thesimplekid/satsettle
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

fix: require wallet proof evidence before crediting Cashu (#4) #12

Merged
thesimplekid merged 1 commit from fix/4-cashu-receipt-evidence into main 2026-10-09 14:21:12 +00:00
Conversation 0 Commits 1 Files changed 10 +462 -44
thesimplekid commented 2026-10-09 12:21:36 +00:00
Owner
Copy link

A token spent by another wallet could become a paid intent after recovery and retry: Satsettle trusted a completed CDK transaction even when CDK had restored no outputs. This change requires durable evidence of newly owned wallet proofs before crediting the payment.

The payment ledger checkpoints existing proof IDs and original input IDs before an exclusive receive. CDK continues to handle transport, proof validation and recovery. Satsettle records the value of newly stored derived outputs before another wallet operation can spend them. Cancelled blocking writes retain their ordering guard, and every wallet entry reconciles SDK sagas before starting another operation. This also prevents an interrupted payout reclaim from supplying evidence for an unrelated payment.

Changed areas: payment ledger, receive orchestration/evidence, wallet recovery callers, regression fixtures/tests, and recovery documentation. No custom mint connector or transport is introduced.

Validation:

  • The new spent-elsewhere reproduction failed before the fix and passes afterward.
  • Regressions cover v1/v2 tokens, empty and definitive-error restore responses, existing wallet balances, repeated recovery/restarts, cancelled checkpoint writes, successful SDK completion before the receipt commit, later spending, and interrupted payout reclamation.
  • Legitimate lost-response receives and the existing direct-settlement/manual-capture scenarios pass.
  • Formatting, Clippy and all 48 tests pass on locked CDK 0.18.0 and a separate latest-compatible CDK 0.18.1 resolution.
  • Full x86_64 Linux Nix checks pass, including release tests and documentation. These are local cryptographic protocol fixtures, not live-fund tests; aarch64 was not checked.

Previously unproven SDK transactions are no longer credited from status alone. Historical receipts already issued by older code are not automatically revoked. Exclusive wallet ownership remains required and is documented.

Stacked on #11; the diff contains only the issue #4 fix.

Closes #4.

A token spent by another wallet could become a paid intent after recovery and retry: Satsettle trusted a completed CDK transaction even when CDK had restored no outputs. This change requires durable evidence of newly owned wallet proofs before crediting the payment. The payment ledger checkpoints existing proof IDs and original input IDs before an exclusive receive. CDK continues to handle transport, proof validation and recovery. Satsettle records the value of newly stored derived outputs before another wallet operation can spend them. Cancelled blocking writes retain their ordering guard, and every wallet entry reconciles SDK sagas before starting another operation. This also prevents an interrupted payout reclaim from supplying evidence for an unrelated payment. Changed areas: payment ledger, receive orchestration/evidence, wallet recovery callers, regression fixtures/tests, and recovery documentation. No custom mint connector or transport is introduced. Validation: - The new spent-elsewhere reproduction failed before the fix and passes afterward. - Regressions cover v1/v2 tokens, empty and definitive-error restore responses, existing wallet balances, repeated recovery/restarts, cancelled checkpoint writes, successful SDK completion before the receipt commit, later spending, and interrupted payout reclamation. - Legitimate lost-response receives and the existing direct-settlement/manual-capture scenarios pass. - Formatting, Clippy and all 48 tests pass on locked CDK 0.18.0 and a separate latest-compatible CDK 0.18.1 resolution. - Full x86_64 Linux Nix checks pass, including release tests and documentation. These are local cryptographic protocol fixtures, not live-fund tests; aarch64 was not checked. Previously unproven SDK transactions are no longer credited from status alone. Historical receipts already issued by older code are not automatically revoked. Exclusive wallet ownership remains required and is documented. Stacked on #11; the diff contains only the issue #4 fix. Closes #4.
fix: require wallet proof evidence before crediting Cashu
Some checks failed
Checks / checks (pull_request) Failing after 2s
Details
Checks / format (pull_request) Failing after 2s
Details
Checks / cdk-compatible (pull_request) Failing after 2s
Details
Checks / format (push) Has been cancelled
Details
Checks / checks (push) Has been cancelled
Details
Checks / cdk-compatible (push) Has been cancelled
Details
0669753f0f 
A completed CDK receive transaction can have no recovered outputs. Record
an exclusive receive checkpoint before calling CDK and credit only newly
stored derived proofs, excluding the original inputs and existing balance.

Persist received value before later payouts can consume the proofs. Order
cancelled ledger writes before recovery reads, and reconcile SDK sagas on
every wallet entry so reclaimed funds cannot be attributed to a receive.

Refs: #4
thesimplekid changed target branch from fix/9-cdk-compatibility to main 2026-10-09 14:21:10 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
thesimplekid/satsettle!12
No description provided.