From 95cf88f1246118eb6a672a5b4b6545331c9ddef4 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sun, 6 Sep 2026 18:09:16 -0700 Subject: Interim safety for on-chain gifts ahead of the crypto redesign. (1) On-chain (Savings) gift creation now shows a hard bearer-risk warning: the presigned input is redirectable, a sweeper bot is actively front-running shared links, so share privately and claim immediately (Spending/ark gifts are unaffected). (2) The false "success" is fixed: a broadcast returning OK was never proof WE won — a higher-fee sweep can evict our claim (the "claimed! → empty wallet" the bot produced). verifyClaimWon now polls the funding coin after broadcast and, if it settles spent by a txid that isn't ours, retracts the celebration and shows the already-taken screen. Full architectural fix (ephemeral-key gifts, non-malleable SIGHASH_ALL claim) is next MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01MGzU12QrAA4G6BYGzGVdXz --- src/i18n.js | 1 + 1 file changed, 1 insertion(+) (limited to 'src/i18n.js') diff --git a/src/i18n.js b/src/i18n.js index b5db206..86fed95 100644 --- a/src/i18n.js +++ b/src/i18n.js @@ -911,6 +911,7 @@ const STR = { lnPayNetworkFee: 'Network fee', lnPayTotal: 'Total', lnPayConfirm: 'Pay', + giftChainWarn: '\u26a0 On-chain gift links are bearer: anyone who gets the link — or sees the claim on the network — can sweep it. Share it privately and have the recipient claim right away. (A safer redesign is coming; Spending gifts aren\u2019t affected.)', lnAutopayOffer: 'Auto-pay {name} up to {n} next time', lnPaySentTitle: 'Lightning payment sent', lnPaySentBody: 'The swap provider pays the invoice once the on-chain lockup confirms.', -- cgit v1.2.3