Replying to Avatar Sjors Provoost

Just realized there was a plugin. A bit annoying that it needs (?) a private key to receive zaps, but I guess that's part of the protocol.

Please try again...
Avatar
jb55 2y ago

Huh? The zapper key can be random

Reply to this note

Please Login to reply.

Discussion

Avatar
kukks 2y ago

Wtf? I assumed it was supposed to have been signed by the zapper else anyone can just lie about zaps from everyone?

Avatar
jb55 2y ago

It does, but the zapper key itself can be a random key. Is the concern that #[5]​ had to use his privkey ? Maybe I misunderstood.

Avatar
jb55 2y ago

Damus validates that the nostrPubkey matches the zap pubkey, and also validates the deschash

Avatar
thesimplekid 2y ago

More clients should probably check this not all of them do

Avatar
jb55 2y ago

That’s really bad. zaps are completely broken without that check.

Avatar
Carman 2y ago

Yeah I did a fake zap to #[9]​ and could see it on snort

Avatar
Sjors Provoost 2y ago

The plugin asked, so I gave it. I'm a simple man.

Avatar
0xtr 2y ago

😂

Avatar
jb55 2y ago

It should probably just generate a random key… it’s not supposed to be your key

Avatar
kukks 2y ago

I was under the assumption that the nostrpubkey provided in the lnurlp should match the nip5 or the user being zapped so that the payment request is actually receipted by that same user? Maybe we cna make the nip a bit clearer if that isn't the case.