fix: reject placeholder bridge recipients before posting

apps/cowswap-frontend/src/modules/ethFlow/services/ethFlow/index.ts

@@ -15,7 +15,7 @@ import { emitPostedOrderEvent } from 'modules/orders'
 import { addPendingOrderStep } from 'modules/trade/utils/addPendingOrderStep'
 import { logTradeFlow } from 'modules/trade/utils/logger'
 import { TradeFlowAnalytics } from 'modules/trade/utils/tradeFlowAnalytics'
-import { TradeFlowContext } from 'modules/tradeFlow'
+import { assertValidBridgeRecipient, TradeFlowContext } from 'modules/tradeFlow'
 import { isQuoteExpired } from 'modules/tradeQuote'
 
 import { ethFlowEnv } from 'common/hooks/useContract'
@@ -91,6 +91,7 @@ export async function ethFlow({
     }
 
     logTradeFlow('ETH FLOW', 'STEP 3: sign order')
+    assertValidBridgeRecipient(tradeQuoteState)
 
     const signingStepManager: SigningStepManager = {
       beforeBridgingSign() {

apps/cowswap-frontend/src/modules/tradeFlow/index.ts

@@ -1,4 +1,5 @@
 export { useHandleSwap } from './hooks/useHandleSwap'
 export { useTradeFlowContext } from './hooks/useTradeFlowContext'
 export { useTradeFlowType } from './hooks/useTradeFlowType'
+export { assertValidBridgeRecipient } from './services/assertValidBridgeRecipient.service'
 export * from './types/TradeFlowContext'

apps/cowswap-frontend/src/modules/tradeFlow/services/assertValidBridgeRecipient.service.ts

@@ -0,0 +1,19 @@
+import { isNonEvmPlaceholderRecipient } from 'modules/tradeQuote'
+import type { TradeQuoteState } from 'modules/tradeQuote'
+
+export function assertValidBridgeRecipient(tradeQuoteState: TradeQuoteState): void {
+  /**
+   * Safety guard: placeholder addresses injected into quote requests so that routes and prices can
+   * be fetched before the user has entered a real non-EVM destination address. They must never reach
+   * an actual order.
+   *
+   * The UI already blocks order submission via the RecipientNotSet form validation, but this check
+   * is a last-resort defence against any path (race condition, future refactor, etc.) that could
+   * bypass that gate and call postSwapOrderFromQuote with a stale quote still holding a placeholder.
+   */
+  const bridgeRecipient = tradeQuoteState.bridgeQuote?.tradeParameters.bridgeRecipient
+
+  if (isNonEvmPlaceholderRecipient(bridgeRecipient)) {
+    throw new Error('Bridge recipient is a placeholder address. Please set a valid recipient before proceeding.')
+  }
+}

apps/cowswap-frontend/src/modules/tradeFlow/services/safeBundleFlow/safeBundleApprovalFlow.ts

@@ -23,6 +23,7 @@ import { shouldZeroApprove as shouldZeroApproveFn } from 'modules/zeroApproval'
 import { getSwapErrorMessage } from 'common/utils/getSwapErrorMessage'
 
 import { SafeBundleFlowContext, TradeFlowContext } from '../../types/TradeFlowContext'
+import { assertValidBridgeRecipient } from '../assertValidBridgeRecipient.service'
 
 const LOG_PREFIX = 'SAFE APPROVAL BUNDLE FLOW'
 
@@ -83,6 +84,8 @@ export async function safeBundleApprovalFlow({
     orderParams.appData = await removePermitHookFromAppData(orderParams.appData, typedHooks)
 
     logTradeFlow(LOG_PREFIX, 'STEP 3: post order')
+    assertValidBridgeRecipient(tradeContext.tradeQuoteState)
+
     const {
       orderId,
       signingScheme,

apps/cowswap-frontend/src/modules/tradeFlow/services/safeBundleFlow/safeBundleEthFlow.ts

@@ -22,6 +22,7 @@ import { TradeFlowAnalytics } from 'modules/trade/utils/tradeFlowAnalytics'
 import { getSwapErrorMessage } from 'common/utils/getSwapErrorMessage'
 
 import { SafeBundleFlowContext, TradeFlowContext } from '../../types/TradeFlowContext'
+import { assertValidBridgeRecipient } from '../assertValidBridgeRecipient.service'
 
 const LOG_PREFIX = 'SAFE BUNDLE ETH FLOW'
 
@@ -100,6 +101,7 @@ export async function safeBundleEthFlow(
     orderParams.appData = await removePermitHookFromAppData(orderParams.appData, typedHooks)
 
     logTradeFlow(LOG_PREFIX, 'STEP 4: post order')
+    assertValidBridgeRecipient(tradeContext.tradeQuoteState)
 
     const {
       orderId,

apps/cowswap-frontend/src/modules/tradeFlow/services/swapFlow/index.ts

@@ -26,11 +26,11 @@ import { callDataContainsPermitSigner, handlePermit } from 'modules/permit'
 import { addPendingOrderStep } from 'modules/trade/utils/addPendingOrderStep'
 import { logTradeFlow } from 'modules/trade/utils/logger'
 import { TradeFlowAnalytics } from 'modules/trade/utils/tradeFlowAnalytics'
-import { isNonEvmPlaceholderRecipient } from 'modules/tradeQuote'
 
 import { getSwapErrorMessage } from 'common/utils/getSwapErrorMessage'
 
 import { TradeFlowContext } from '../../types/TradeFlowContext'
+import { assertValidBridgeRecipient } from '../assertValidBridgeRecipient.service'
 
 import type { Hex } from 'viem'
 
@@ -151,19 +151,7 @@ export async function swapFlow(
       },
     }
 
-    /**
-     * Safety guard: placeholder addresses injected into quote requests so that routes and prices can
-     * be fetched before the user has entered a real non-EVM destination address. They must never reach
-     * an actual order.
-     *
-     * The UI already blocks order submission via the RecipientNotSet form validation, but this check
-     * is a last-resort defence against any path (race condition, future refactor, etc.) that could
-     * bypass that gate and call postSwapOrderFromQuote with a stale quote still holding a placeholder.
-     */
-    const bridgeRecipient = tradeQuoteState.bridgeQuote?.tradeParameters.bridgeRecipient
-    if (isNonEvmPlaceholderRecipient(bridgeRecipient)) {
-      throw new Error('Bridge recipient is a placeholder address. Please set a valid recipient before proceeding.')
-    }
+    assertValidBridgeRecipient(tradeQuoteState)
 
     const {
       orderId,