Audit fixes:
- Wallet names were used unvalidated as file paths, so a name like
"../<other-id>/x" reached another user's wallet directory or overwrote
bot_settings.json. Names are now validated and every path is resolved and
confirmed to sit inside the caller's own directory, which also blocks a
planted symlink from escaping.
- Tor mode leaked: the mempool.space fee check opened a direct clear-net
connection, tying the server's IP to its Bitcoin activity. It now goes
through Tor's SOCKS proxy to mempool's onion service, DNS included.
- The xpub message was left in the chat forever. It reveals the wallet's whole
address and balance history, so it is now deleted like the password is.
- Inline buttons stay live on old messages, so a user removed from the
allow-list could keep using them. Callbacks re-check authorisation, and
auth_check now works for callback queries instead of raising on a null
message.
- Wallet names echoed back in callback_data are confirmed against the user's
real wallet list.
- Settings are written via temp file + atomic rename; a crash mid-write used
to truncate the file and lose every user's wallet selection.
- Replies were sent against messages that had just been deleted; deletion is
now best-effort and cannot abort the flow.
Deployment:
- Allow-list can come from ALLOWED_USERS instead of a bind-mounted file, so a
deployment needs no files on disk. Both sources merge when both are present.
- A missing bind-mounted allowed_users.txt made Docker create a directory in
its place and silently lock everyone out; the entrypoint now detects that
and stops with an explanation.
- Standard mode honours ELECTRUM_SERVER, which previously only worked in Tor
mode despite being documented.
- Added VERSION, push.sh, docker-compose.deploy.yml and .env.deploy.example
for a two-file deploy off the published image.
Docs rewritten in English and Persian around the name Telegtrum, leading with
the security model and what it does not protect against.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
goyban