payments: freeze matches uid as well as username (rename-proof)

Port of master 43427afe. The blacklist (send freeze) only matched the
current username, so a compromised account could shake the freeze by
renaming itself. Match on either the lowercased username OR the immutable
uid; add the uid to the blacklist set to freeze durably.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

1 files changed, 6 insertions, 1 deletions

diff --git a/lib/payments.ts b/lib/payments.ts
index 0a27143e..e346e5f0 100644
--- a/lib/payments.ts
+++ b/lib/payments.ts
@@ -161,7 +161,12 @@ export const debit = async ({
 
   const whitelisted = await db.sIsMember("whitelist", user?.username?.toLowerCase().trim());
 
-  const blacklisted = await db.sIsMember("blacklist", user?.username?.toLowerCase().trim());
+  // Blacklist (freeze) matches on EITHER the current username OR the uid. The
+  // uid never changes, so renaming the account can't shake the freeze — add the
+  // uid to the `blacklist` set to freeze a compromised account durably.
+  const blacklisted =
+    (await db.sIsMember("blacklist", user?.username?.toLowerCase().trim())) ||
+    (!!user?.id && (await db.sIsMember("blacklist", user.id)));
 
   if (hash && await db.sIsMember("blocked_addresses", hash)) {
     err(`SECURITY: blocked send to ${hash} by ${user.username}`);