A claim with an ark address that doesn't decode is refused at the door — a corrupt one recorded is a payment black hole

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_014tE4U5nEjGTQy8PwYqamfv

1 files changed, 9 insertions, 0 deletions

diff --git a/names/server.js b/names/server.js
index 27b31d9..1b1f4bc 100644
--- a/names/server.js
+++ b/names/server.js
@@ -27,6 +27,7 @@ import { HDKey } from '@scure/bip32';
 import { mnemonicToSeedSync } from '@scure/bip39';
 import { lnBackend } from '../bridge/ln.js';
 import { ArkManager } from '../src/ark/manager.js';
+import { decodeAddress } from '../src/ark/proto.js';
 
 const CFG = JSON.parse(readFileSync(process.env.NAMES_CONFIG
   || join(import.meta.dir, 'config.json'), 'utf8'));
@@ -745,6 +746,14 @@ Bun.serve({
         }
       }
       if (/[?&]lno=/.test(claim.uri)) return json({ error: 'lno is added by the registrar' }, 400);
+      // A corrupt ark address recorded here is a payment black hole: forwards
+      // fail forever while the sats sit on the node (goyslop's 190k sat sat
+      // behind an invalid checksum). Refuse it at the door.
+      const arkDest = arkParamOf(claim.uri);
+      if (arkDest) {
+        try { decodeAddress(arkDest); }
+        catch { return json({ error: 'the ark address in the uri does not decode' }, 400); }
+      }
 
       // Every name also gets a static Lightning offer on our node; payments
       // to it are forwarded to the ark destination in the claim.