check onchain order owner in ban list

[MartinquaXD]

Description

Currently the scan to filter out orders from banned users does not check the onchain account that placed an onchain order. So if a malicious actor creates an ethflow order it would not get flagged.
The respective field gets populated by this query here.

Changes

Also check the onchain_user address for ban status.
Refactored the code slightly to have 1 place to define all the relevant addresses and use them in 1 places.

How to test

extended existing unit test

[claude]

Claude finished @MartinquaXD's task in 1m 6s —— View job

---

PR Review: check onchain order owner in ban list

I reviewed the change to find_banned_user_orders. This is a correct and clean fix.

Summary

• The added onchain_user check is correct: it's Option<Address>, chains cleanly, and closes the gap where a banned actor placing an on-chain order (e.g. ethflow) would previously slip through since owner is the ethflow contract rather than the actual user.
• The users_to_check refactor removes the duplication between the pre-fetch pass and the filter pass — good simplification.
• The extended unit test covers each combination (owner / receiver / onchain_user banned, all-clean, all-banned) and correctly asserts a banned order is only reported once.

One minor point (posted inline): the function's doc comment still only mentions "owners or receivers" and should be updated to reflect that onchain_user is now also checked.

Nothing blocking — LGTM aside from the stale doc comment.

[AryanGodara]

LGTM