The 'matches' validation rule fails even though I'm sure its correct

I'm building a simple signup form that has a password confirmation field and it uses the 'matches' validation rule. I can't get it to return true though even though I can var_dump the values and see that they are both the same.
Here is my UserModel:

PHP Code:

class UserModel extends Model
{
 protected $DBGroup              = 'default';
 protected $table                = 'users';
 protected $primaryKey          = 'id';
 protected $useAutoIncrement    = true;
 protected $insertID            = 0;
 protected $returnType          = 'object';
 protected $useSoftDelete        = false;
 protected $protectFields        = true;
 protected $allowedFields        = ['username', 'email', 'password'];

 // Dates
 protected $useTimestamps        = false;
 protected $dateFormat          = 'datetime';
 protected $createdField        = 'created_at';
 protected $updatedField        = 'updated_at';
 protected $deletedField        = 'deleted_at';
    
 // Validation
    protected $validationRules      = [
        'username' => 'required|min_length[2]|alpha_numeric',
        'email' => 'required|valid_email',
        'password' => 'required',
        'password-confirm' => 'required|matches[password]'
    ];

    protected $validationMessages  = [];
 protected $skipValidation      = false;
 protected $cleanValidationRules = true;

 // Callbacks
 protected $allowCallbacks      = true;
 protected $beforeInsert        = [];
 protected $afterInsert          = [];
 protected $beforeUpdate        = [];
 protected $afterUpdate          = [];
 protected $beforeFind          = [];
 protected $afterFind            = [];
 protected $beforeDelete        = [];
 protected $afterDelete          = [];
} 


Here is  the method that deals with signing up the user:

PHP Code:

/**
 * Create a new resource object, from "posted" parameters
 *
 * @return mixed
 */
 public function create()
 {
        $user = new User();

        /**------------------------------------------------------------------------------
        * Validation
        ------------------------------------------------------------------------------*/
        if (! $this->validate($user->validationRules))
        {
            echo view('login/signup', [
                'validation' => $this->validation,
            ]);
        } else
        {
            $username = $this->request->getVar('username');
            $email = $this->request->getVar('email');
            $password = $this->request->getVar('password');

            $userFound = $user->where('username', $username)->first();
            $emailFound = $user->where('email', $email)->first();

            /**------------------------------------------------------------------------------
            * Check if username or email already exist.
            ------------------------------------------------------------------------------*/
            if ($userFound)
            {
                $this->session->setFlashdata('message', "The username <strong>{$username}</strong> has already been taken. Please try another one.");
                return redirect()->to('signup');
            } else if($emailFound)
            {
                $this->session->setFlashdata('message', "Another user is already using <strong>{$email}</strong>. Please try another one.");
                return redirect()->to('signup');

            } else
            {
                $data = [
                    'username' => $username,
                    'email' => $email,
                    'password' => password_hash($password, PASSWORD_DEFAULT),
                    'password-confirm' => $password
                ];

                dump($user->insert($data));

                dump($this->request->getVar('password'));
                dump($this->request->getVar('password-confirm'));

                dump($user->errors());

                $this->session->setFlashdata("message", "An account for <strong>{$username}</strong> has been created. Now you can login!");
                return redirect()->to('/login');
            }
        }



What am I doing wrong? I have used no quotes, double quotes and single quotes in the validation rule and I still get the correct result.

Some help would be greatly appreciated.