Six months ago i discovered a severe vulnerability in Cashu affecting most major wallets, which would let a malicious mint steal money from users.
See the link to my blog for a full description, but the TLDR is that Cashu spec for deterministic wallets - NUT-13 - contained a small oversight which allowed a malicious mint to trick Cashu clients into revealing secrets meant for an unrelated target mint. Using some math and leveraging the authentic mint as an oracle, a malicious mint operator could steal a target mint's ecash proofs from users, and claim the money for himself.
Thanks to the good work of cashu devs like @calle and lollerfirst it has since been patched, with stable long-term protocol-level fixes coming soon.
Even though most of the math is something I'd have to puzzle over (and perhaps take a refresher course to get), I enjoyed your blog post. I'm reminded once again that cryptography is really really hard to for well. Hard off to people who build tools that use it in novel ways -- and to people like yourself who poke around to find vulnerabilities like this.
As far as I understand, if a mint wants to cheat, it is better off just rug pulling all its users by nuking the database and withdrawing the funds from the node. Stealing particular tokens is not worth the effort.
This isn't about a mint stealing funds from its own users. It's about a malicious mint stealing funds from users of another mint. E.g. you trust Alice's mint and have $1000 on there. You don't trust Bob's mint, but someone airdrops you $5 in ecash from Bob's mint. You try to transfer (melt) the ecash to Alice's mint (which you trust) but doing so allows Bob to steal the $1000 of valid ecash that you already had on Alice's mint.
Oh, that would be really bad. Thanks. Reading your paper...
Tienes muchas razón
Feels less like a “market shift” and more like the predictable outcome of policy piling up.
Thank you
what vulnerability did this guy find then?
Another one 🫣
https://twiiit.com/i/status/1979648693159842240
Forward! Well done let’s keep building
Deterministic wallets are powerful but they must be designed with careful compartmentalization to prevent one actor in the system from influencing another. The community should continue to document these incidents in detail because each one adds to the collective knowledge base that helps prevent similar issues in the future.
Where is @DarthCoin? Ecash technically isn't Bitcoin and qualifies as a shitcoin under the qualifications he uses. Did he downzap you like he does everyone else that posts about anything he considers a "shitcoin?" Ya know @k00b keeps downzaps having so much more weight to keep darth happy by being able to control what people see and don't see with his downzapping