Zaps are broken. There is a vulnerability/bug (depending on how you see it) where you could show off on social media that you zapped someone but you could just pay yourself.
Here’s how to reproduce it:
When you click zap, an invoice is fetched from a URL that looks like this
- https://stacker.news/api/lnurlp/02fbae2cc5/pay?SOMECRAP
- Replace 02fbae2cc5 with your own user ID and fetch the invoice and pay it, so you pay yourself. Check the post you’re trying to Zap, it will get updated saying you zapped them. LOL
https://snort.social/e/note1sxedhg4r6tyjamdtr7txzxda5e24tkfxh9amgxs5cpccw3e0v9vs36vfxq
This is an example post, Only one of my zap is real, 2 more I just paid myself.
fiatjaf (npub180c…h6w6) found this out.
Nitesh
npub1qg…g7y7n
2023-02-19 20:07:26
Author Public Key
npub1qgwhaaa2lsp54rl0hfx7qa3z678ax6wlre0em475rhpvl7n54cpqgg7y7nPublished at
2023-02-19 20:07:26Event JSON
{
"id": "d126a2d02dd016fba0b4544aae47b245df213e37c03a2ad938e14a1e4ba3c1c8",
"pubkey": "021d7ef7aafc034a8fefba4de07622d78fd369df1e5f9dd7d41dc2cffa74ae02",
"created_at": 1676837246,
"kind": 1,
"tags": [
[
"p",
"3bf0c63fcb93463407af97a5e5ee64fa883d107ef9e558472c4eb9aaaefa459d"
]
],
"content": "Zaps are broken. There is a vulnerability/bug (depending on how you see it) where you could show off on social media that you zapped someone but you could just pay yourself.\n\nHere’s how to reproduce it:\nWhen you click zap, an invoice is fetched from a URL that looks like this\n\n- https://stacker.news/api/lnurlp/02fbae2cc5/pay?SOMECRAP\n- Replace 02fbae2cc5 with your own user ID and fetch the invoice and pay it, so you pay yourself. Check the post you’re trying to Zap, it will get updated saying you zapped them. LOL\n\nhttps://snort.social/e/note1sxedhg4r6tyjamdtr7txzxda5e24tkfxh9amgxs5cpccw3e0v9vs36vfxq\n\nThis is an example post, Only one of my zap is real, 2 more I just paid myself.\n\n#[0] found this out.",
"sig": "e6fbe593fca7e37d385ce29ef2f50e773cc376677ff4ae3b8f47a96c2dedaabf985b3d74c934b232fe2d8ed67ce5f21450538ba8fa210257c8d9e6cf54065419"
}