From 136ba2a12e87178f6d83fba2874abf4c9ad32915 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Tue, 17 Mar 2026 01:21:48 -0700 Subject: fix: add account ownership checks and harden PIN validation - Validate account ownership (aid) before allowing ark send/sync/vault operations and in debit/sendOnchain as defense-in-depth - Harden PIN check to reject missing/empty pin when user has one set Co-Authored-By: Claude Opus 4.6 (1M context) --- lib/payments.ts | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'lib/payments.ts') diff --git a/lib/payments.ts b/lib/payments.ts index 2737f886..78f20684 100644 --- a/lib/payments.ts +++ b/lib/payments.ts @@ -152,6 +152,12 @@ export const debit = async ({ }) => { amount = Number.parseInt(amount); + // Defense-in-depth: verify account ownership at the debit level + if (aid && user && aid !== user.id) { + const index = await db.lPos(`${user.id}:accounts`, aid); + if (index === null) fail("unauthorized"); + } + const whitelisted = await db.sIsMember("whitelist", user?.username?.toLowerCase().trim()); const blacklisted = await db.sIsMember("blacklist", user?.username?.toLowerCase().trim()); @@ -715,6 +721,8 @@ export const sendOnchain = async (params) => { // Non-custodial bitcoin account — use esplora if (aid !== user.id) { + const index = await db.lPos(`${user.id}:accounts`, aid); + if (index === null) fail("unauthorized"); return sendNonCustodial(params); } -- cgit v1.2.3