Arándano on nostr

Open in Damus

https://cashu.me wallet fetches mint info from the mint URL specified in a cashu token. This can be used by attackers to log IP address of the users. https://image.nostr.build/a03cefc1380b7053edd95d9...

Arándano @Arándano 1770140093

Me waiting @/dev/fd0 to submit a fix proposal after discovering this attack vector:

1

1. Do not fetch the mint info automatically for untrusted mints. Show the mint URL and ask the user. 2. Use a proxy between wallet and mint. 3. Use Tor and new tor circuits for each request.