coinos-server.git/index.ts, branch regtest-fulcrum

users: add authenticated self-delete endpoint

2026-06-13T21:21:49Z

POST /delete (auth) wipes every key tied to the calling user, mirroring scripts/delall-legacy.ts: user records, payments/invoices, sub-accounts, NWC apps, nostr follow graph + nip5. Gated by typing the username and refuses while balance+pending > 10k sats so funds can't be destroyed by accident. Co-Authored-By: Claude Opus 4.8 (1M context)

payments: guard /replay double-credit race with SET NX idempotency

2026-06-13T21:21:44Z

getPayment() pre-check in the lightning listener/replay isn't atomic, so concurrent re-credits of the same settlement each ran incrBy. Claim each lightning/bolt12 settlement with an atomic SET NX on credited: (ref = preimage) and bail if already claimed. Also disable the /replay route that triggered it. Co-Authored-By: Claude Opus 4.8 (1M context)

remove /gateway endpoint

2026-05-18T06:21:39Z

Unauthenticated arbitrary db.set abuse vector. Exploited to inflate user balances and override safety controls (bitcoin:limit, limit, hardfreeze, freeze) in real time, leading to a hot-wallet drain. Route and handler both fully removed. Co-Authored-By: Claude Opus 4.7 (1M context)

check listpays before reversing

2026-04-25T16:21:14Z

lnurl proxy

2026-03-28T06:41:08Z

ensure lightning payments get processed

2026-03-20T06:51:57Z

remove logs

2026-03-17T06:53:13Z

adjust ln minfee

2026-03-15T22:49:17Z

health check

2026-02-06T16:55:45Z

challenge verify

2025-10-01T14:33:54Z