<![CDATA[T09
Error
- Location
index.js:146- Finding
<![CDATA[Connection Method Restrictions Are Not Enforced]]>
- Content
View full analysis
disallow spending (no pay_invoice). // if name contains "send" -> allow spending only. let allow_methods = null; const lname = name.toLowerCase(); if (lname.includes('recv') || lname.includes('receive')) { // Receiver connection must NOT allow any spending methods (SN validates this). allow_methods = ['make_invoice', 'get_balance', 'get_info']; } else if (lname.includes('send')) { // Sender connection must allow spending. // SN send validation checks only `pay_invoice`. allow_methods = ['pay_invoice', 'get_balance', 'get_info']; } ``` However, the request dispatcher processes payment requests without checking `conn.allow_methods`: ```js const { method, params } = payload; console.log(`[nwc] payload=${JSON.stringify(payload)}`); console.log(`[nwc] method=${method}`); const conn = state.connections[clientPub]; if (method === 'get_balance') { const balance = satsBalance(); await sendResult(ev, clientPub, enc, 'get_balance', { balance }); return; } if (method === 'get_info') { // NIP-47 get_info response: different libs/clients use different field names. // Provide both `methods` (per spec) and `supported` (some libs expect this). const defaultMethods = ['pay_invoice', 'make_invoice', 'get_balance', 'get_info']; const methods = Array.isArray(conn.allow_methods) && conn.allow_methods.length ? conn.allow_methods : defaultMethods; console.log(`[nwc] get_info methods=${methods.join(',')}`); await sendResult(ev, clientPub, enc, 'get_info', { alias: 'agent-wallet', color: '#FF45 ...[truncated 3516 chars]- Remediation
View remediation