Are clients verifying the authenticity of zaps? Probably not, it is too cumbersome. Cashu-based zaps would probably make that much easier..
Login to reply
Replies (3)
Gossip (in nostr-types) is apparently not doing it sufficiently. Looking over NIP-57 again, I'm seeing things I don't recall when I wrote the code. I'll get this issue fixed.
Verify the p tag, find its metadata, fetch its LUD address, extract the pubkey from the HTTP response and then validate the zap pubkey against that? I guess it's not that hard, but if the zap provider pubkey was included directly in the receiver metadata that would be much better.
Impossible since people can just send between two wallets multiple times.