From ca4bdc84f1eac1859044639ffa16bac9aa8fce1b Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sun, 17 May 2026 23:42:28 -0700 Subject: remove /gateway endpoint Unauthenticated arbitrary db.set abuse vector. Exploited on the master deployment to inflate user balances and override safety controls in real time, leading to a hot-wallet drain. Route and handler both fully removed; if a webhook-by-short-channel-id mapping is ever needed again it must be rebuilt with auth + SCID format validation + webhook URL validation + per-user ownership check. Co-Authored-By: Claude Opus 4.7 (1M context) --- routes/payments.ts | 8 -------- 1 file changed, 8 deletions(-) (limited to 'routes') diff --git a/routes/payments.ts b/routes/payments.ts index 56dcad21..81698e10 100644 --- a/routes/payments.ts +++ b/routes/payments.ts @@ -749,14 +749,6 @@ export default { } }, - async gateway(c) { - const body = await c.req.json(); - const { short_channel_id, webhook } = body; - - await s(short_channel_id, webhook); - return c.json({ ok: true }); - }, - async bump(c) { const body = await c.req.json(); const { id } = body; -- cgit v1.2.3