From ca4bdc84f1eac1859044639ffa16bac9aa8fce1b Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sun, 17 May 2026 23:42:28 -0700 Subject: remove /gateway endpoint Unauthenticated arbitrary db.set abuse vector. Exploited on the master deployment to inflate user balances and override safety controls in real time, leading to a hot-wallet drain. Route and handler both fully removed; if a webhook-by-short-channel-id mapping is ever needed again it must be rebuilt with auth + SCID format validation + webhook URL validation + per-user ownership check. Co-Authored-By: Claude Opus 4.7 (1M context) --- index.ts | 1 - routes/payments.ts | 8 -------- 2 files changed, 9 deletions(-) diff --git a/index.ts b/index.ts index 7046c03e..a664638d 100644 --- a/index.ts +++ b/index.ts @@ -104,7 +104,6 @@ app.post("/take", auth, payments.take); app.post("/print", auth, payments.print); app.post("/send/:lnaddress/:amount", auth, payments.lnaddress); app.post("/send", auth, payments.internal); -app.post("/gateway", payments.gateway); app.post("/bump", auth, payments.bump); app.get("/decode/:bolt11", payments.decode); app.post("/fetchinvoice", payments.fetchinvoice); diff --git a/routes/payments.ts b/routes/payments.ts index 56dcad21..81698e10 100644 --- a/routes/payments.ts +++ b/routes/payments.ts @@ -749,14 +749,6 @@ export default { } }, - async gateway(c) { - const body = await c.req.json(); - const { short_channel_id, webhook } = body; - - await s(short_channel_id, webhook); - return c.json({ ok: true }); - }, - async bump(c) { const body = await c.req.json(); const { id } = body; -- cgit v1.2.3