Server trusting client-sent total in shop purchase event?

I've got a shop system where clients send purchase requests to the server with itemName, quantity, and total. The server validates the item exists but then removes the client-provided total amount from their cash:

local QBCore = exports['qb-core']:GetCoreObject()

RegisterNetEvent('shop:buy', function(itemName, quantity, total)
    local player = QBCore.Functions.GetPlayer(source)
    player.Functions.RemoveMoney('cash', total)
    player.Functions.AddItem(itemName, quantity)
end)

I've reproduced a situation where a modified client can send a different total value than what should be charged, and the server processes it without validation against the actual item price. The item name validation works fine, but I'm not sure which fields I can safely trust from the client side. Should I be recalculating the expected total on the server based on my stored item prices before processing the transaction?