Replying to nitesh

Zaps are broken. There is a vulnerability/bug (depending on how you see it) where you could show off on social media that you zapped someone but you could just pay yourself.

Here’s how to reproduce it:

When you click zap, an invoice is fetched from a URL that looks like this

- https://stacker.news/api/lnurlp/02fbae2cc5/pay?SOMECRAP

- Replace 02fbae2cc5 with your own user ID and fetch the invoice and pay it, so you pay yourself. Check the post you’re trying to Zap, it will get updated saying you zapped them. LOL

https://snort.social/e/note1sxedhg4r6tyjamdtr7txzxda5e24tkfxh9amgxs5cpccw3e0v9vs36vfxq

This is an example post, Only one of my zap is real, 2 more I just paid myself.

#[0] found this out.

key in your note is "show off"

we are having wild days right now, innovation is huge

wait for some weeks

if a note doesn't have signal in it, why should there be massive zaps

calma, nothing is broken

Reply to this note

Please Login to reply.

Discussion

Dude. You’re missing the point. We can’t have holes like this, this could also be a vulnerability.

o.k. then - I was missing the point.