ecash: redeem tokens by melting to the user's own invoice

Redeeming ecash is now a plain NUT-05 melt into a Lightning invoice owned
by the redeeming user, credited by the regular lightning listener. Drop
the house proof pool and its lock, the /mint and /melt routes, and the
special-casing of a mint account in NWC and payment routing. Tokens are
decoded against the mint's keyset list so short v1 ids resolve, and an
empty keyset list is never cached.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

2 files changed, 148 insertions, 160 deletions

diff --git a/lib/ecash.ts b/lib/ecash.ts
index b1d8b7fb..e9e099c3 100644
--- a/lib/ecash.ts
+++ b/lib/ecash.ts
@@ -1,101 +1,44 @@
 import config from "$config";
-import { db, g } from "$lib/db";
-import { lnb } from "$lib/ln";
+import { g } from "$lib/db";
+import { generate } from "$lib/invoices";
 import { warn } from "$lib/logging";
 import { safeGot } from "$lib/safe-fetch";
-import { fail, wait } from "$lib/utils";
+import { PaymentType } from "$lib/types";
+import { fail, getPayment, sleep, wait } from "$lib/utils";
 import {
   CashuMint,
   CashuWallet,
-  MintQuoteState,
   PaymentRequest,
   PaymentRequestTransportType,
   getDecodedToken,
-  getEncodedToken,
 } from "@cashu/cashu-ts";
 
-
 const { URL } = process.env;
 const m = new CashuMint(config.mintUrl);
 
-// The mint issues NUT-02 v1 keyset ids (`01…`, 33 bytes). cashu-ts 2.9.0 only
-// derives v0 ids, so CashuWallet.getKeys() rejects every keyset with "Couldn't
-// verify keyset ID" and receive()/send() can never run — ecash claims have been
-// failing since the July keyset cutover. (4.x derives v1 ids, but not the way
-// this nutshell build does, so upgrading wouldn't help either.) config.mintUrl
-// is our own mint, so skip the derivation check: CashuMint.getKeys() returns
-// the keys unverified, and a wallet constructed with them preloaded uses them
-// as-is. Re-fetched periodically so a keyset rotation is picked up.
-const KEYS_TTL = 10 * 60 * 1000;
-let cached: { w: CashuWallet; keysets: any[]; at: number } | undefined;
-const wallet = async () => {
-  if (cached && Date.now() - cached.at < KEYS_TTL) return cached;
-  const [{ keysets: keys }, { keysets }] = await Promise.all([
-    m.getKeys(),
-    m.getKeySets(),
-  ]);
-  const w = new CashuWallet(m, { keys, keysets });
-  cached = { w, keysets, at: Date.now() };
-  return cached;
-};
-
-// 2.9.0 writes v1 keyset ids into V4 tokens in their 8-byte short form, and
-// refuses to decode a short id unless it's handed the mint's keysets to expand
-// it against — so every token we encode (the house pool included) has to be
-// decoded through here rather than with a bare getDecodedToken().
-const decode = async (token) =>
-  getDecodedToken(token, (await wallet()).keysets);
-
-const enc = (proofs) =>
-  getEncodedToken({
-    mint: config.mintUrl,
-    proofs,
-  });
+// Redeeming ecash is a plain NUT-05 melt: the proofs pay a Lightning invoice
+// that belongs to the redeeming user, and the settlement is credited by the
+// regular lightning listener like any other incoming payment. The mint's node
+// is our own, so the melt is a self-payment on cl — nothing is held in a house
+// wallet and no proofs are swapped or stored on our side.
 
-// The house wallet is a single encoded token under the `cash` key. g() JSON-
-// parses whatever is stored there, and the key has been found holding a bare
-// integer — getDecodedToken(number) then threw "n.startsWith is not a function"
-// on every claim. Only trust the value when it decodes; otherwise start from
-// no proofs and let the next write replace it.
-export const pool = async () => {
-  const v = await g("cash");
-  if (typeof v === "string") {
-    try {
-      return (await decode(v)).proofs;
-    } catch (e: any) {
-      warn("cash pool token unreadable, treating as empty:", e.message);
-    }
-  } else {
-    warn("cash pool key is not a token, treating as empty:", typeof v);
-  }
-  return [];
+// cashu-ts 2.9.0 writes v1 keyset ids into V4 tokens in their 8-byte short form
+// and refuses to decode a short id unless it's handed the mint's keysets to
+// expand it against. config.mintUrl fronts every keyset we've ever issued, so
+// its list is enough to decode any token of ours.
+const KEYSETS_TTL = 10 * 60 * 1000;
+let cached: { keysets: any[]; at: number } | undefined;
+const keysets = async () => {
+  if (cached && Date.now() - cached.at < KEYSETS_TTL) return cached.keysets;
+  const { keysets } = await m.getKeySets();
+  // Never cache an empty list: a token can't be decoded or fee-checked
+  // against it, and the next call should try the mint again.
+  if (!keysets?.length) fail("Mint keysets unavailable");
+  cached = { keysets, at: Date.now() };
+  return keysets;
 };
 
-// s() is fire-and-forget; a dropped write here would silently strand the
-// proofs we just swapped in, so await the set directly.
-const setPool = (proofs) => db.set("cash", JSON.stringify(enc(proofs)));
-
-// Serialize every read-modify-write of the shared `cash` house-wallet token. The
-// mint swap sits between reading the current proofs and writing the merged set,
-// so two concurrent claim()/mint() calls would each read the same `current` and
-// the later write would clobber the earlier — the earlier call's freshly-swapped
-// proofs vanish from the stored token while both users stay credited (an
-// insolvency leak). This mutex is in-process; if the server ever runs
-// multi-process, move to a redis lock (WATCH/MULTI or SET NX).
-let cashLock: Promise<void> = Promise.resolve();
-const withCashLock = async <T>(fn: () => Promise<T>): Promise<T> => {
-  const prev = cashLock;
-  let release: () => void = () => {};
-  cashLock = new Promise((res) => {
-    release = res;
-  });
-  await prev;
-  try {
-    return await fn();
-  } finally {
-    release();
-  }
-};
+const decode = async (token) => getDecodedToken(token, await keysets());
 
 // `mint` comes straight out of an attacker-supplied cashu token, and this is
 // the first thing we do with it — so fetching it with cashu-ts's plain fetch
@@ -112,68 +55,112 @@ const ext = async (mint) => {
   return issuerPk !== ourPk;
 };
 
+const sum = (proofs) => proofs.reduce((a, p) => a + p.amount, 0);
+
+// NUT-02 input fee: ceil of the summed per-proof ppk.
+const inputFee = (proofs, ks) =>
+  Math.ceil(
+    proofs.reduce(
+      (a, p) => a + (ks.find((k) => k.id === p.id)?.input_fee_ppk || 0),
+      0,
+    ) / 1000,
+  );
+
+// nutshell's Lightning fee reserve: max(lightning_reserve_fee_min = 2 sat,
+// lightning_fee_percent = 1%), rounded up to whole sats. The actual routing fee
+// of a self-payment is zero, but without NUT-08 change outputs the mint keeps
+// the reserve — it's our mint, so nothing leaves the system.
+const reserve = (amount) => Math.max(2, Math.ceil(amount / 100));
+
 export async function get(id) {
   const token = await g(`cash:${id}`);
   return token;
 }
 
-export async function claim(token) {
-  const { mint } = await decode(token);
-
+// Melt `token` into a Lightning invoice owned by `user`. With `invoice` (a
+// NUT-18 payment-request invoice of type ecash) the Lightning invoice takes
+// over that id, so whatever is waiting on it sees the payment land. Returns
+// the amount the user receives: the token's value less the mint's input fee
+// and Lightning fee reserve.
+export async function redeem({ token, user, invoice = undefined, memo = undefined }) {
+  const { mint, proofs } = await decode(token);
+  if (!proofs?.length) fail("Token has no proofs");
   if (await ext(mint)) fail("Unable to receive from other mints");
 
-  const { w } = await wallet();
-  return withCashLock(async () => {
-    const current = await pool();
-    const rcvd = await w.receive(token);
-    await setPool([...current, ...rcvd]);
-    return rcvd.reduce((a, b) => a + b.amount, 0);
-  });
-}
+  // Cheap pre-check so a spent token fails before an invoice is created for
+  // it (the melt would reject it anyway, but not before leaving an unpaid
+  // invoice on the user's account).
+  const states = await new CashuWallet(m).checkProofsStates(proofs);
+  if (states.some((p) => p.state !== "UNSPENT")) fail("Token already spent");
 
-export async function mint(amount) {
-  const { w } = await wallet();
-  return withCashLock(async () => {
-    const proofs = await pool();
-    const { send, keep } = await w.send(amount, proofs);
-    const rcvd = await w.receive(enc(send));
-    await setPool(keep);
-    return enc(rcvd);
+  const ks = await keysets();
+  const total = sum(proofs);
+  const fees = inputFee(proofs, ks);
+  let amount = total - fees - 2;
+  while (amount > 0 && amount + reserve(amount) + fees > total) amount--;
+  if (amount < 1) fail("Token is too small to redeem");
+
+  invoice = await generate({
+    invoice: {
+      ...(invoice ?? {}),
+      id: invoice?.id,
+      amount,
+      // The invoice amount is exactly what the melt can cover: no tip on top,
+      // and no fiat re-pricing of it.
+      tip: null,
+      fiat: undefined,
+      bolt11: undefined,
+      bolt12: undefined,
+      memo: memo ?? invoice?.memo,
+      type: PaymentType.lightning,
+    },
+    user,
   });
+
+  const quote = await m.createMeltQuote({ unit: "sat", request: invoice.text });
+  if (quote.amount + quote.fee_reserve + fees > total)
+    fail("Mint fee reserve exceeds the token's value");
+
+  let r = await m.melt({ quote: quote.quote, inputs: proofs });
+  for (let i = 0; r.state === "PENDING" && i < 60; i++) {
+    await sleep(1000);
+    r = await m.checkMeltQuote(quote.quote);
+  }
+  if (r.state === "PENDING")
+    fail("Redemption is still settling; the funds will arrive once it does");
+  if (r.state !== "PAID") fail("Redemption failed");
+
+  // The lightning listener credits the settlement. Give it a moment so the
+  // caller's payment list already shows it, but the credit doesn't depend on
+  // this wait.
+  try {
+    await wait(() => getPayment(invoice.hash), 50, 200);
+  } catch {
+    warn("ecash redeemed but credit not yet visible", user.username, invoice.hash);
+  }
+
+  return amount;
 }
 
 export async function check(token) {
   const { mint, proofs } = await decode(token);
-  const total = proofs.reduce((a, b) => a + b.amount, 0);
+  const total = sum(proofs);
 
   const external = await ext(mint);
 
-  const { w } = await wallet();
+  // Only ask our own mint about proof states; an external mint URL is never
+  // contacted with cashu-ts's unpinned fetch.
   let spent = 0;
-  for (const [i, p] of (await w.checkProofsStates(proofs)).entries()) {
-    if (p.state === "SPENT") spent += proofs[i].amount;
+  if (!external) {
+    const w = new CashuWallet(m);
+    for (const [i, p] of (await w.checkProofsStates(proofs)).entries()) {
+      if (p.state === "SPENT") spent += proofs[i].amount;
+    }
   }
 
   return { total, spent, mint, external };
 }
 
-export async function init(amount = 100000) {
-  try {
-    await new Promise((r) => setTimeout(r, 2000));
-    const { w } = await wallet();
-    const { quote, request } = await w.createMintQuote(amount);
-    await lnb.pay(request);
-
-    await wait(async () => {
-      const { state } = await w.checkMintQuote(quote);
-      return state === MintQuoteState.PAID;
-    });
-
-    const proofs = await w.mintProofs(amount, quote);
-    await setPool(proofs);
-  } catch (e) {}
-}
-
 export function request(uuid, amount, memo) {
   const target = `${URL}/api/ecash/${uuid}`;
 
diff --git a/lib/nwc.ts b/lib/nwc.ts
index a15d6c86..5dba6e97 100644
--- a/lib/nwc.ts
+++ b/lib/nwc.ts
@@ -657,9 +657,12 @@ const handle = (method, params, ev, app, user) =>
 
       if (payee === id) {
         const invoice = await getInvoice(pr);
-        const recipient = await g(`user:${invoice.uid}`);
+        const recipient = await g(`user:${invoice?.uid}`);
 
-        if (recipient?.username !== "mint") {
+        // No coinos invoice record means the bolt11 is on our node but not
+        // ours to settle internally (a mint quote, say) — pay it over
+        // Lightning below like any other.
+        if (invoice) {
           const { id: pid } = await sendInternal({
             amount,
             invoice,
@@ -823,48 +826,46 @@ const handle = (method, params, ev, app, user) =>
       if (invoice) {
         const recipient = await g(`user:${invoice.uid}`);
 
-        if (recipient?.username !== "mint") {
-          // Internal settlement never builds a bolt12 invoice request, so the
-          // spec's deliver-or-reject rule for payer_note is met by handing the
-          // note to the recipient as the payment memo (bolt11 + payer_note was
-          // already rejected above)
-          const { id: pid } = await sendInternal({
-            amount,
-            invoice,
-            memo: payer_note,
-            recipient,
-            sender: user,
-            maxTotal: remaining,
-          });
+        // Internal settlement never builds a bolt12 invoice request, so the
+        // spec's deliver-or-reject rule for payer_note is met by handing the
+        // note to the recipient as the payment memo (bolt11 + payer_note was
+        // already rejected above)
+        const { id: pid } = await sendInternal({
+          amount,
+          invoice,
+          memo: payer_note,
+          recipient,
+          sender: user,
+          maxTotal: remaining,
+        });
 
-          await db.lPush(`${pubkey}:payments`, pid);
+        await db.lPush(`${pubkey}:payments`, pid);
 
-          if (invoice.memo?.includes("9734")) {
-            const { invoices } = await ln.listinvoices({ invstring: pr });
-            const inv = invoices[0];
-            if (inv) {
-              inv.payment_preimage = pid;
-              inv.paid_at = created_at;
-              try {
-                await handleZap(inv, user.pubkey);
-              } catch (e) {
-                console.log("zap receipt failed", e);
-              }
+        if (invoice.memo?.includes("9734")) {
+          const { invoices } = await ln.listinvoices({ invstring: pr });
+          const inv = invoices[0];
+          if (inv) {
+            inv.payment_preimage = pid;
+            inv.paid_at = created_at;
+            try {
+              await handleZap(inv, user.pubkey);
+            } catch (e) {
+              console.log("zap receipt failed", e);
             }
           }
-
-          // Internal settlement never touches CLN, so there's no real
-          // preimage or payer proof to hand back
-          return result({
-            transaction_id: pid,
-            state: "settled",
-            instruction_type,
-            amount: amountMsat,
-            fees_paid: 0,
-            created_at,
-            settled_at: Math.floor(Date.now() / 1000),
-          });
         }
+
+        // Internal settlement never touches CLN, so there's no real
+        // preimage or payer proof to hand back
+        return result({
+          transaction_id: pid,
+          state: "settled",
+          instruction_type,
+          amount: amountMsat,
+          fees_paid: 0,
+          created_at,
+          settled_at: Math.floor(Date.now() / 1000),
+        });
       }
 
       try {