brugeman
· 23w
How can they still be rugged if mint and it's LN backend are both in the enclave and keys never leave and enclave termination is solved by backups?
There are some critical ways in which backups won't help in a Cashu context. The backup can actually be the source of the rug, since the only way a Cashu mint can function is by being a single, authoritative entity. (Double spend and all that.) That means a backup CANNOT be restored unless that specific backup is to take over as the single, authoritative entity, and this leads to all sorts of problems that in the end can only be solved if all backups are under centralised control.
And even if this was solvable, a backup is a snapshot in time, and even if backups are frequent the rug event can easily happen in the shortest of missing time-gaps.
More minor, mint is on an ICANN URL first, and the operator is going to be in control that URL, so there's that.
And other things. For example a vulnerability is discovered and you need to update the code of the mint, or the node, or both, you cannot leave them online in the vulnerable state, they must be shut off. In that case the backups all share this vulnerability, so they are of no use. You need a stable and discoverable source for the new code's hash that has been publicly vetted and which the orchestrator enclave can use to fan out to the fleet, and a smart contract on blockchain can provide that much better than a signed nostr event or something else.