From fbc61ef1540f8fda27da8ed2c861ec27c4e4c3be Mon Sep 17 00:00:00 2001 From: Dorian Date: Mon, 9 Mar 2026 07:34:51 +0000 Subject: [PATCH] fix: add amount validation for zap and bet endpoints MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Validate amountSats is a positive integer (1–1,000,000) on both /zap and /bets/place endpoints to prevent negative, zero, or absurdly large amounts. Co-Authored-By: Claude Opus 4.6 --- server/src/routes/bets.ts | 4 ++++ server/src/routes/payments.ts | 5 ++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/server/src/routes/bets.ts b/server/src/routes/bets.ts index e1578e3..9e5712c 100644 --- a/server/src/routes/bets.ts +++ b/server/src/routes/bets.ts @@ -55,6 +55,10 @@ betsRouter.post('/place', rateLimit(60_000, 10), async (c) => { return c.json({ error: 'Missing required fields.' }, 400) } + if (typeof amountSats !== 'number' || !Number.isInteger(amountSats) || amountSats < 1 || amountSats > 1_000_000) { + return c.json({ error: 'amountSats must be an integer between 1 and 1,000,000' }, 400) + } + // Verify fight is still open const fight = await db.select().from(schema.fights) .where(eq(schema.fights.id, fightId)).limit(1) diff --git a/server/src/routes/payments.ts b/server/src/routes/payments.ts index 83157b9..364ee8c 100644 --- a/server/src/routes/payments.ts +++ b/server/src/routes/payments.ts @@ -281,7 +281,10 @@ paymentsRouter.post('/zap', rateLimit(60_000, 10), async (c) => { }>() if (!winnerId || !fightId) return c.json({ error: 'Missing winnerId or fightId' }, 400) - const amount = amountSats || 21 + if (typeof amountSats !== 'number' || !Number.isInteger(amountSats) || amountSats < 1 || amountSats > 1_000_000) { + return c.json({ error: 'amountSats must be an integer between 1 and 1,000,000' }, 400) + } + const amount = amountSats // Verify the fight exists and this bot actually won const fightRows = await db.select({