CoinPay — Payments and Custody Review

Summary

Source review of CoinPay authorization, payment validation, Lightning x402 flows and treasury custody in the assessed repository state.

Document record

Author: Eduardo Camarillo [Noir0x63]
Published: 2026-08-20
Version: v2.0
Language: English

1. Scope and Method

This document consolidates two source-review passes over CoinPay. The work covered authorization, payment validation, Lightning x402 flows and custody controls. Targeted dynamic verification was limited to selected payment-rail and custody paths. Remediation states refer to the repository version reviewed at the stated date.

2. Selected Findings

Custody-key Initialization (CVSS v3.1: 9.8 / v4.0: 9.3)

When ENCRYPTION_KEY was unset, the affected code fell back to '0'.repeat(64), a known string of 64 ASCII zero characters. The security impact depends on how the encryption routine interprets that value; the advisory describes offline decryption after a database leak.

The linked advisory recommends failing closed when keys are missing and using a KMS. A specific HSM implementation and independent retest are not established by that advisory.

x402 Lightning Proof Verification (CVSS v3.1: 10.0 / v4.0: 9.9)

The Lightning x402 payment rail accepted client-crafted payment preimages without querying the LND RPC node, enabling zero-cost self-verified payments and arbitrary synthetic balance minting.

Remediation verified in reviewed master: server-side RPC invoice validation.

Payout Wallet Authorization via Email Upsert (CVSS v3.1: 9.6 / v4.0: 9.3)

An email-parameter upsert during authentication could overwrite a merchant receiving address without the intended authorization check.

Remediation verified in reviewed master: merchant identity binding.

Forwarding Authorization & Plan Validation (CVSS v3.1: 9.3 / v4.0: 8.5)

Secured unauthenticated check-balance requests triggering on-chain forwards, $0.01 payment escalation to $490/yr tiers bound to the attacker's merchant_id, and unauthenticated subscriptions with NULL amounts.

Remediation verified in reviewed master: authorization and price-tier validation.

3. Supabase RLS Remediation

The reviewed changes introduced more granular Supabase RLS rules across the database schema to enforce tenant boundaries around financial records.

Primary evidence: Relevant published advisory. The advisory records the affected versions and technical mechanism; a fix or retest requires separate evidence.