From 8fbc6ea19c9f4959799f3d72b32e2b8661596ea8 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Mon, 2 Nov 2026 12:54:10 -0700
Subject: payments: credit each on-chain output once and require uuid invoice
 ids

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VMan6VN9xvnX1cgvV6hrUV
---
 lib/payments.ts | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'lib/payments.ts')

diff --git a/lib/payments.ts b/lib/payments.ts
index 20025cd2..46682670 100644
--- a/lib/payments.ts
+++ b/lib/payments.ts
@@ -469,6 +469,12 @@ export const credit = async ({
   let balanceKey = "balance";
   if ([PaymentType.bitcoin, PaymentType.liquid].includes(type)) {
     const [txid, vout] = ref.split(":").slice(-2);
+    // Permanent first-credit claim per output. Unlike `payment:<txid>:<vout>`,
+    // nothing else writes or deletes this key.
+    if (!(await db.set(`credited:${txid}:${vout}`, id, { NX: true }))) {
+      warn("duplicate credit blocked", hash, ref);
+      return;
+    }
     p.confirmed = false;
     balanceKey = "pending";
     await s(`payment:${txid}:${vout}`, id);
-- 
cgit v1.2.3