reject tickets with more than a single payment

gateway/src/node/client_handling/websocket/connection_handler/authenticated.rs

@@ -102,6 +102,11 @@ pub enum RequestHandlingError {
 
     #[error(transparent)]
     EcashFailure(EcashTicketError),
+
+    #[error(
+        "the received payment contained more than a single ticket. that's currently not supported"
+    )]
+    MultipleTickets,
 }
 
 impl RequestHandlingError {
@@ -413,6 +418,10 @@ where
         // check if the credential hasn't been spent before
         let serial_number = credential.data.encoded_serial_number();
 
+        if credential.data.payment.spend_value != 1 {
+            return Err(RequestHandlingError::MultipleTickets);
+        }
+
         self.check_credential_spending_date(credential.data.spend_date, spend_date.ecash_date())?;
         self.check_bloomfilter(&serial_number).await?;
         self.check_local_db_for_double_spending(&serial_number)

nym-api/nym-api-requests/src/ecash/models.rs

@@ -96,6 +96,11 @@ pub enum EcashTicketVerificationRejection {
 
     #[error("failed to verify the provided ticket")]
     InvalidTicket,
+
+    #[error(
+        "the received payment contained more than a single ticket. that's currently not supported"
+    )]
+    MultipleTickets,
 }
 
 //  All strings are base58 encoded representations of structs

nym-api/src/ecash/api_routes/spending.rs

@@ -37,6 +37,12 @@ pub async fn verify_ticket(
 ) -> crate::ecash::error::Result<Json<EcashTicketVerificationResponse>> {
     let credential_data = &verify_ticket_body.credential;
     let gateway_cosmos_addr = &verify_ticket_body.gateway_cosmos_addr;
+
+    // easy check: is there only a single payment attached?
+    if credential_data.payment.spend_value != 1 {
+        return reject_ticket(EcashTicketVerificationRejection::MultipleTickets);
+    }
+
     let sn = &credential_data.encoded_serial_number();
     let spend_date = credential_data.spend_date;
     let epoch_id = credential_data.epoch_id;