feat: security audit fixes

apps/api/src/routes/bsc-swap-proxy.routes.ts

@@ -1,5 +1,7 @@
 import { Request, Response, Router } from 'express';
 import { ethers } from 'ethers';
+import { logger } from '../lib/logger';
+import { assertUserOwnsAddress } from '../lib/wallet-binding';
 
 const router = Router();
 
@@ -85,7 +87,7 @@ async function getSwapQuote(req: Request, res: Response) {
       toDecimals: TOKEN_DECIMALS[to],
     });
   } catch (error) {
-    console.error(`BSC quote failed: ${(error as any)?.stack || (error as any)?.message}`);
+    logger.error(`BSC quote failed: ${(error as any)?.stack || (error as any)?.message}`);
     res.status(502).json({ success: false, error: 'Failed to get BSC swap quote' });
   }
 }
@@ -113,6 +115,16 @@ async function buildSwapTx(req: Request, res: Response) {
     return;
   }
 
+  // C17 — bind userAddress to JWT. Иначе attacker может set userAddress=victim_addr
+  // и output swap'а пойдёт victim'у/контракту-attacker'у (reentrancy vector).
+  const userId = req.auth!.userId;
+  try {
+    await assertUserOwnsAddress(userId, 'BSC', userAddress);
+  } catch (err: any) {
+    res.status(403).json({ success: false, error: err.message });
+    return;
+  }
+
   // Validate amount + amountOutMin: positive integers > 0 (string-encoded BigInt).
   // "0" truthy bypass — без этого attacker может выставить amountOutMin=0 = 100% slippage
   // → sandwich attack осушает swap.
@@ -189,7 +201,7 @@ async function buildSwapTx(req: Request, res: Response) {
 
     res.json({ success: true, transactions });
   } catch (error) {
-    console.error(`BSC build failed: ${(error as any)?.stack || (error as any)?.message}`);
+    logger.error(`BSC build failed: ${(error as any)?.stack || (error as any)?.message}`);
     res.status(502).json({ success: false, error: 'Failed to build BSC swap' });
   }
 }