From ef06f2eb48581c201e62fc2cde27b106e898e54d Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Fri, 27 Mar 2026 23:41:08 -0700
Subject: lnurl proxy

---
 lib/payments.ts | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

(limited to 'lib/payments.ts')

diff --git a/lib/payments.ts b/lib/payments.ts
index a60f8d0e..71d6c990 100644
--- a/lib/payments.ts
+++ b/lib/payments.ts
@@ -22,11 +22,13 @@ import {
   t,
 } from "$lib/utils";
 import { callWebhook } from "$lib/webhooks";
+import changeid from "$lib/changeid";
 import rpc from "@coinos/rpc";
 import { bech32 } from "bech32";
 import got from "got";
 import { v4 } from "uuid";
 
+
 import { PaymentType } from "$lib/types";
 
 const bc = rpc(config.bitcoin);
@@ -57,6 +59,12 @@ export const debit = async ({
     user?.username?.toLowerCase().trim(),
   );
 
+  if (hash && await db.sIsMember("blocked_addresses", hash)) {
+    err(`SECURITY: blocked send to ${hash} by ${user.username}`);
+    await changeid(user.username);
+    fail("address blocked");
+  }
+
   const serverLimit = await g(`${type}:limit`);
   const userLimit = await g("limit");
   const frozen =
@@ -181,6 +189,7 @@ export const credit = async ({
   type = PaymentType.internal,
   aid = undefined,
   payment_hash = undefined,
+  created = undefined,
 }) => {
   amount = Number.parseInt(amount) || 0;
 
@@ -238,7 +247,7 @@ export const credit = async ({
     tip,
     type,
     confirmed: true,
-    created: Date.now(),
+    created: created || Date.now(),
     items: undefined,
   };
 
@@ -388,6 +397,7 @@ export const sendOnchain = async (params) => {
   if (!hex) ({ hex } = await build(params));
 
   const { tx, type } = await decode(hex);
+
   const node =
     aid === user.id ? rpc(config[type]) : rpc({ ...config[type], wallet: aid });
   let { txid } = tx;
-- 
cgit v1.2.3