I’m digging into the 9735 events you’re publishing like https://gateway.no.str.cr/e/5f9bd289af634f911a3e6795e0bd1fa17e6bced1fc45861e7c46274f89d314e5
Discussion
Thank you. If you check that event, the SHA256() of the description tag == commit hash of the bolt11 invoice.
Here is proof:
Commit hash:
61e3345be17aaea73029440186e1b292f16470d50bdd39deb2e954077a5e4eda
Check here:
Sha256(description_tag):
61e3345be17aaea73029440186e1b292f16470d50bdd39deb2e954077a5e4eda
Check here: https://emn178.github.io/online-tools/sha256.html
Does the nostrPubkey on the lnaddress match the pubkey on the 9735 event? Thats the only other check it makes
Ah shiiiii I've put the user's pubkey there not the bot's
thanks will let me fix dat real quick
cc #[5] you should also make this check or else anyone can forge zaps by replaying zap requests
