From 3c4d0b6914bbc7ecf49312a264d55af3c2e2d7a6 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sun, 17 May 2026 23:21:39 -0700 Subject: remove /gateway endpoint Unauthenticated arbitrary db.set abuse vector. Exploited to inflate user balances and override safety controls (bitcoin:limit, limit, hardfreeze, freeze) in real time, leading to a hot-wallet drain. Route and handler both fully removed. Co-Authored-By: Claude Opus 4.7 (1M context) --- index.ts | 1 - routes/payments.ts | 9 --------- 2 files changed, 10 deletions(-) diff --git a/index.ts b/index.ts index 78c43598..793bf2f8 100644 --- a/index.ts +++ b/index.ts @@ -84,7 +84,6 @@ app.post("/take", auth, payments.take); app.post("/print", auth, payments.print); app.post("/send/:lnaddress/:amount", auth, payments.lnaddress); app.post("/send", auth, payments.internal); -app.post("/gateway", payments.gateway); app.post("/replace", auth, payments.replace); app.get("/decode/:bolt11", payments.decode); app.post("/fetchinvoice", payments.fetchinvoice); diff --git a/routes/payments.ts b/routes/payments.ts index 1845512c..43c098b6 100644 --- a/routes/payments.ts +++ b/routes/payments.ts @@ -626,15 +626,6 @@ export default { } }, - async gateway(req, res) { - const { - body: { short_channel_id, webhook }, - } = req; - - await s(short_channel_id, webhook); - res.send({ ok: true }); - }, - async replace(req, res) { const { body: { id }, -- cgit v1.2.3