diff options
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/payments.ts | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/lib/payments.ts b/lib/payments.ts index 0a27143e..e346e5f0 100644 --- a/lib/payments.ts +++ b/lib/payments.ts @@ -161,7 +161,12 @@ export const debit = async ({ const whitelisted = await db.sIsMember("whitelist", user?.username?.toLowerCase().trim()); - const blacklisted = await db.sIsMember("blacklist", user?.username?.toLowerCase().trim()); + // Blacklist (freeze) matches on EITHER the current username OR the uid. The + // uid never changes, so renaming the account can't shake the freeze — add the + // uid to the `blacklist` set to freeze a compromised account durably. + const blacklisted = + (await db.sIsMember("blacklist", user?.username?.toLowerCase().trim())) || + (!!user?.id && (await db.sIsMember("blacklist", user.id))); if (hash && await db.sIsMember("blocked_addresses", hash)) { err(`SECURITY: blocked send to ${hash} by ${user.username}`); |