diff --git a/src/pages/api/votes/[combatId].ts b/src/pages/api/votes/[combatId].ts
index e66cd29a2..a22d275a9 100644
--- a/src/pages/api/votes/[combatId].ts
+++ b/src/pages/api/votes/[combatId].ts
@@ -34,6 +34,8 @@ export const POST: APIRoute = async ({ params, request }) => {
 	if (!success) return res("Bad request", { status: 400 })
 
 	const { voteId } = output
+	const boxerData = combatData.boxers.find((b) => b === voteId)
+	if (!boxerData) return res("Boxer not found", { status: 404 })
 
 	const userId = session.user.id
 	const votedAt = NOW