From 0c1d993ffd86e75bb55e811ad58fe146af58ccc1 Mon Sep 17 00:00:00 2001
From: "Calum H. (IMB11)" <contact@cal.engineer>
Date: Sat, 31 Oct 2026 15:41:58 +0000
Subject: [PATCH] feat: prevent mural withdrawals for certain countries

---
 .../withdraw-stages/MuralpayKycStage.vue      | 40 ++++++++++++++++++-
 apps/frontend/src/locales/en-US/index.json    | 18 +++++++++
 .../src/providers/creator-withdraw.ts         | 11 ++++-
 apps/frontend/src/utils/muralpay-rails.ts     | 33 +++++++++++++++
 apps/labrinth/src/queue/payouts/flow/mural.rs | 24 +++++++++++
 apps/labrinth/src/queue/payouts/mod.rs        |  1 +
 6 files changed, 125 insertions(+), 2 deletions(-)

diff --git a/apps/frontend/src/components/ui/dashboard/withdraw-stages/MuralpayKycStage.vue b/apps/frontend/src/components/ui/dashboard/withdraw-stages/MuralpayKycStage.vue
index 1532258371c..e9b41f5b416 100644
--- a/apps/frontend/src/components/ui/dashboard/withdraw-stages/MuralpayKycStage.vue
+++ b/apps/frontend/src/components/ui/dashboard/withdraw-stages/MuralpayKycStage.vue
@@ -1,5 +1,13 @@
 <template>
-	<div class="flex flex-col gap-3 sm:gap-4">
+	<div ref="rootRef" class="flex flex-col gap-3 sm:gap-4">
+		<Admonition
+			v-if="blockedRegionName"
+			type="critical"
+			:header="formatMessage(messages.blockedRegionHeader)"
+		>
+			{{ formatMessage(messages.blockedRegionBody, { region: blockedRegionName }) }}
+		</Admonition>
+
 		<div class="flex flex-col gap-2.5">
 			<label>
 				<span class="text-md font-semibold text-contrast">
@@ -211,6 +219,7 @@
 
 <script setup lang="ts">
 import {
+	Admonition,
 	Chips,
 	Combobox,
 	DatePicker,
@@ -225,6 +234,7 @@ import iso3166 from 'iso-3166-2'
 
 import { useFormattedCountries } from '@/composables/country.ts'
 import { useWithdrawContext } from '@/providers/creator-withdraw.ts'
+import { getBlockedSubdivision, MURALPAY_BLOCKED_COUNTRIES } from '@/utils/muralpay-rails'
 
 const { withdrawData } = useWithdrawContext()
 const { formatMessage } = useVIntl()
@@ -279,6 +289,26 @@ const maxDate = computed(() => {
 
 const countryOptions = useFormattedCountries()
 
+const blockedRegionName = computed(() => {
+	const { country, state } = formData.value.physicalAddress
+	if (!country) return null
+
+	if (MURALPAY_BLOCKED_COUNTRIES.includes(country)) {
+		return countryOptions.value.find((option) => option.value === country)?.label ?? country
+	}
+
+	const subdivision = getBlockedSubdivision(country, state)
+	return subdivision ? formatMessage(subdivision) : null
+})
+
+const rootRef = ref<HTMLElement | null>(null)
+
+watch(blockedRegionName, async (name, previous) => {
+	if (!name || previous) return
+	await nextTick()
+	rootRef.value?.closest('[data-modal-content]')?.scrollTo({ top: 0, behavior: 'smooth' })
+})
+
 const subdivisionOptions = computed(() => {
 	const selectedCountry = formData.value.physicalAddress.country
 	if (!selectedCountry) return []
@@ -373,5 +403,13 @@ const messages = defineMessages({
 		id: 'dashboard.creator-withdraw-modal.kyc.search-countries-placeholder',
 		defaultMessage: 'Search countries...',
 	},
+	blockedRegionHeader: {
+		id: 'dashboard.creator-withdraw-modal.kyc.blocked-region-header',
+		defaultMessage: 'Withdrawals are not supported for this region',
+	},
+	blockedRegionBody: {
+		id: 'dashboard.creator-withdraw-modal.kyc.blocked-region-body',
+		defaultMessage: 'Due to compliance restrictions, we can’t send money to {region}.',
+	},
 })
 </script>
diff --git a/apps/frontend/src/locales/en-US/index.json b/apps/frontend/src/locales/en-US/index.json
index 8f2ef19e2f2..75f21622d66 100644
--- a/apps/frontend/src/locales/en-US/index.json
+++ b/apps/frontend/src/locales/en-US/index.json
@@ -1610,6 +1610,12 @@
   "dashboard.creator-withdraw-modal.fee-breakdown-usd-equivalent": {
     "message": "USD equivalent"
   },
+  "dashboard.creator-withdraw-modal.kyc.blocked-region-body": {
+    "message": "Due to compliance restrictions, we can’t send money to {region}."
+  },
+  "dashboard.creator-withdraw-modal.kyc.blocked-region-header": {
+    "message": "Withdrawals are not supported for this region"
+  },
   "dashboard.creator-withdraw-modal.kyc.business-entity": {
     "message": "Business entity"
   },
@@ -3410,6 +3416,18 @@
   "muralpay.account-type.savings": {
     "message": "Savings"
   },
+  "muralpay.blocked-region.crimea": {
+    "message": "Crimea"
+  },
+  "muralpay.blocked-region.donetsk": {
+    "message": "Donetsk"
+  },
+  "muralpay.blocked-region.luhansk": {
+    "message": "Luhansk"
+  },
+  "muralpay.blocked-region.sevastopol": {
+    "message": "Sevastopol"
+  },
   "muralpay.country.at": {
     "message": "Austria"
   },
diff --git a/apps/frontend/src/providers/creator-withdraw.ts b/apps/frontend/src/providers/creator-withdraw.ts
index db12d7a2055..0dd0ed68c63 100644
--- a/apps/frontend/src/providers/creator-withdraw.ts
+++ b/apps/frontend/src/providers/creator-withdraw.ts
@@ -11,7 +11,7 @@ import type { MessageDescriptor } from '@modrinth/ui'
 import { createContext, getCurrencyIcon, paymentMethodMessages, useDebugLogger } from '@modrinth/ui'
 import { type Component, computed, type ComputedRef, type Ref, ref } from 'vue'
 
-import { type FieldConfig, getRailConfig } from '@/utils/muralpay-rails'
+import { type FieldConfig, getRailConfig, isMuralpayBlockedRegion } from '@/utils/muralpay-rails'
 
 export function getTaxThreshold(thresholds: Record<string, number> | undefined): number {
 	if (!thresholds || Object.keys(thresholds).length === 0) return 600
@@ -705,6 +705,15 @@ export function createWithdrawContext(
 				const kycData = withdrawData.value.providerData.kycData
 				if (!kycData) return false
 
+				if (
+					isMuralpayBlockedRegion(
+						kycData.physicalAddress?.country ?? '',
+						kycData.physicalAddress?.state ?? '',
+					)
+				) {
+					return false
+				}
+
 				const hasValidAddress = !!(
 					kycData.physicalAddress?.address1 &&
 					kycData.physicalAddress?.city &&
diff --git a/apps/frontend/src/utils/muralpay-rails.ts b/apps/frontend/src/utils/muralpay-rails.ts
index fea915a9f75..c9a7ec395ea 100644
--- a/apps/frontend/src/utils/muralpay-rails.ts
+++ b/apps/frontend/src/utils/muralpay-rails.ts
@@ -1023,3 +1023,36 @@ export function getRailConfig(railId: string): RailConfig | undefined {
 export function findRail(railCode: string): RailConfig | undefined {
 	return Object.values(MURALPAY_RAILS).find((rail) => rail.railCode === railCode)
 }
+
+export const MURALPAY_BLOCKED_COUNTRIES = ['CU', 'IR', 'KP', 'RU', 'BY', 'VE']
+export const MURALPAY_BLOCKED_SUBDIVISIONS: Record<string, MessageDescriptor> = {
+	'UA-43': defineMessage({
+		id: 'muralpay.blocked-region.crimea',
+		defaultMessage: 'Crimea',
+	}),
+	'UA-40': defineMessage({
+		id: 'muralpay.blocked-region.sevastopol',
+		defaultMessage: 'Sevastopol',
+	}),
+	'UA-14': defineMessage({
+		id: 'muralpay.blocked-region.donetsk',
+		defaultMessage: 'Donetsk',
+	}),
+	'UA-09': defineMessage({
+		id: 'muralpay.blocked-region.luhansk',
+		defaultMessage: 'Luhansk',
+	}),
+}
+
+export function getBlockedSubdivision(
+	country: string,
+	state: string,
+): MessageDescriptor | undefined {
+	if (!country || !state) return undefined
+	const code = state.startsWith(`${country}-`) ? state : `${country}-${state}`
+	return MURALPAY_BLOCKED_SUBDIVISIONS[code]
+}
+
+export function isMuralpayBlockedRegion(country: string, state: string): boolean {
+	return MURALPAY_BLOCKED_COUNTRIES.includes(country) || !!getBlockedSubdivision(country, state)
+}
diff --git a/apps/labrinth/src/queue/payouts/flow/mural.rs b/apps/labrinth/src/queue/payouts/flow/mural.rs
index 0d56d9e39ad..ac55d132a82 100644
--- a/apps/labrinth/src/queue/payouts/flow/mural.rs
+++ b/apps/labrinth/src/queue/payouts/flow/mural.rs
@@ -43,6 +43,24 @@ pub fn min_usd_fiat(fiat_and_rail_code: FiatAndRailCode) -> Decimal2dp {
 
 pub const MAX_USD: Decimal2dp = Decimal2dp::new_unchecked(dec!(10_000.0));
 
+pub const BLOCKED_COUNTRIES: &[&str] = &["CU", "IR", "KP", "RU", "BY", "VE"];
+pub const BLOCKED_SUBDIVISIONS: &[&str] = &["UA-43", "UA-40", "UA-14", "UA-09"];
+
+fn is_blocked_region(address: &muralpay::PhysicalAddress) -> bool {
+    let country = address.country.alpha2;
+    if BLOCKED_COUNTRIES.contains(&country) {
+        return true;
+    }
+
+    let state = address.state.trim().to_ascii_uppercase();
+    let subdivision = if state.starts_with(&format!("{country}-")) {
+        state
+    } else {
+        format!("{country}-{state}")
+    };
+    BLOCKED_SUBDIVISIONS.contains(&subdivision.as_str())
+}
+
 #[derive(Debug)]
 pub(super) struct MuralFlow {
     net_usd: Decimal2dp,
@@ -57,6 +75,12 @@ pub(super) async fn create(
     amount: Decimal,
     details: MuralPayDetails,
 ) -> Result<PayoutFlow, ApiError> {
+    if is_blocked_region(details.recipient_info.physical_address()) {
+        return Err(ApiError::Request(eyre!(
+            "withdrawals are not supported for this region"
+        )));
+    }
+
     let gross_usd =
         Decimal2dp::new(amount).wrap_request_err("invalid amount")?;
     let platform_fee_usd = Decimal2dp::rounded(
diff --git a/apps/labrinth/src/queue/payouts/mod.rs b/apps/labrinth/src/queue/payouts/mod.rs
index bf81449c649..166851caa67 100644
--- a/apps/labrinth/src/queue/payouts/mod.rs
+++ b/apps/labrinth/src/queue/payouts/mod.rs
@@ -74,6 +74,7 @@ fn create_muralpay_methods() -> Vec<PayoutMethod> {
     let all_countries = rust_iso3166::ALL
         .iter()
         .map(|x| x.alpha2)
+        .filter(|x| !flow::mural::BLOCKED_COUNTRIES.contains(x))
         .collect::<Vec<_>>();
 
     let currencies = vec![