Verify invoice amount in lightning address withdrawal (#501)

* Verify invoice amount in lightning address withdrawal * Add benthecarman to contributors.txt
stackernews · Sep 24, 2023 · a14341c · a14341c
1 parent dde82e2
commit a14341c
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/api/resolvers/wallet.js b/api/resolvers/wallet.js
@@ -336,6 +336,9 @@ export default {
         throw new Error('description hash does not match')
       }
 
+      if (!decoded.mtokens || BigInt(decoded.mtokens) !== BigInt(milliamount)) {
+        throw new Error('invoice has incorrect amount')
+      }
       // take pr and createWithdrawl
       return await createWithdrawal(parent, { invoice: res2.pr, maxFee }, { me, models, lnd })
     },

diff --git a/contributors.txt b/contributors.txt
@@ -3,4 +3,5 @@ kr
 ekzyis
 WeAreAllSatoshi
 rleed
-bitcoinplebdev
+bitcoinplebdev
+benthecarman