diff options
| author | Adam Soltys <[email protected]> | 2026-08-25 08:17:56 -0700 |
|---|---|---|
| committer | Adam Soltys <[email protected]> | 2026-08-25 08:18:22 -0700 |
| commit | 13d906b4239e7520359df76943dece656e10e240 (patch) | |
| tree | 2f011913e86c9286c11bf7710d65bbc4fd959d62 /docker | |
| parent | 15c3aba306f35953f965acb9f83a83b5fff81dbe (diff) | |
| download | coinos-server-13d906b4239e7520359df76943dece656e10e240.tar.gz coinos-server-13d906b4239e7520359df76943dece656e10e240.zip | |
take/authorize: kill-switch + validate fund-claim amounts
The /take fund-claim path could pay out unbacked balance: the only ceiling on a
take is sats(fiat / rates[currency]) from the authorization, and a
crypto-denominated authorization (rate ~1) or a non-finite/zero rate turns that
ceiling astronomically large, so a take is no longer bounded by the authorized
fiat value. Combined with the fund debit/credit running per-call, an authorizer
account could be drained far beyond intent.
- Add a `fund:disabled` redis kill-switch to both /authorize and /take that
fails the fund/authorize/take mechanism closed while it is audited.
- Reject non-finite/zero rates, non-fiat (crypto) authorization currencies, and
non-positive/NaN fiat and amounts, so the fiat cap can no longer be defeated.
- Require the authorizer account to exist before debiting it.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01XiwgmQKwKnRxUmVDd4xSf7
Diffstat (limited to 'docker')
0 files changed, 0 insertions, 0 deletions