From 6bb42eef5c0a2a9a8ae1664cfb60f6264dba314b Mon Sep 17 00:00:00 2001
From: Martin Grabina <martin@aave.com>
Date: Thu, 20 Aug 2026 11:00:50 -0300
Subject: [PATCH] fix: tag compliance checks with surface=v3

The compliance API records which surface a denial came from, but only when the
caller sends ?surface=. Without it every denial lands as UNATTRIBUTED and
/compliance blocked-stats --surface v3 returns zero.
---
 pages/api/preflight-compliance.ts | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/pages/api/preflight-compliance.ts b/pages/api/preflight-compliance.ts
index fcf49f204b..cc8d7ec0b8 100644
--- a/pages/api/preflight-compliance.ts
+++ b/pages/api/preflight-compliance.ts
@@ -54,12 +54,15 @@ export default async function handler(
   try {
     // use ?overrideResultStatus=false | true if you want to override the result
 
-    const response = await fetch(`${COMPLIANCE_API_URL}/check/${encodeURIComponent(address)}`, {
-      method: 'GET',
-      headers: {
-        'x-compliance-secret': COMPLIANCE_SECRET,
-      },
-    });
+    const response = await fetch(
+      `${COMPLIANCE_API_URL}/check/${encodeURIComponent(address)}?surface=v3`,
+      {
+        method: 'GET',
+        headers: {
+          'x-compliance-secret': COMPLIANCE_SECRET,
+        },
+      }
+    );
 
     if (!response.ok) {
       if (response.status === 401) {