Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[NUT-11] SIG_ALL non-standard construction breaks interop with spec-compliant mints

Open
  • Is something wrong?
#809 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
go
Domain
cryptography, payments

Research direction

The issue names no source files, and its cited audit report sits on a local machine, so start by reading NUT-11 in the Cashu spec and locating the P2PK signing and verification code in this Go repo. The first task is to check whether the SIG_ALL, n_sigs_refund, n_sigs=0, duplicate-key and expired-lock findings still reproduce on upstream main. Done means each finding is either reproduced with a test or closed as no longer applicable.

Written by the indexing model from the issue text.

Description

Migrated from Amperstrand/tollgate-module-basic-go#81 as part of the fork retirement — OpenTollGate/tollgate-module-basic-go is the single source of truth; the fork issue carries the original discussion and any lab evidence. Retirement plan: #758.]

NUT-11 P2PK implementation uses a non-standard SIG_ALL construction that breaks interoperability with spec-compliant mints. Gonuts puts the witness on outputs with per-output signatures over sha256(B_), while the spec requires: first-input witness over aggregated message.

Additional issues:

  • n_sigs_refund tag not implemented at all
  • n_sigs=0 accepted (spec: malformed, MUST reject)
  • Duplicate-key-per-pathway not rejected
  • Expired-lock drops the primary pathway (spec: both continue)

Result: gonuts↔gonuts interop only; cannot interoperate with nutshell/cdk/cashu-ts mints.

Fix: Implement SIG_INPUTS construction per spec; implement missing tag validation; fix expired-lock handling.

Evidence: /home/ubuntu/src/tollgate_audit_report_2026-08-26.md §6, line 101; §7
Section reference: /home/ubuntu/src/tollgate_audit_report_2026-08-26.md §6

Migrated 2026-10-09. Applicability to current upstream main (4614ac2, post-rc1) was not re-verified during migration — confirming whether the finding still reproduces upstream is this issue's first task.

Dominant language
Go
Stars
12
Forks
14
Avg merge
1d 5h
Merged PRs (30d)
239

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from OpenTollGate/tollgate-module-basic-go

All issues in OpenTollGate/tollgate-module-basic-go

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.