Skip to content

NIP-61 replay protection: commit to P and e in Cashu proof #2104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
callebtc wants to merge 4 commits into
base: master
Choose a base branch
from
Open

NIP-61 replay protection: commit to P and e in Cashu proof #2104

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f5169c3
add e tag, improve wording, clarify proof tags in nostr event
callebtc Oct 31, 2025
dfa7d16
Merge branch 'master' into nip-61-commit-to-event
callebtc Oct 31, 2025
d1cd02b
fix proof
callebtc Oct 31, 2025
7811c1d
add P tag to Cashu proofs secret
callebtc Oct 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
add P tag to Cashu proofs secret
  • Loading branch information
@callebtc
callebtc committed Oct 31, 2025
commit 7811c1d5cacf902cad5f03ee9c08d40ddb546d5c
13 changes: 7 additions & 6 deletions 61.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ Alice wants to nutzap 1 sat to Bob for an event `nutzapped-event-id` she liked.

### Alice nutzaps Bob
1. Alice fetches event `kind:10019` from Bob to see the mints Bob trusts.
2. She mints or swaps ecash at that mint with a P2PK lock that contains the pubkey Bob listed in his `kind:10019` and an `e` tag of the event `nutzapped-event-id` to zap.
2. She mints or swaps ecash at that mint with a P2PK lock that contains the pubkey Bob listed in his `kind:10019`, a `P` tag with the sender's pubkey, and an `e` tag of the event `nutzapped-event-id` to zap.
3. She publishes a `kind:9321` event to the relays Bob indicated with the proofs she minted.

### Bob receives the nutzap
Expand Down Expand Up @@ -43,15 +43,15 @@ Alice wants to nutzap 1 sat to Bob for an event `nutzapped-event-id` she liked.
Event `kind:9321` is a nutzap event published by the sender, p-tagging the recipient. The outputs are P2PK-locked to the public key the recipient indicated in their `kind:10019` event and with a P2PK secret that commits to the event id `nutzapped-event-id` to zap.

##### Cashu proof
A NIP-61 zap contains one or more Cashu proofs with a [NUT-12](https://github.com/cashubtc/nuts/blob/main/11.md) P2PK lock. The proof's `secret` has the receiver's `p2pk-pubkey` in `data` and the zapped event's id `e` tag. The proof also contains a [NUT-12](https://github.com/cashubtc/nuts/blob/main/12.md) DLEQ field `dleq`.
A NIP-61 zap contains one or more Cashu proofs with a [NUT-12](https://github.com/cashubtc/nuts/blob/main/11.md) P2PK lock. The proof's `secret` has the receiver's `p2pk-pubkey` in `data` field. The `tags` field of the `secret` contains a `P` tag with the sender's pubkey `sender-pubkey` and the zapped event's id `e`. The proof also contains a [NUT-12](https://github.com/cashubtc/nuts/blob/main/12.md) DLEQ field `dleq`.

Clients MUST prefix the receiver's `p2pk-pubkey` with `"02"` (for nostr<>cashu compatibility).
```jsonc
{
"amount":2,
"C":"0302f4aacbfa5da455b884501ebcbd4c9c3cc6640daa7269f640aa70522727b790",
"id":"00da2cc2b0016589",
"secret":"[\"P2PK\", {\"data\": \"029128d0918cd2241e92968c2d5f8eb6ba9b6adf3cd7bd0a5c82c64400470f9a86\", \"nonce\": \"ec2180143de3341e47eeaa1ec41d37fc\", \"tags\": [[\"e\", \"nutzapped-event-id\"]]}]",
"secret":"[\"P2PK\", {\"data\": \"029128d0918cd2241e92968c2d5f8eb6ba9b6adf3cd7bd0a5c82c64400470f9a86\", \"nonce\": \"43e0d7c14e20616850f540b5dec96006\", \"tags\": [[\"e\", \"nutzapped-event-id\"], [\"P\", \"sender-pubkey\"]]}]",
"dleq":{
"r":"e5f0c29513ef7e0b0b1798be8f7ca7940296833a7e723e16ba2162299c77d183",
"s":"12fdde66b4bc26fc76f11f88aae527fb1642c0fb4066d06db8a3c6976a224205",
Expand All @@ -70,7 +70,7 @@ The nutzap event contains one or more serialized Cashu proofs.
"content": "Thanks for this great idea.",
"pubkey": "<sender-pubkey>",
"tags": [
[ "proof", "{\"amount\": 2, \"C\": \"0302f4aacbfa5da455b884501ebcbd4c9c3cc6640daa7269f640aa70522727b790\", \"id\": \"00da2cc2b0016589\", \"secret\": \"[\\\"P2PK\\\", {\\\"data\\\": \\\"029128d0918cd2241e92968c2d5f8eb6ba9b6adf3cd7bd0a5c82c64400470f9a86\\\", \\\"nonce\\\": \\\"ec2180143de3341e47eeaa1ec41d37fc\\\", \\\"tags\\\": [[\\\"e\\\", \\\"nutzapped-event-id\\\"]]}]\", \"dleq\": {\"r\": \"e5f0c29513ef7e0b0b1798be8f7ca7940296833a7e723e16ba2162299c77d183\", \"s\": \"12fdde66b4bc26fc76f11f88aae527fb1642c0fb4066d06db8a3c6976a224205\", \"e\": \"9df01b6421926fd04521185d3264eed99a4c0951d8c247f0f8f1244d340d5e06\"}}"],
[ "proof", "{\"amount\": 2, \"C\": \"0302f4aacbfa5da455b884501ebcbd4c9c3cc6640daa7269f640aa70522727b790\", \"id\": \"00da2cc2b0016589\", \"secret\": \"[\\\"P2PK\\\", {\\\"data\\\": \\\"029128d0918cd2241e92968c2d5f8eb6ba9b6adf3cd7bd0a5c82c64400470f9a86\\\", \\\"nonce\\\": \\\"43e0d7c14e20616850f540b5dec96006\\\", \\\"tags\\\": [[\\\"e\\\", \\\"nutzapped-event-id\\\"], [\\\"P\\\", \\\"sender-pubkey\\\"]]}]\", \"dleq\": {\"r\": \"e5f0c29513ef7e0b0b1798be8f7ca7940296833a7e723e16ba2162299c77d183\", \"s\": \"12fdde66b4bc26fc76f11f88aae527fb1642c0fb4066d06db8a3c6976a224205\", \"e\": \"9df01b6421926fd04521185d3264eed99a4c0951d8c247f0f8f1244d340d5e06\"}}"],
[ "unit", "sat" ],
[ "u", "https://stablenut.umint.cash" ],
[ "e", "<nutzapped-event-id>", "<relay-hint>" ],
Expand All @@ -82,13 +82,13 @@ The nutzap event contains one or more serialized Cashu proofs.

* `.content` is an optional comment for the nutzap
* `.tags`:
* `proof` is one P2PK-locked proof to the public key the recipient specified in their `kind:10019` event, an optional `e` tag committing to `nutzapped-event-id`, and a DLEQ proof. Multiple `proof` tags may be added - one proof per tag.
* `proof` is one P2PK-locked proof to the public key the recipient specified in their `kind:10019` event, a `P` tag committing to the sender's pubkey `sender-pubkey`, an optional `e` tag committing to `nutzapped-event-id`, and a DLEQ proof. Multiple `proof` tags may be added - one proof per tag.
* `unit` the base unit the proofs are denominated in (eg: `sat`, `usd`, `eur`). Default: `sat` if omitted.
* `u` is the mint the URL of the mint EXACTLY as specified by the recipient's `kind:10019`.
* `p` is the Nostr identity public key of nutzap recipient.
* `e` is the event that is being nutzapped, if any.

Note that the optional `e` tag is contained in the proof's `secret` as well as in the Nostr event.
Note that the optional `e` tag is contained in the Cashu proof's `secret` as well as in the Nostr event. The `P` tag in the Cashu proof is the `pubkey` in the nutzap event.

## Sending a nutzap

Expand Down Expand Up @@ -136,6 +136,7 @@ When listing or counting zaps received by any given event, observer clients SHOU

* check that the receiving user has issued a `kind:10019` tagging the mint where the cashu has been minted.
* check that the Cashu proofs are locked to the pubkey the user has listed in their `kind:10019`.
* check that the Cashu proof's secret contains a `P` that equals the `pubkey` of the nutzap event.
* check that the Cashu proofs' secrets contain an `e` tag that equals the zapped event's id.
* look at the `u` tag and check that the token is issued in one of the mints listed in the `kind:10019`.
* verify the DLEQs of the proofs using the public keysets of the mint.
Expand Down