payments: freeze matches uid as well as username (rename-proof)

The blacklist (send freeze) only matched the current username, so a
compromised account could shake the freeze by renaming itself. Match on
either the lowercased username OR the immutable uid; add the uid to the
`blacklist` set to freeze durably.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

1 files changed, 6 insertions, 4 deletions

diff --git a/lib/payments.ts b/lib/payments.ts
index f10559be..aeebcc48 100644
--- a/lib/payments.ts
+++ b/lib/payments.ts
@@ -101,10 +101,12 @@ export const debit = async ({
     user?.username?.toLowerCase().trim(),
   );
 
-  const blacklisted = await db.sIsMember(
-    "blacklist",
-    user?.username?.toLowerCase().trim(),
-  );
+  // Blacklist (freeze) matches on EITHER the current username OR the uid. The
+  // uid never changes, so renaming the account can't shake the freeze — add the
+  // uid to the `blacklist` set to freeze a compromised account durably.
+  const blacklisted =
+    (await db.sIsMember("blacklist", user?.username?.toLowerCase().trim())) ||
+    (!!user?.id && (await db.sIsMember("blacklist", user.id)));
 
   if (hash && await db.sIsMember("blocked_addresses", hash)) {
     err(`SECURITY: blocked send to ${hash} by ${user.username}`);