check conversion limit

3 files changed, 8 insertions, 5 deletions

diff --git a/routes/bitcoin/receive.js b/routes/bitcoin/receive.js
index ccaabc06..e381ccda 100644
--- a/routes/bitcoin/receive.js
+++ b/routes/bitcoin/receive.js
@@ -136,7 +136,7 @@ setInterval(async () => {
     for (let i = 0; i < arr.length; i++) {
       const hash = arr[i];
 
-      let account, address, user;
+      let account, address, user, total;
       await db.transaction(async transaction => {
         let p = await db.Payment.findOne({
           where: { hash, confirmed: 0, received: 1 },
@@ -157,7 +157,7 @@ setInterval(async () => {
         ({ account, address, user } = p);
 
         if (p && p.account) {
-          let total = p.amount + p.tip;
+          total = p.amount + p.tip;
 
           p.confirmed = 1;
           await account.save({ transaction });
@@ -193,7 +193,8 @@ setInterval(async () => {
         await sendLiquid({
           address,
           user,
-          tx
+          tx,
+          limit: total
         });
       }
     }
diff --git a/routes/liquid/fee.js b/routes/liquid/fee.js
index 82bb7604..1f5c1deb 100644
--- a/routes/liquid/fee.js
+++ b/routes/liquid/fee.js
@@ -74,7 +74,7 @@ module.exports = ah(async (req, res) => {
   try {
     res.send(await liquidTx({ ...req.body, user: req.user }));
   } catch (e) {
-    l.error("error estimating liquid fee", e.message);
+    l.error("error estimating liquid fee", e.message, e.stack);
     return res.status(500).send(e.message);
   }
 });
diff --git a/routes/liquid/send.js b/routes/liquid/send.js
index ee62c1b8..ab28471e 100644
--- a/routes/liquid/send.js
+++ b/routes/liquid/send.js
@@ -1,7 +1,7 @@
 const btc = config.liquid.btcasset;
 const lcad = config.liquid.cadasset;
 
-sendLiquid = async ({ user, address, memo, tx }) => {
+sendLiquid = async ({ user, address, memo, tx, limit }) => {
   const isChange = async address =>
     (await lq.getAddressInfo(address)).ismine &&
     !Object.keys(addresses).includes(address);
@@ -67,6 +67,8 @@ sendLiquid = async ({ user, address, memo, tx }) => {
         }
       }
 
+      if (limit && total > limit) throw new Error("Tx amount exceeds authorized amount");
+
       if (asset !== btc || total) {
         l.info("creating liquid payment", user.username, asset, total, fee);