diff options
| author | Adam Soltys <[email protected]> | 2026-05-19 08:34:54 -0700 |
|---|---|---|
| committer | Adam Soltys <[email protected]> | 2026-05-19 08:34:54 -0700 |
| commit | 9142b4dbcce407e331a2c1c9b56bb1ead3d3df76 (patch) | |
| tree | a9bdb40f6cbcb07f4865f9bc8fc124290eee50bc /server.c | |
| parent | cddafe5ef8fc90559d5163d4ecaa0da37c7947f7 (diff) | |
| download | coinos-server-9142b4dbcce407e331a2c1c9b56bb1ead3d3df76.tar.gz coinos-server-9142b4dbcce407e331a2c1c9b56bb1ead3d3df76.zip | |
withdraw-lock: refuse external sends when /locks/<type>.locked is present
Out-of-band emergency stop. The companion nobal.sh creates a sentinel
file on the host (bind-mounted at /locks in the container) when a
wallet balance drops below its failsafe threshold; debit() checks for
the file on every external send and refuses with "External withdrawals
temporarily disabled". /locks/ALL.locked is a global override.
Lives outside the db so a db-write vector (the May 18 /gateway pattern)
can't disable it. Internal sends are exempt — receives and user-to-user
transfers keep working with the site fully online during a lock.
For bitcoin and liquid this is a secondary defense on top of daemon-
level walletpassphrase rotation. For lightning, it's the only available
mechanism since CLN has no walletlock equivalent.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Diffstat (limited to 'server.c')
0 files changed, 0 insertions, 0 deletions