I love how this note was (apparently?) zapped 1000 bitcoin. Don't spend it all at once.

Reply to this note

Please Login to reply.

Discussion

Are clients verifying the authenticity of zaps? Probably not, it is too cumbersome. Cashu-based zaps would probably make that much easier..

Gossip (in nostr-types) is apparently not doing it sufficiently. Looking over NIP-57 again, I'm seeing things I don't recall when I wrote the code. I'll get this issue fixed.

Verify the p tag, find its metadata, fetch its LUD address, extract the pubkey from the HTTP response and then validate the zap pubkey against that? I guess it's not that hard, but if the zap provider pubkey was included directly in the receiver metadata that would be much better.

Impossible since people can just send between two wallets multiple times.