim', () => {
 
   it('cannot claim twice', async () => {
     // The first claim was executed in the previous test
-    await expect(claimContract.withWallet(donorWallets[0]).methods.claim(valueNote).send().wait()).rejects.toThrow();
+    await expect(
+      claimContract.withWallet(donorWallets[0]).methods.claim(valueNote, donorWallets[0].getAddress()).send().wait(),
+    ).rejects.toThrow();
   });
 
   it('cannot claim with a non-existent note', async () => {
@@ -270,7 +276,11 @@ describe('e2e_crowdfunding_and_claim', () => {
     nonExistentNote.randomness = Fr.random();
 
     await expect(
-      claimContract.withWallet(donorWallets[0]).methods.claim(nonExistentNote).send().wait(),
+      claimContract
+        .withWallet(donorWallets[0])
+        .methods.claim(nonExistentNote, donorWallets[0].getAddress())
+        .send()
+        .wait(),
     ).rejects.toThrow();
   });
 
@@ -293,7 +303,9 @@ describe('e2e_crowdfunding_and_claim', () => {
     await inclusionsProofsContract.methods.test_note_inclusion(owner, false, 0n, true).send().wait();
 
     // 4) Finally, check that the claim process fails
-    await expect(claimContract.withWallet(donorWallets[0]).methods.claim(note).send().wait()).rejects.toThrow();
+    await expect(
+      claimContract.withWallet(donorWallets[0]).methods.claim(note, donorWallets[0].getAddress()).send().wait(),
+    ).rejects.toThrow();
   });
 
   it('cannot donate after a deadline', async () => {