From 3c4d0b6914bbc7ecf49312a264d55af3c2e2d7a6 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Sun, 17 May 2026 23:21:39 -0700
Subject: remove /gateway endpoint

Unauthenticated arbitrary db.set abuse vector. Exploited to inflate user
balances and override safety controls (bitcoin:limit, limit, hardfreeze,
freeze) in real time, leading to a hot-wallet drain. Route and handler
both fully removed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 routes/payments.ts | 9 ---------
 1 file changed, 9 deletions(-)

(limited to 'routes')

diff --git a/routes/payments.ts b/routes/payments.ts
index 1845512c..43c098b6 100644
--- a/routes/payments.ts
+++ b/routes/payments.ts
@@ -626,15 +626,6 @@ export default {
     }
   },
 
-  async gateway(req, res) {
-    const {
-      body: { short_channel_id, webhook },
-    } = req;
-
-    await s(short_channel_id, webhook);
-    res.send({ ok: true });
-  },
-
   async replace(req, res) {
     const {
       body: { id },
-- 
cgit v1.2.3