package.json

@@ -1,6 +1,6 @@
 {
   "name": "ussd-tg-proxy",
-  "version": "0.2.2",
+  "version": "0.2.1",
   "description": "ussd-tg-proxy",
   "main": "src/index.js",
   "repository": "https://git.grassecon.net/grassrootseconomics/ussd-tg-proxy.git",

src/bot.js

@@ -77,7 +77,7 @@ bot.on("msg:contact", async (ctx) => {
   log.debug(ctx.update, "msg:contact received");
   const contact = ctx.msg.contact;
 
-  if (ctx.from.id === contact.user_id) {
+  if (ctx.msg.reply_to_message.from.is_bot && ctx.from.id === contact.user_id) {
     if (contact.phone_number.slice(0, 4) !== "+254") {
       return ctx.reply("Sarafu is only available in Kenya at the moment.");
     }
@@ -89,6 +89,7 @@ bot.on("msg:contact", async (ctx) => {
     );
   }
 
+  log.info(ctx.update.user, "contact spoof attempted");
   return ctx.reply("Could not verify sent contact.");
 });