lnbits icon indicating copy to clipboard operation
lnbits copied to clipboard

[BUG] funds withdrawn to new, inaccessible wallets

Open acurious opened this issue 1 year ago • 0 comments

Describe the bug Using the LNURLw extension when the user list is restricted/limited can result in funds being withdrawn to new, inaccessible wallets of knew unknown and not whitelisted users. Server administrator does not have an overview of the situation, making it difficult or impossible for him to assist individuals involved.

To Reproduce Steps to reproduce the behavior:

  1. Restrict usage to whitelisted users only
  2. Install and enable LNURLw extension
  3. Create LNURL withdrawal links
  4. Try to withdraw from these links with fresh web browser instance where there's no LNbits installed
  5. See error . New user and wallet created. Funds withdrawn to this new wallet. However, the wallet is inaccessible since the user is not whitelisted.

Expected behavior One would expect that new user with new inaccessible wallet is not created and funds are not withdrawn to such inaccessible wallet when user list is restricted to specific users only.

Desktop (please complete the following information):

  • LNbits version: 0.11.1
  • Database: sqlite,

Additional context Usermanager extension gives only list of users, that are manually created by this extension user. Would be nice if server administrator could get an overview of all users and their wallets from GUI. This would allow him/her to give support to new users and/or detect spam accounts.

acurious avatar Oct 30 '23 11:10 acurious