diff options
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/payments.ts | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/lib/payments.ts b/lib/payments.ts index f10559be..aeebcc48 100644 --- a/lib/payments.ts +++ b/lib/payments.ts @@ -101,10 +101,12 @@ export const debit = async ({ user?.username?.toLowerCase().trim(), ); - const blacklisted = await db.sIsMember( - "blacklist", - user?.username?.toLowerCase().trim(), - ); + // Blacklist (freeze) matches on EITHER the current username OR the uid. The + // uid never changes, so renaming the account can't shake the freeze — add the + // uid to the `blacklist` set to freeze a compromised account durably. + const blacklisted = + (await db.sIsMember("blacklist", user?.username?.toLowerCase().trim())) || + (!!user?.id && (await db.sIsMember("blacklist", user.id))); if (hash && await db.sIsMember("blocked_addresses", hash)) { err(`SECURITY: blocked send to ${hash} by ${user.username}`); |