diff options
| author | Adam Soltys <[email protected]> | 2026-05-17 23:42:28 -0700 |
|---|---|---|
| committer | Adam Soltys <[email protected]> | 2026-05-17 23:42:28 -0700 |
| commit | ca4bdc84f1eac1859044639ffa16bac9aa8fce1b (patch) | |
| tree | c4625ee4d7512edb4e877bb94b332a8c832ec1e5 /lib | |
| parent | 6992af9bc03822dea71b59604f03d34a91511264 (diff) | |
| download | coinos-server-ca4bdc84f1eac1859044639ffa16bac9aa8fce1b.tar.gz coinos-server-ca4bdc84f1eac1859044639ffa16bac9aa8fce1b.zip | |
remove /gateway endpoint
Unauthenticated arbitrary db.set abuse vector. Exploited on the master
deployment to inflate user balances and override safety controls in real
time, leading to a hot-wallet drain. Route and handler both fully
removed; if a webhook-by-short-channel-id mapping is ever needed again
it must be rebuilt with auth + SCID format validation + webhook URL
validation + per-user ownership check.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Diffstat (limited to 'lib')
0 files changed, 0 insertions, 0 deletions