some clients do not validate that a zap actually happened, they don't verify signatures.
Discussion
but the zap receipt is not created by the client, the LNURL server is the one to publish the zap receipt when the invoice is paid
From NIP-57: "The zap receipt is not a proof of payment, all it proves is that some nostr user fetched an invoice. The existence of the zap receipt implies the invoice as paid, but it could be a lie given a rogue implementation."
So all you need is a rogue lightning node.
yeah, or a user pretending to be a lightning node posting fake bolt11 invoices :)
