diff --git a/backend/src/graphql/resolver/TransactionResolver.ts b/backend/src/graphql/resolver/TransactionResolver.ts
index 04f636b5a..40e9ec2dd 100644
--- a/backend/src/graphql/resolver/TransactionResolver.ts
+++ b/backend/src/graphql/resolver/TransactionResolver.ts
@@ -322,8 +322,6 @@ export class TransactionResolver {
       throw new LogError('Amount to send must be positive', amount)
     }
 
-    // TODO this is subject to replay attacks
-    // --- WHY?
     const senderUser = getUser(context)
 
     // validate recipient user