From 8fbc6ea19c9f4959799f3d72b32e2b8661596ea8 Mon Sep 17 00:00:00 2001
From: Adam Soltys <adam@coinos.io>
Date: Mon, 2 Nov 2026 12:54:10 -0700
Subject: payments: credit each on-chain output once and require uuid invoice
 ids

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VMan6VN9xvnX1cgvV6hrUV
---
 routes/payments.ts | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to 'routes')

diff --git a/routes/payments.ts b/routes/payments.ts
index 66fd3386..cfb34af7 100644
--- a/routes/payments.ts
+++ b/routes/payments.ts
@@ -616,6 +616,18 @@ export default {
 
         const p = await getPayment(`${txid}:${vout}`);
 
+        // A pointer whose payment record is gone (account deleted, record
+        // overwritten) means this output was already credited once. Never
+        // treat it as a first sighting.
+        if (
+          !p &&
+          ((await db.exists(`payment:${txid}:${vout}`)) ||
+            (await db.exists(`credited:${txid}:${vout}`)))
+        ) {
+          warn("blocked re-credit of seen output", txid, vout, sats(amount), address);
+          continue;
+        }
+
         if (!p) {
           const invoice = await getInvoice(address);
           if (!hot && aid !== invoice?.aid) continue;
-- 
cgit v1.2.3