fix: ensure alias address can only be linked to a single parent address

Adds a check that rejects alias creation if the alias address is
already associated with a different parent address, preventing
one alias from acting on behalf of multiple addresses.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: wa0x6e

src/writer/alias.ts

@@ -10,16 +10,20 @@ export async function verify(message): Promise<any> {
     log.warn(`[writer] Wrong alias format ${JSON.stringify(schemaIsValid)}`);
     return Promise.reject('wrong alias format');
   }
-  if (message.address === msg.payload.alias) {
+  if (message.address.toLowerCase() === msg.payload.alias.toLowerCase()) {
     return Promise.reject('alias cannot be the same as the address');
   }
 
-  const existing = await db.queryAsync(
-    'SELECT 1 FROM aliases WHERE address = ? AND alias = ? LIMIT 1',
-    [message.address, msg.payload.alias]
-  );
-  if (existing.length > 0) {
-    return Promise.reject('alias already exists');
+  const results = await db.queryAsync('SELECT address FROM aliases WHERE alias = ?', [
+    msg.payload.alias
+  ]);
+  for (const row of results) {
+    if (row.address.toLowerCase() === message.address.toLowerCase()) {
+      return Promise.reject('alias already exists');
+    }
+  }
+  if (results.length > 0) {
+    return Promise.reject('alias is already linked to another address');
   }
 
   return true;

test/integration/helpers/alias.test.ts

@@ -41,6 +41,22 @@ describe('alias', () => {
       ).rejects.toMatch('alias already exists');
     });
 
+    it('should reject when alias is already linked to another address', async () => {
+      const alias = aliasesSqlFixtures[0].alias;
+      const differentAddress = '0x0000000000000000000000000000000000000099';
+      const msg = {
+        version: '0.1.4',
+        timestamp: Math.floor(Date.now() / 1000),
+        type: 'alias',
+        from: differentAddress,
+        payload: { alias }
+      };
+
+      await expect(
+        verify({ address: differentAddress, from: differentAddress, msg: JSON.stringify(msg) })
+      ).rejects.toMatch('alias is already linked to another address');
+    });
+
     it('should pass when alias does not exist', async () => {
       const msg = {
         version: '0.1.4',