CashuPayServer v0.5.9-alpha is out — together with yesterday's v0.5.8, the result of a fourth audit that asked one question: can anyone lose money?
The most serious security one: if the same Cashu token was sent to two payment requests at the same moment, both turned "Paid ✓" while the shop received the money once. Now each shop receives one payment at a time.
The rest of the security and payment fixes:
- Late payments are collected again on busy shops. If the mint or your server was down for more than three days, a customer's payment could stay uncredited as long as new checkouts kept coming in.
- One price source can no longer move fiat prices. With the other providers down, a single bad answer could shift EUR, GBP or CAD prices by up to 25 %, and the wrong rate stuck.
- Backup mints are protected and looked after: removing one with open orders could hide a later payment, and money held there was never moved off retiring keysets.
- A store left behind by whoever claimed setup first (with their mint and their seed) could survive a recovery-code takeover. It is now removed.
But the interesting result: the worst risks to a shop's money were not attackers. They were things that quietly stop working. So 0.5.9 fixes those:
- Automatic withdrawals work above 10,000 sats. On a mint that reserves 1–2 % for Lightning fees, every automatic payout above roughly 10k sats failed, run after run, while the money piled up at the mint.
- Setup now asks where your money should go: paste your Lightning address, it is checked, and payouts happen by themselves. Or choose "Not now" and try it first.
- Customers are never told to pay twice. Paying at the last second used to show "Invoice expired, request a new one". Now the page says not to pay again, keeps checking, and turns to "Payment Complete" when the money arrives.
- Your shop hears about a payment at once, not on the next visitor.
- Alerts by email or a private Nostr DM (NIP-17) when customers can't pay, withdrawals keep failing, or a security update is out.
- A printable recovery sheet: your seed words plus every mint your store has used. The seed alone doesn't tell you which mints to restore from.
- No more white screens at install. Hosting problems now show a plain page with a message to send to your host.
One change in how you upgrade: the zip no longer has a folder of its own. Unpack it straight into your existing installation folder, keeping your data folder. If you unpack it into a new subfolder by mistake, setup notices and tells you which folder to delete.
- Standalone: unpack the new zip into your installation folder, replacing the old files, keeping your data folder.
- WordPress: upload the plugin and choose "Replace current with uploaded".
The database updates itself on your first visit.
About the audit: Opus 5.5 with the Cloudflare security-audit skill (
https://github.com/cloudflare/security-audit-skill), plus separate passes for reliability, the customer at checkout, and a shop owner who has never used SSH. Every finding was reproduced in a sandbox and checked by independent verifiers before it counted.
👉 Download:
https://github.com/jooray/cashupayserver/releases/tag/v0.5.9-alpha
