feat(batch_add_transaction): only creator of the batch can add txs to it

Squads-Protocol · Sep 24, 2023 · c43d180 · c43d180
1 parent 720ca8c
commit c43d180
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/programs/squads_multisig_program/src/instructions/batch_add_transaction.rs b/programs/squads_multisig_program/src/instructions/batch_add_transaction.rs
@@ -79,6 +79,7 @@ impl BatchAddTransaction<'_> {
             multisig,
             member,
             proposal,
+            batch,
             ..
         } = self;
 
@@ -91,6 +92,8 @@ impl BatchAddTransaction<'_> {
             multisig.member_has_permission(member.key(), Permission::Initiate),
             MultisigError::Unauthorized
         );
+        // Only batch creator can add transactions to it.
+        require!(member.key() == batch.creator, MultisigError::Unauthorized);
 
         // `proposal`
         require!(