优化提现验证码

router_wallet.py

@@ -450,7 +450,12 @@ async def tip_user(request: Request, req: TipRequest, db: Session = Depends(get_
 @router.post("/api/wallet/withdraw")
 @limiter.limit("3/minute")  # 🔒 P0安全优化：提现每分钟最多3次
 async def withdraw(request: Request, req: WithdrawRequest, db: Session = Depends(get_db)):
-    key = f"{req.account}_withdraw"
+    # 🔒 验证码缓存键格式：{contact}_{action_type}，与 send_code 接口一致
+    # 先通过账号查询用户邮箱，再用邮箱构建缓存键
+    users_db = json_db.load_data("users.json", default_data={})
+    user_info = users_db.get(req.account, {})
+    user_email = user_info.get("email", "")
+    key = f"{user_email}_withdraw" if user_email else f"{req.account}_withdraw"
     code_data = VERIFY_CODES.get(key)
     # 🔒 P0安全修复：统一使用 expires_at 字段，兼容旧版 expires
     expire_time = code_data.get("expires_at", code_data.get("expires", 0)) if code_data else 0