From 43427afe5b0b16d887163bd788360ac29105d69c Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sat, 13 Jun 2026 14:21:39 -0700 Subject: payments: freeze matches uid as well as username (rename-proof) The blacklist (send freeze) only matched the current username, so a compromised account could shake the freeze by renaming itself. Match on either the lowercased username OR the immutable uid; add the uid to the `blacklist` set to freeze durably. Co-Authored-By: Claude Opus 4.8 (1M context) --- lib/payments.ts | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/lib/payments.ts b/lib/payments.ts index f10559be..aeebcc48 100644 --- a/lib/payments.ts +++ b/lib/payments.ts @@ -101,10 +101,12 @@ export const debit = async ({ user?.username?.toLowerCase().trim(), ); - const blacklisted = await db.sIsMember( - "blacklist", - user?.username?.toLowerCase().trim(), - ); + // Blacklist (freeze) matches on EITHER the current username OR the uid. The + // uid never changes, so renaming the account can't shake the freeze — add the + // uid to the `blacklist` set to freeze a compromised account durably. + const blacklisted = + (await db.sIsMember("blacklist", user?.username?.toLowerCase().trim())) || + (!!user?.id && (await db.sIsMember("blacklist", user.id))); if (hash && await db.sIsMember("blocked_addresses", hash)) { err(`SECURITY: blocked send to ${hash} by ${user.username}`); -- cgit v1.2.3