Bob should assert swap contract used by Alice is a valid swap contract
Alice could potentially deploy a malicious swap contract with the same function signatures as the real contract and fool Bob into using it. Bob should check against this by:
- loading a known, verified contract at start-up (this already happens, but it isn't used by Bob necessarily during the swap process, if Alice sends a different contract)
- verify the code hash of the contract Alice sends