From 911dc0c1534eea0570f5e940df670a6a6489d794 Mon Sep 17 00:00:00 2001
From: Tyagiquamar <mohdquamartyagi@gmail.com>
Date: Wed, 2 Sep 2026 18:37:43 +0530
Subject: [PATCH] scanner: reject duplicate BIP21 parameter keys (#63)

---
 src/modules/scanner/implementation.rs | 23 +++++++++++------------
 src/modules/scanner/tests.rs          | 13 ++++++++++++-
 2 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/src/modules/scanner/implementation.rs b/src/modules/scanner/implementation.rs
index 72e47a19..f9c65f86 100644
--- a/src/modules/scanner/implementation.rs
+++ b/src/modules/scanner/implementation.rs
@@ -317,18 +317,17 @@ impl Scanner {
 
         let address = parts[0].to_string();
 
-        let params = if parts.len() > 1 {
-            parts[1]
-                .split('&')
-                .filter_map(|param| {
-                    param
-                        .split_once('=')
-                        .map(|(k, v)| (k.to_string(), v.to_string()))
-                })
-                .collect::<HashMap<String, String>>()
-        } else {
-            HashMap::new()
-        };
+        let mut params = HashMap::new();
+        if parts.len() > 1 {
+            for param in parts[1].split('&') {
+                if let Some((k, v)) = param.split_once('=') {
+                    if params.contains_key(k) {
+                        return Err(DecodingError::InvalidFormat);
+                    }
+                    params.insert(k.to_string(), v.to_string());
+                }
+            }
+        }
 
         let amount_satoshis = params
             .get("amount")
diff --git a/src/modules/scanner/tests.rs b/src/modules/scanner/tests.rs
index ea18f1f3..62092fd3 100644
--- a/src/modules/scanner/tests.rs
+++ b/src/modules/scanner/tests.rs
@@ -199,8 +199,19 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn test_invalid_lightning_invoice() {
+    fn test_invalid_lightning_invoice_sync() {
         let invoice = "lnbc1invalid".to_string();
+        assert!(matches!(
+            Scanner::decode_onchain(&invoice),
+            Err(DecodingError::InvalidFormat)
+        ));
+    }
+
+    #[tokio::test]
+    async fn test_duplicate_bip21_params_fails() {
+        let invoice =
+            "bitcoin:bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq?amount=0.000035&amount=0.00005"
+                .to_string();
         assert!(matches!(
             Scanner::decode(invoice).await,
             Err(DecodingError::InvalidFormat)