validate amounts

2 files changed, 3 insertions, 0 deletions

diff --git a/routes/assets.js b/routes/assets.js
index 270a3e78..9a9c6836 100644
--- a/routes/assets.js
+++ b/routes/assets.js
@@ -286,11 +286,13 @@ app.post(
   ah(async (req, res) => {
     const { user } = req;
     const { asset, amount } = req.body;
+    amount = parseInt(amount);
 
     try {
       await db.transaction(async transaction => {
         let { account } = user;
 
+        if (amount < 0) throw new Error("Amount to load cannot be negative");
         if (account.asset !== config.liquid.btcasset)
           throw new Error(
             "Faucet has to be funded with bitcoin. Try sending from another wallet."
diff --git a/routes/send.js b/routes/send.js
index 78c6d9b7..6cb73b55 100644
--- a/routes/send.js
+++ b/routes/send.js
@@ -4,6 +4,7 @@ const uuidv4 = require("uuid/v4");
 module.exports = ah(async (req, res, next) => {
   let { amount, asset, memo, username } = req.body;
   let { user } = req;
+  amount = parseInt(amount);
 
   if (!asset) asset = config.liquid.btcasset;