Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[NUT-11] SIG_ALL non-standard construction breaks interop with spec-compliant mints

Abierto
  • ¿Algo no está bien?
#809 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
25/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
go
Área
cryptography, payments

Línea de trabajo

The issue names no source files, and its cited audit report sits on a local machine, so start by reading NUT-11 in the Cashu spec and locating the P2PK signing and verification code in this Go repo. The first task is to check whether the SIG_ALL, n_sigs_refund, n_sigs=0, duplicate-key and expired-lock findings still reproduce on upstream main. Done means each finding is either reproduced with a test or closed as no longer applicable.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Migrated from Amperstrand/tollgate-module-basic-go#81 as part of the fork retirement — OpenTollGate/tollgate-module-basic-go is the single source of truth; the fork issue carries the original discussion and any lab evidence. Retirement plan: #758.]

NUT-11 P2PK implementation uses a non-standard SIG_ALL construction that breaks interoperability with spec-compliant mints. Gonuts puts the witness on outputs with per-output signatures over sha256(B_), while the spec requires: first-input witness over aggregated message.

Additional issues:

  • n_sigs_refund tag not implemented at all
  • n_sigs=0 accepted (spec: malformed, MUST reject)
  • Duplicate-key-per-pathway not rejected
  • Expired-lock drops the primary pathway (spec: both continue)

Result: gonuts↔gonuts interop only; cannot interoperate with nutshell/cdk/cashu-ts mints.

Fix: Implement SIG_INPUTS construction per spec; implement missing tag validation; fix expired-lock handling.

Evidence: /home/ubuntu/src/tollgate_audit_report_2026-08-26.md §6, line 101; §7
Section reference: /home/ubuntu/src/tollgate_audit_report_2026-08-26.md §6

Migrated 2026-10-09. Applicability to current upstream main (4614ac2, post-rc1) was not re-verified during migration — confirming whether the finding still reproduces upstream is this issue's first task.

Lenguaje dominante
Go
Estrellas
12
Forks
14
Merge medio
1 d 6 h
PR fusionados (30 d)
234

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de OpenTollGate/tollgate-module-basic-go

Todos los issues de OpenTollGate/tollgate-module-basic-go

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.