lfg2025/archy
1
0
Fork 0
Code Issues 24 Pull Requests 1 Actions Packages Projects Releases 64 Wiki Activity

feat(botfights): bump to 1.2.11 — closes 6 IDOR/auth bugs + winnings-claim UI

Browse Source 
Ships botfight repo commits f5f57e6, c162d5e, 41f1b93, 10d4209:

- Fixed 6 instances of the same trust-a-client-supplied-pubkey pattern
  across auth/payments/queue routes, two of them critical: GET
  /winnings/:botId had no auth at all and leaked live spendable Cashu
  bearer tokens; POST /connect-wallet let anyone redirect a victim
  bot's future payouts to an attacker's wallet by pubkey (public by
  design in nostr).
- Added owner-reachable AI-answer settings (existing bots, not just at
  creation) and a "claim your winnings" UI (Cashu payouts were minted
  server-side but had no frontend consumer at all until now).

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
archipelago
2026-07-31 19:48:06 -04:00
co-authored by Claude
parent 6c2b6668dc
commit aea17248f6
3 changed files with 2647 additions and 2649 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/image-versions.sh
+1 -1
View File
@@ -90,7 +90,7 @@ FIPS_UI_IMAGE="$ARCHY_REGISTRY/fips-ui:latest"
ROUTSTR_IMAGE="$ARCHY_REGISTRY/routstr:v0.4.3"
# Community / Gaming
BOTFIGHTS_IMAGE="$ARCHY_REGISTRY/botfights:1.2.9"
BOTFIGHTS_IMAGE="$ARCHY_REGISTRY/botfights:1.2.11"
# IndeedHub stack
INDEEDHUB_IMAGE="$ARCHY_REGISTRY/indeedhub:1.0.0"