reservation: validate confirmed output amounts

Compare each confirmed transaction output with the expected reservation
amount before advancing the state machine.

instantout/reservation/actions_test.go

@@ -203,6 +203,7 @@ func TestSubscribeToConfirmationAction(t *testing.T) {
 		blockHeight   int32
 		blockErr      error
 		sendTxConf    bool
+		outputValue   btcutil.Amount
 		confErr       error
 		expectedEvent fsm.EventType
 	}{
@@ -210,8 +211,15 @@ func TestSubscribeToConfirmationAction(t *testing.T) {
 			name:          "success",
 			blockHeight:   0,
 			sendTxConf:    true,
+			outputValue:   defaultValue,
 			expectedEvent: OnConfirmed,
 		},
+		{
+			name:          "reservation value mismatch",
+			sendTxConf:    true,
+			outputValue:   defaultValue - 1,
+			expectedEvent: fsm.OnError,
+		},
 		{
 			name:          "expired",
 			blockHeight:   100,
@@ -273,7 +281,7 @@ func TestSubscribeToConfirmationAction(t *testing.T) {
 							TxIn: []*wire.TxIn{},
 							TxOut: []*wire.TxOut{
 								{
-									Value:    int64(defaultValue),
+									Value:    int64(tc.outputValue),
 									PkScript: pkScript,
 								},
 							},

instantout/reservation/manager_test.go

@@ -58,6 +58,7 @@ func TestManager(t *testing.T) {
 	confTx := &wire.MsgTx{
 		TxOut: []*wire.TxOut{
 			{
+				Value:    int64(defaultValue),
 				PkScript: pkScript,
 			},
 		},

instantout/reservation/reservation.go

@@ -142,8 +142,14 @@ func (r *Reservation) findReservationOutput(tx *wire.MsgTx) (*wire.OutPoint,
 		return nil, err
 	}
 
+	var foundScript bool
 	for i, txOut := range tx.TxOut {
 		if bytes.Equal(txOut.PkScript, pkScript) {
+			foundScript = true
+			if txOut.Value != int64(r.Value) {
+				continue
+			}
+
 			return &wire.OutPoint{
 				Hash:  tx.TxHash(),
 				Index: uint32(i),
@@ -151,6 +157,11 @@ func (r *Reservation) findReservationOutput(tx *wire.MsgTx) (*wire.OutPoint,
 		}
 	}
 
+	if foundScript {
+		return nil, fmt.Errorf("reservation output value mismatch: "+
+			"expected %d", r.Value)
+	}
+
 	return nil, errors.New("reservation output not found")
 }