From 851e35c3cd0546a2bc0fc17a8800930f477464ff Mon Sep 17 00:00:00 2001
From: Evan Yang <evan@evanfy.com>
Date: Mon, 23 Mar 2026 11:02:52 +0800
Subject: [PATCH] Return 400 for invalid wallet JSON bodies

---
 src/daemon/http/index.ts | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/daemon/http/index.ts b/src/daemon/http/index.ts
index 9e3f67c..b885dfc 100644
--- a/src/daemon/http/index.ts
+++ b/src/daemon/http/index.ts
@@ -87,7 +87,15 @@ async function readBody(req: IncomingMessage): Promise<string> {
 
 async function readJsonBody(req: IncomingMessage): Promise<Record<string, unknown>> {
   const bodyText = await readBody(req);
-  return bodyText ? (JSON.parse(bodyText) as Record<string, unknown>) : {};
+  if (!bodyText) {
+    return {};
+  }
+
+  try {
+    return JSON.parse(bodyText) as Record<string, unknown>;
+  } catch {
+    throw new CocodHttpError(400, "Invalid JSON body.");
+  }
 }
 
 function parseLimit(value: string | null, fallback = 10): number {