i had to do the same, we should probably just drop that MUST

Reply to this note

Please Login to reply.

Discussion

at the end of the day you have to trust the zapper anyways, verification of the bolt11 just makes faking the zap slightly harder but not impossible

yeah, zap verification always seemed like a lot of work for not much gain against real bad actors

Should I log your initial missing payment_hash for Primal team nostr:npub1xdtducdnjerex88gkg2qk2atsdlqsyxqaag4h05jmcpyspqt30wscmntxy ?

Maybe a table for "Zap verification" across clients, with problematic cases in comments? My guess is many clients do very little of it, and if they eventually start doing it they might stumble on the same issues.

Seems ok to me. Is Damus verifying event signatures now? And zaps too?

damus ios has always verified zaps. it also verifies profile signatures so that noone can fake profiles. also when constructing threads it walks nostrdb which verifies all notes. we just haven't completed the full nostrdb migration everywhere yet.

also be careful about albyhub zaps as well:

https://github.com/damus-io/damus/pull/2404

Thanks, that part works fine on my end