coinos-server.git/routes/payments.ts, branch staging

don't remove orphan payment ids from user payment lists

2026-05-18T06:50:16Z

When the underlying payment record is missing, removing the id from the user's payments list was destructive — a transiently unavailable record (arc fallback miss, database hiccup) would cause us to permanently drop the pointer. Leave the orphan in place so a back-fill from an RDB backup can restore the record under the same id later. Co-Authored-By: Claude Opus 4.7 (1M context)

mirror payment records to arc + atomic /confirm lock to prevent double-credits

2026-05-18T06:46:58Z

Apr 29 double-credit prevention, ported from master 0e368dab and adapted to staging's hono/tigerbeetle structure. Two parallel callers of /confirm (walletnotify, catchUp, bulk sweeps) could each read p.confirmed=false and each run tbConfirm — doubling the pending→balance transfer. tbConfirm itself isn't idempotent on its own, so the race materializes as a real double-credit even with TB. - routes/payments.ts: SET NX EX 60 lock around the confirmation block keyed by `confirmlock:${txid}:${vout}`. Concurrent callers short-circuit cleanly. Released on success and on every early-return. - lib/payments.ts credit() + routes/payments.ts /confirm: mirror payment + invoice records and the `payment::` / `payment:` pointer keys into arc as soon as they're written. gf() will then find the prior credit via arc fallback even if the main-db copy is wiped by a future data-loss event. Co-Authored-By: Claude Opus 4.7 (1M context)

remove /gateway endpoint

2026-05-18T06:42:28Z

Unauthenticated arbitrary db.set abuse vector. Exploited on the master deployment to inflate user balances and override safety controls in real time, leading to a hot-wallet drain. Route and handler both fully removed; if a webhook-by-short-channel-id mapping is ever needed again it must be rebuilt with auth + SCID format validation + webhook URL validation + per-user ownership check. Co-Authored-By: Claude Opus 4.7 (1M context)

verify ark amounts

2026-03-22T15:41:12Z

fix: add account ownership checks and harden PIN validation

2026-03-17T08:34:28Z

- Validate account ownership (aid) before allowing ark send/sync/vault operations and in debit/sendOnchain as defense-in-depth - Harden PIN check to reject missing/empty pin when user has one set Co-Authored-By: Claude Opus 4.6 (1M context)

tx recalc

2026-03-12T06:51:53Z

try to cpfp piggyback on in flight withdrawals

2026-03-12T06:01:00Z

remove bumpestimate

2026-03-12T05:30:37Z

fund authorizations

2026-03-04T20:43:11Z

funds route

2026-03-04T19:10:49Z