1 files changed, 19 insertions, 1 deletions
diff --git a/packages/taler-wallet-core/src/operations/pay.ts b/packages/taler-wallet-core/src/operations/pay.ts
index 8dbc2af41..0c45290fc 100644
--- a/packages/taler-wallet-core/src/operations/pay.ts
+++ b/packages/taler-wallet-core/src/operations/pay.ts
@@ -56,7 +56,11 @@ import * as Amounts from "../util/amounts";
 import { AmountJson } from "../util/amounts";
 import { Logger } from "../util/logging";
 import { parsePayUri } from "../util/taleruri";
-import { guardOperationException, OperationFailedError } from "./errors";
+import {
+  guardOperationException,
+  OperationFailedAndReportedError,
+  OperationFailedError,
+} from "./errors";
 import { createRefreshGroup, getTotalRefreshCost } from "./refresh";
 import { InternalWalletState, EXCHANGE_COINS_LOCK } from "./state";
 import {
@@ -661,6 +665,20 @@ async function processDownloadProposalImpl(
   );
   const fulfillmentUrl = parsedContractTerms.fulfillment_url;
 
+  const baseUrlForDownload = proposal.merchantBaseUrl;
+  const baseUrlFromContractTerms = parsedContractTerms.merchant_base_url;
+
+  if (baseUrlForDownload !== baseUrlFromContractTerms) {
+    throw OperationFailedAndReportedError.fromCode(
+      TalerErrorCode.WALLET_CONTRACT_TERMS_BASE_URL_MISMATCH,
+      "merchant base URL mismatch",
+      {
+        baseUrlForDownload,
+        baseUrlFromContractTerms,
+      },
+    );
+  }
+
   await ws.db.runWithWriteTransaction(
     [Stores.proposals, Stores.purchases],
     async (tx) => {