[NUT-08] Async-melt change discarded in CheckMeltQuoteState — operator fund loss
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 30/100
Research direction
Start by checking whether the bug still reproduces on upstream main (4614ac2), since the migration did not verify it. The payload names only CheckMeltQuoteState, which should be where the blinding rs values are dropped, and the local audit report §6 is cited but not in the repo. Done means either the change outputs can be unblinded after an async melt, or async-melt quotes are rejected when NUT-08 is unsupported. Choosing between those two fixes needs Cashu wallet knowledge, so confirm the approach with maintainers first.
Written by the indexing model from the issue text.
Description
Migrated from Amperstrand/tollgate-module-basic-go#84 as part of the fork retirement — OpenTollGate/tollgate-module-basic-go is the single source of truth; the fork issue carries the original discussion and any lab evidence. Retirement plan: #758.]
NUT-08 fees/change: Async-melt change is discarded in CheckMeltQuoteState, causing operator fund loss. The function doesn't store the rs values needed to unblind the change outputs.
The mint declares NUT-08 unsupported (consistent), but the wallet's async-melt implementation silently discards change when quotes are checked, which means the operator loses funds when users perform async melts.
Fix: Store rs values in CheckMeltQuoteState to enable change unblinding; or properly reject async-melt quotes if NUT-08 is unsupported.
Evidence: /home/ubuntu/src/tollgate_audit_report_2026-08-26.md §6, line 98; §7
Section reference: /home/ubuntu/src/tollgate_audit_report_2026-08-26.md §6
Migrated 2026-10-09. Applicability to current upstream main (4614ac2, post-rc1) was not re-verified during migration — confirming whether the finding still reproduces upstream is this issue's first task.
- Dominant language
- Go
- Stars
- 12
- Forks
- 14
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 232
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from OpenTollGate/tollgate-module-basic-go
-
Session event emits the customer's MAC address in the p tag — spec-invalid value on every payment responsePossibly taken @Amperstrand claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
OpenTollGate/tollgate-module-basic-go#949 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
OpenTollGate/tollgate-module-basic-go#833 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
OpenTollGate/tollgate-module-basic-go#813 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
OpenTollGate/tollgate-module-basic-go#804 ·
Maintainers usually reply within 1 day
-
go-battery needs an ndsctl on PATH: TestPurchaseSessionGuardHoldsThroughTheOutcomeUnknownWindow fails on bare hosts (passes with stub)Possibly taken @Amperstrand claimed this 5 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
OpenTollGate/tollgate-module-basic-go#726 · 2 comments ·
Maintainers usually reply within 1 day
All issues in OpenTollGate/tollgate-module-basic-go
Similar issues
-
bug
Difficulty 2/5 Half a day Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
kind/bug
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
kubernetes-sigs/external-dns#6816 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
ANSI translator ignores SGR 22/24 (and other attribute-off codes): bold and underline never turn offOpen
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Named Tuple element with a space in its name fails to parsePossibly taken @spicysharkco claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
ClickHouse/clickhouse-go#2073 ·
Maintainers usually reply within 1 day