fix: harden rate-limit IP resolution + guard stale generation in transak checkout catch

- widget-url route: resolveClientIp prefers x-real-ip (written by trusted
  proxies, unspoofable from the client) over the leftmost x-forwarded-for
  entry; falls back to 'unknown' bucket when no public IP is available so
  attackers cannot trivially rotate headers to bypass the rate limit.
- useTransakCheckout open(): guard the catch block with genRef.current !== gen
  so a superseded generation does not overwrite the active generation's
  error/status (matches the guard already used before instance assignment).

Author: victhorbi

examples/next-template/src/app/api/transak/widget-url/route.ts

@@ -48,6 +48,28 @@ function rateLimited(ip: string): boolean {
     return false;
 }
 
+const PRIVATE_IP_PREFIXES = ['10.', '172.16.', '172.17.', '172.18.', '172.19.', '172.20.', '172.21.', '172.22.', '172.23.', '172.24.', '172.25.', '172.26.', '172.27.', '172.28.', '172.29.', '172.30.', '172.31.', '192.168.', '127.', '169.254.', '::1', 'fc', 'fd'];
+
+function isPrivateIp(ip: string): boolean {
+    const trimmed = ip.trim().toLowerCase();
+    return PRIVATE_IP_PREFIXES.some((p) => trimmed.startsWith(p));
+}
+
+function resolveClientIp(req: NextRequest): string {
+    const realIp = req.headers.get('x-real-ip');
+    if (realIp && !isPrivateIp(realIp)) {
+        return realIp.trim();
+    }
+    const forwardedFor = req.headers.get('x-forwarded-for');
+    if (forwardedFor) {
+        const leftmost = forwardedFor.split(',')[0]?.trim();
+        if (leftmost && !isPrivateIp(leftmost)) {
+            return leftmost;
+        }
+    }
+    return 'unknown';
+}
+
 async function fetchWithTimeout(
     url: string,
     init: RequestInit,
@@ -123,8 +145,7 @@ export async function POST(req: NextRequest) {
         );
     }
 
-    const forwardedFor = req.headers.get('x-forwarded-for');
-    const userIp = forwardedFor?.split(',')[0]?.trim() ?? req.headers.get('x-real-ip') ?? '';
+    const userIp = resolveClientIp(req);
 
     if (rateLimited(userIp)) {
         return NextResponse.json(

packages/vechain-kit/src/hooks/payments/useTransakCheckout.ts

@@ -125,10 +125,11 @@ export const useTransakCheckout = (
             setStatus('processing');
             setIsOpen(true);
 
+            genRef.current += 1;
+            const gen = genRef.current;
+
             try {
                 removeEmbeddedWidget();
-                genRef.current += 1;
-                const gen = genRef.current;
 
                 const { Transak: TransakSDK } = await import(
                     '@transak/ui-js-sdk'
@@ -181,6 +182,9 @@ export const useTransakCheckout = (
 
                 instanceRef.current = instance;
             } catch (err) {
+                if (genRef.current !== gen) {
+                    return;
+                }
                 const error =
                     err instanceof Error
                         ? err