I agree, returning the transaction seems fine. All we need here is to prevent a replay attack from doing bad things.