From ca4bdc84f1eac1859044639ffa16bac9aa8fce1b Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sun, 17 May 2026 23:42:28 -0700 Subject: remove /gateway endpoint Unauthenticated arbitrary db.set abuse vector. Exploited on the master deployment to inflate user balances and override safety controls in real time, leading to a hot-wallet drain. Route and handler both fully removed; if a webhook-by-short-channel-id mapping is ever needed again it must be rebuilt with auth + SCID format validation + webhook URL validation + per-user ownership check. Co-Authored-By: Claude Opus 4.7 (1M context) --- index.ts | 1 - 1 file changed, 1 deletion(-) (limited to 'index.ts') diff --git a/index.ts b/index.ts index 7046c03e..a664638d 100644 --- a/index.ts +++ b/index.ts @@ -104,7 +104,6 @@ app.post("/take", auth, payments.take); app.post("/print", auth, payments.print); app.post("/send/:lnaddress/:amount", auth, payments.lnaddress); app.post("/send", auth, payments.internal); -app.post("/gateway", payments.gateway); app.post("/bump", auth, payments.bump); app.get("/decode/:bolt11", payments.decode); app.post("/fetchinvoice", payments.fetchinvoice); -- cgit v1.2.3