From 85849ede6fb6bd9151703ebb8cf1b2b2df385b99 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sun, 14 Jun 2026 12:33:35 -0700 Subject: payments: freeze matches uid as well as username (rename-proof) Port of master 43427afe. The blacklist (send freeze) only matched the current username, so a compromised account could shake the freeze by renaming itself. Match on either the lowercased username OR the immutable uid; add the uid to the blacklist set to freeze durably. Co-Authored-By: Claude Opus 4.8 --- lib/payments.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'lib') diff --git a/lib/payments.ts b/lib/payments.ts index 0a27143e..e346e5f0 100644 --- a/lib/payments.ts +++ b/lib/payments.ts @@ -161,7 +161,12 @@ export const debit = async ({ const whitelisted = await db.sIsMember("whitelist", user?.username?.toLowerCase().trim()); - const blacklisted = await db.sIsMember("blacklist", user?.username?.toLowerCase().trim()); + // Blacklist (freeze) matches on EITHER the current username OR the uid. The + // uid never changes, so renaming the account can't shake the freeze — add the + // uid to the `blacklist` set to freeze a compromised account durably. + const blacklisted = + (await db.sIsMember("blacklist", user?.username?.toLowerCase().trim())) || + (!!user?.id && (await db.sIsMember("blacklist", user.id))); if (hash && await db.sIsMember("blocked_addresses", hash)) { err(`SECURITY: blocked send to ${hash} by ${user.username}`); -- cgit v1.2.3