Verify a Payment - Base Documentation

Never fulfill from client state. Validate the canonical transaction data and atomically claim its hash in persistent storage before you reserve inventory, issue credentials, or return a paid resource.

Demo

Base Pay
USDC or B20

Verify Base Pay

Backend

export async function verifyBasePay(args: {
  id: Hash;
  payer: Address;
  merchant: Address;
  amount: string;
  orderId: string;
  store: PaymentStore;
}) {
  const payment = await getPaymentStatus({ id: args.id, testnet: true });
  if (payment.status !== "completed") throw new Error("Payment is not complete");
  if (payment.sender?.toLowerCase() !== args.payer.toLowerCase()) throw new Error("Wrong sender");
  if (payment.recipient?.toLowerCase() !== args.merchant.toLowerCase()) throw new Error("Wrong recipient");
  if (payment.amount !== args.amount) throw new Error("Wrong amount");
  if (!(await args.store.claimOnce(args.id, args.orderId))) throw new Error("Payment already used");
}

Verify a raw token transfer

Backend

export async function verifyTokenPayment(args: {
  hash: Hash;
  token: Address;
  payer: Address;
  merchant: Address;
  amount: string;
  memo?: `0x${string}`;
  orderId: string;
  store: PaymentStore;
}) {
  const receipt = await publicClient.getTransactionReceipt({ hash: args.hash });
  if (receipt.status !== "success") throw new Error("Transaction reverted");
  const transfers = parseEventLogs({ abi: tokenEvents, eventName: "Transfer", logs: receipt.logs, strict: true });
  const transfer = transfers.find((log) => log.address.toLowerCase() === args.token.toLowerCase());
  if (!transfer || transfer.args.from.toLowerCase() !== args.payer.toLowerCase()) throw new Error("Wrong sender");
  if (transfer.args.to.toLowerCase() !== args.merchant.toLowerCase()) throw new Error("Wrong recipient");
  if (transfer.args.amount !== parseUnits(args.amount, 6)) throw new Error("Wrong amount");
  const memos = parseEventLogs({ abi: tokenEvents, eventName: "Memo", logs: receipt.logs, strict: true });
  if (args.memo && !memos.some((log) => log.args.memo === args.memo)) throw new Error("Wrong memo");
  if (!(await args.store.claimOnce(args.hash, args.orderId))) throw new Error("Payment already used");
}

claimOnce must use a database uniqueness constraint and participate in the same durable workflow as fulfillment. A process-local Set cannot prevent replay across restarts or multiple workers.

Only the first request with the expected chain, token, sender, recipient, amount, and optional memo reaches fulfillment.

See the verified backend fixture for complete types and client setup.

See also

⌘I