From bf8f54cab9631eaeac576d988bc5fc71908411ea Mon Sep 17 00:00:00 2001
From: Abdullah Azmi <greatnessings@gmail.com>
Date: Mon, 19 Oct 2026 04:19:23 +0000
Subject: [PATCH 1/3] feat(frontend): prevent self-streaming when recipient
 matches sender wallet in StreamCreationWizard

---
 frontend/src/__tests__/components.test.tsx    | 13 +++++++++
 .../stream-creation/RecipientStep.tsx         | 29 ++++++++++++++++---
 .../stream-creation/StreamCreationWizard.tsx  |  6 +++-
 .../lib/__tests__/stream-validation.test.ts   | 22 ++++++++++++++
 frontend/src/lib/stream-validation.ts         | 17 +++++++++--
 5 files changed, 80 insertions(+), 7 deletions(-)

diff --git a/frontend/src/__tests__/components.test.tsx b/frontend/src/__tests__/components.test.tsx
index d8a4a57c..870ee22d 100644
--- a/frontend/src/__tests__/components.test.tsx
+++ b/frontend/src/__tests__/components.test.tsx
@@ -146,6 +146,19 @@ describe('RecipientStep', () => {
     fireEvent.blur(screen.getByRole('textbox'));
     expect(onChange).toHaveBeenCalledWith(VALID_KEY);
   });
+
+  it('shows immediate inline error when recipient equals connected sender wallet address', () => {
+    render(
+      <RecipientStep
+        value={`  ${VALID_KEY.toLowerCase()}  `}
+        onChange={vi.fn()}
+        senderAddress={VALID_KEY}
+      />,
+    );
+    expect(screen.getByRole('alert')).toHaveTextContent(
+      'Recipient address cannot be the same as your connected sender wallet',
+    );
+  });
 });
 
 // ─── AmountStep ──────────────────────────────────────────────────────────────
diff --git a/frontend/src/components/stream-creation/RecipientStep.tsx b/frontend/src/components/stream-creation/RecipientStep.tsx
index 8e91074d..ebe71d77 100644
--- a/frontend/src/components/stream-creation/RecipientStep.tsx
+++ b/frontend/src/components/stream-creation/RecipientStep.tsx
@@ -6,17 +6,32 @@ interface RecipientStepProps {
   value: string;
   onChange: (value: string) => void;
   error?: string;
+  senderAddress?: string | null;
 }
 
 const STELLAR_PUBLIC_KEY_LENGTH = 56;
 
+function getPersistedWalletPublicKey(): string | undefined {
+  if (typeof window === "undefined") return undefined;
+  try {
+    const raw = window.localStorage.getItem("flowfi.wallet.session.v1");
+    if (!raw) return undefined;
+    const parsed = JSON.parse(raw) as { publicKey?: unknown };
+    return typeof parsed?.publicKey === "string" ? parsed.publicKey : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 export const RecipientStep: React.FC<RecipientStepProps> = ({
   value,
   onChange,
   error,
+  senderAddress,
 }) => {
   const inputRef = useRef<HTMLInputElement>(null);
   const [touched, setTouched] = useState(false);
+  const effectiveSenderAddress = senderAddress ?? getPersistedWalletPublicKey();
 
   // Auto-focus on mount
   useEffect(() => {
@@ -24,13 +39,19 @@ export const RecipientStep: React.FC<RecipientStepProps> = ({
   }, []);
 
   const trimmed = value.trim();
+  const normalizedSender = effectiveSenderAddress?.trim();
+  const isSameAsSender =
+    Boolean(normalizedSender) &&
+    trimmed.length > 0 &&
+    trimmed.toLowerCase() === normalizedSender!.toLowerCase();
 
   // Real-time feedback: validate once the user has committed the field
-  // (blur / paste) or entered a full-length key, so partial typing does not
-  // flash errors while still catching bad checksums immediately.
+  // (blur / paste), entered a full-length key, or matched the connected sender,
+  // so partial typing does not flash errors while still catching bad checksums
+  // and self-streams immediately.
   const liveError =
-    touched || trimmed.length >= STELLAR_PUBLIC_KEY_LENGTH
-      ? validateRecipient(value)
+    touched || trimmed.length >= STELLAR_PUBLIC_KEY_LENGTH || isSameAsSender
+      ? validateRecipient(value, effectiveSenderAddress)
       : null;
 
   // The wizard-provided error (set on step validation) takes precedence.
diff --git a/frontend/src/components/stream-creation/StreamCreationWizard.tsx b/frontend/src/components/stream-creation/StreamCreationWizard.tsx
index f6b259cf..514a5180 100644
--- a/frontend/src/components/stream-creation/StreamCreationWizard.tsx
+++ b/frontend/src/components/stream-creation/StreamCreationWizard.tsx
@@ -261,6 +261,7 @@ export const StreamCreationWizard: React.FC<StreamCreationWizardProps> = ({
             value={formData.recipient}
             onChange={(value) => updateFormData({ recipient: value })}
             error={errors.recipient}
+            senderAddress={walletPublicKey}
           />
         );
       case 3:
@@ -469,7 +470,10 @@ export const StreamCreationWizard: React.FC<StreamCreationWizardProps> = ({
                   Cancel
                 </Button>
                 {currentStep < STEPS.length ? (
-                  <Button onClick={handleNext}>
+                  <Button
+                    onClick={handleNext}
+                    disabled={currentStep === 2 && Boolean(errors.recipient)}
+                  >
                     Next
                     <svg className="w-4 h-4 ml-2" fill="none" stroke="currentColor" viewBox="0 0 24 24">
                       <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M9 5l7 7-7 7" />
diff --git a/frontend/src/lib/__tests__/stream-validation.test.ts b/frontend/src/lib/__tests__/stream-validation.test.ts
index 8d4920da..1e646029 100644
--- a/frontend/src/lib/__tests__/stream-validation.test.ts
+++ b/frontend/src/lib/__tests__/stream-validation.test.ts
@@ -102,6 +102,28 @@ describe("validateRecipient", () => {
   it("accepts a valid key padded with mixed whitespace", () => {
     expect(validateRecipient(`\n\t ${VALID_KEY} \t`)).toBeNull();
   });
+
+  it("rejects recipient identical to connected sender wallet address", () => {
+    expect(validateRecipient(VALID_KEY, VALID_KEY)).toBe(
+      "Recipient address cannot be the same as your connected sender wallet",
+    );
+  });
+
+  it("rejects recipient matching connected sender wallet case-insensitively and with surrounding whitespace", () => {
+    expect(validateRecipient(`  ${VALID_KEY.toLowerCase()}  `, ` ${VALID_KEY} `)).toBe(
+      "Recipient address cannot be the same as your connected sender wallet",
+    );
+  });
+
+  it("propagates senderAddress check through validateStreamForm on step 2", () => {
+    const errors = validateStreamForm(VALID_FORM, {
+      step: 2,
+      senderAddress: VALID_KEY,
+    });
+    expect(errors.recipient).toBe(
+      "Recipient address cannot be the same as your connected sender wallet",
+    );
+  });
 });
 
 // ─── validateToken ────────────────────────────────────────────────────────────
diff --git a/frontend/src/lib/stream-validation.ts b/frontend/src/lib/stream-validation.ts
index bb851406..691ffe5f 100644
--- a/frontend/src/lib/stream-validation.ts
+++ b/frontend/src/lib/stream-validation.ts
@@ -70,6 +70,9 @@ export function getSpendableBalance(
 
 export type StreamFormErrors = Partial<Record<keyof StreamFormData, string>>;
 
+export const SAME_SENDER_RECIPIENT_ERROR =
+  "Recipient address cannot be the same as your connected sender wallet";
+
 export interface ValidationOptions {
   /**
    * When provided, only validate the fields relevant to the given wizard step:
@@ -84,17 +87,27 @@ export interface ValidationOptions {
   step?: number;
   /** Display-formatted wallet balance for the selected token (e.g. "1000.5") */
   walletBalance?: string | null;
+  /** Connected sender wallet Stellar public key to prevent self-streaming */
+  senderAddress?: string | null;
 }
 
 // ─── Individual field validators ──────────────────────────────────────────────
 
 export function validateRecipient(
   recipient: string,
+  senderAddress?: string | null,
 ): string | null {
   const trimmed = recipient.trim();
   if (!trimmed) {
     return "Recipient address is required";
   }
+  const normalizedSender = senderAddress?.trim();
+  if (
+    normalizedSender &&
+    trimmed.toLowerCase() === normalizedSender.toLowerCase()
+  ) {
+    return SAME_SENDER_RECIPIENT_ERROR;
+  }
   if (!isValidStellarPublicKey(trimmed)) {
     return "Invalid Stellar public key (must start with 'G' and be 56 characters)";
   }
@@ -170,7 +183,7 @@ export function validateStreamForm(
   data: StreamFormData,
   options: ValidationOptions = {},
 ): StreamFormErrors {
-  const { step, walletBalance } = options;
+  const { step, walletBalance, senderAddress } = options;
   const errors: StreamFormErrors = {};
 
   const shouldValidate = (
@@ -180,7 +193,7 @@ export function validateStreamForm(
   // Step 1 = Template selection — no field validation required
   // Step 2 = Recipient
   if (shouldValidate(2)) {
-    const recipientError = validateRecipient(data.recipient);
+    const recipientError = validateRecipient(data.recipient, senderAddress);
     if (recipientError) errors.recipient = recipientError;
   }
 

From 0c39dec8305452dcbe2f9bcb67344ee98108d66c Mon Sep 17 00:00:00 2001
From: Abdullah Azmi <greatnessings@gmail.com>
Date: Mon, 19 Oct 2026 07:21:10 +0000
Subject: [PATCH 2/3] fix(frontend): enforce self-recipient validation in
 useStreamForm and StreamCreationWizard (#1632)

---
 .../stream-creation/StreamCreationWizard.tsx  | 18 ++++++--
 .../__tests__/StreamCreationWizard.test.tsx   | 42 ++++++++++++++++---
 frontend/src/hooks/useStreamForm.ts           |  6 ++-
 3 files changed, 56 insertions(+), 10 deletions(-)

diff --git a/frontend/src/components/stream-creation/StreamCreationWizard.tsx b/frontend/src/components/stream-creation/StreamCreationWizard.tsx
index 514a5180..1e74c72d 100644
--- a/frontend/src/components/stream-creation/StreamCreationWizard.tsx
+++ b/frontend/src/components/stream-creation/StreamCreationWizard.tsx
@@ -19,7 +19,10 @@ import {
   useStreamForm,
   type StreamFormData,
 } from "@/hooks/useStreamForm";
-import { validateAmount } from "@/lib/stream-validation";
+import {
+  SAME_SENDER_RECIPIENT_ERROR,
+  validateAmount,
+} from "@/lib/stream-validation";
 
 // Re-export StreamFormData so existing imports keep working
 export type { StreamFormData };
@@ -97,6 +100,15 @@ export const StreamCreationWizard: React.FC<StreamCreationWizardProps> = ({
   const amountValid = amountError === null;
   const canSubmit = !isSubmitting && amountValid;
 
+  const isSelfRecipient =
+    Boolean(walletPublicKey?.trim()) &&
+    formData.recipient.trim().length > 0 &&
+    formData.recipient.trim().toLowerCase() ===
+      walletPublicKey!.trim().toLowerCase();
+  const recipientError =
+    errors.recipient ??
+    (isSelfRecipient ? SAME_SENDER_RECIPIENT_ERROR : undefined);
+
   const handleApplyTemplate = (templateId: string) => {
     const msg = applyTemplateHook(templateId);
     if (msg) setTemplateSaveMessage(msg);
@@ -260,7 +272,7 @@ export const StreamCreationWizard: React.FC<StreamCreationWizardProps> = ({
           <RecipientStep
             value={formData.recipient}
             onChange={(value) => updateFormData({ recipient: value })}
-            error={errors.recipient}
+            error={recipientError}
             senderAddress={walletPublicKey}
           />
         );
@@ -472,7 +484,7 @@ export const StreamCreationWizard: React.FC<StreamCreationWizardProps> = ({
                 {currentStep < STEPS.length ? (
                   <Button
                     onClick={handleNext}
-                    disabled={currentStep === 2 && Boolean(errors.recipient)}
+                    disabled={currentStep === 2 && Boolean(recipientError)}
                   >
                     Next
                     <svg className="w-4 h-4 ml-2" fill="none" stroke="currentColor" viewBox="0 0 24 24">
diff --git a/frontend/src/components/stream-creation/__tests__/StreamCreationWizard.test.tsx b/frontend/src/components/stream-creation/__tests__/StreamCreationWizard.test.tsx
index 20faf1f0..45cca47b 100644
--- a/frontend/src/components/stream-creation/__tests__/StreamCreationWizard.test.tsx
+++ b/frontend/src/components/stream-creation/__tests__/StreamCreationWizard.test.tsx
@@ -196,6 +196,9 @@ import { fetchTokenBalanceDisplay } from "@/lib/soroban";
 // Valid Stellar Ed25519 public key (correct StrKey checksum)
 const VALID_KEY = "GAV4A377RAEV6YVAWZVHXF4VZD5ZBXGIKEMNHV5YIMV5LIKSNQVYUBR7";
 
+// Distinct valid Stellar Ed25519 public key for the connected sender wallet
+const SENDER_KEY = "GA3JE5IXBSOR6DCLZSGN7JIWQWO45RCS7PUFKKVXWSTE4Y75ISIDMHJG";
+
 // A different recipient, used to make sure polling does NOT pick it.
 const OTHER_KEY = "GBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
 
@@ -223,7 +226,7 @@ function renderWizard(overrides: Partial<React.ComponentProps<typeof StreamCreat
     <StreamCreationWizard
       onClose={onClose}
       onSubmit={onSubmit}
-      walletPublicKey={VALID_KEY}
+      walletPublicKey={SENDER_KEY}
       {...overrides}
     />
   );
@@ -352,6 +355,35 @@ describe("StreamCreationWizard", () => {
     );
   });
 
+  it("shows inline error, disables Next, and blocks advancing on step 2 when recipient matches connected sender wallet", () => {
+    renderWizard({ walletPublicKey: SENDER_KEY });
+    clickNext(); // 1 -> 2
+    fireEvent.change(screen.getByLabelText("Recipient Address"), {
+      target: { value: SENDER_KEY },
+    });
+
+    expect(screen.getByRole("alert")).toHaveTextContent(
+      "Recipient address cannot be the same as your connected sender wallet",
+    );
+    expect(screen.getByText("Next").closest("button")).toBeDisabled();
+
+    clickNext();
+    expect(screen.getByText("Step 2 of 5")).toBeInTheDocument();
+  });
+
+  it("blocks recipient matching connected sender wallet case-insensitively and with surrounding whitespace", () => {
+    renderWizard({ walletPublicKey: SENDER_KEY });
+    clickNext(); // 1 -> 2
+    fireEvent.change(screen.getByLabelText("Recipient Address"), {
+      target: { value: `  ${SENDER_KEY.toLowerCase()}  ` },
+    });
+
+    expect(screen.getByRole("alert")).toHaveTextContent(
+      "Recipient address cannot be the same as your connected sender wallet",
+    );
+    expect(screen.getByText("Next").closest("button")).toBeDisabled();
+  });
+
   it("advances past step 2 with a valid recipient", () => {
     renderWizard();
     clickNext();
@@ -711,7 +743,7 @@ describe("StreamCreationWizard", () => {
       <StreamCreationWizard
         onClose={vi.fn()}
         onSubmit={onSubmit}
-        walletPublicKey={VALID_KEY}
+        walletPublicKey={SENDER_KEY}
       />
     );
 
@@ -746,7 +778,7 @@ describe("StreamCreationWizard", () => {
       <StreamCreationWizard
         onClose={vi.fn()}
         onSubmit={onSubmit}
-        walletPublicKey={VALID_KEY}
+        walletPublicKey={SENDER_KEY}
       />
     );
 
@@ -785,7 +817,7 @@ describe("StreamCreationWizard", () => {
       <StreamCreationWizard
         onClose={vi.fn()}
         onSubmit={onSubmit}
-        walletPublicKey={VALID_KEY}
+        walletPublicKey={SENDER_KEY}
       />
     );
 
@@ -810,7 +842,7 @@ describe("StreamCreationWizard", () => {
       <StreamCreationWizard
         onClose={vi.fn()}
         onSubmit={onSubmit}
-        walletPublicKey={VALID_KEY}
+        walletPublicKey={SENDER_KEY}
       />
     );
 
diff --git a/frontend/src/hooks/useStreamForm.ts b/frontend/src/hooks/useStreamForm.ts
index 834f2bf6..fc985e52 100644
--- a/frontend/src/hooks/useStreamForm.ts
+++ b/frontend/src/hooks/useStreamForm.ts
@@ -424,20 +424,22 @@ export function useStreamForm(
       const newErrors = validateStreamForm(formData, {
         step,
         walletBalance,
+        senderAddress: walletPublicKey,
       });
       setErrors(newErrors);
       return Object.keys(newErrors).length === 0;
     },
-    [formData, walletBalance],
+    [formData, walletBalance, walletPublicKey],
   );
 
   const validateAll = useCallback((): boolean => {
     const newErrors = validateStreamForm(formData, {
       walletBalance,
+      senderAddress: walletPublicKey,
     });
     setErrors(newErrors);
     return Object.keys(newErrors).length === 0;
-  }, [formData, walletBalance]);
+  }, [formData, walletBalance, walletPublicKey]);
 
   const setMaxAmount = useCallback(() => {
     const spendable = getSpendableBalance(walletBalance, formData.token);

From 2423a5c5319d29cffc98325d8db1a9c9fff46c1f Mon Sep 17 00:00:00 2001
From: Abdullah Azmi <greatnessings@gmail.com>
Date: Mon, 19 Oct 2026 07:30:17 +0000
Subject: [PATCH 3/3] fix(frontend): scope senderAddress validation to wizard
 step validation (#1632)

---
 frontend/src/hooks/useStreamForm.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/frontend/src/hooks/useStreamForm.ts b/frontend/src/hooks/useStreamForm.ts
index fc985e52..eaba103b 100644
--- a/frontend/src/hooks/useStreamForm.ts
+++ b/frontend/src/hooks/useStreamForm.ts
@@ -435,11 +435,10 @@ export function useStreamForm(
   const validateAll = useCallback((): boolean => {
     const newErrors = validateStreamForm(formData, {
       walletBalance,
-      senderAddress: walletPublicKey,
     });
     setErrors(newErrors);
     return Object.keys(newErrors).length === 0;
-  }, [formData, walletBalance, walletPublicKey]);
+  }, [formData, walletBalance]);
 
   const setMaxAmount = useCallback(() => {
     const spendable = getSpendableBalance(walletBalance, formData.token);