enforce validation of no more than 1 refund_tx_hash

Author: TymKh

proxy/api_validate.go

@@ -17,6 +17,7 @@ var (
 	errLocalEndpointSbundleMetadata = errors.New("mev share bundle should not contain metadata when sent to local endpoint")
 	errVersionNotSet                = errors.New("version field should be set")
 	errInvalidVersion               = errors.New("invalid version")
+	errMoreThanOneRefundTxHash      = errors.New("no more than one refund tx hash is allowed")
 )
 
 // EnsureReplacementUUID updates bundle with consistent replacement uuid value (falling back to `uuid` field if needed)
@@ -49,6 +50,10 @@ func ValidateEthSendBundle(args *rpctypes.EthSendBundleArgs, publicEndpoint bool
 		return errInvalidVersion
 	}
 
+	if len(args.RefundTxHashes) > 1 {
+		return errMoreThanOneRefundTxHash
+	}
+
 	if publicEndpoint {
 		// For now public (system) endpoint should receive version field preset.
 		// For flashbots endpoint orderflowproxy-sender uses it, for direct orderflow