From a0829612b8751e85f28d066fbaa0c2308a85fbda Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Mon, 19 Oct 2026 22:13:54 -0700 Subject: Zaps are signed as the person zapping: the login identity (extension, bunker, passkey, Google) when there is one, else the wallet's key. They were always signed by the wallet's own key, so a signed-in person's zaps showed in stream chats and streamers' overlays under a stranger npub. Zap requests also carry created_at now (a real signer refused them without it). Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_013ZDf1cyCQLkfjftYhymZAg --- src/lnurl.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/lnurl.js') diff --git a/src/lnurl.js b/src/lnurl.js index 592d143..134edcf 100644 --- a/src/lnurl.js +++ b/src/lnurl.js @@ -132,7 +132,7 @@ export function buildZapRequest({ amountMsat, relays, lnurlBech32, recipientPk, const addr = zapAddrOf(eventId); if (addr) tags.push(['a', addr]); tags.push(...momentTags(moment)); - return signFn({ kind: 9734, content: comment || '', tags }); + return signFn({ kind: 9734, created_at: Math.floor(Date.now() / 1000), content: comment || '', tags }); } // GET the callback for a bolt11. When zapRequest is present this is a real zap; -- cgit v1.2.3