CashuPayServer v0.5.9-alpha is out — together with yesterday's v0.5.8, the result of a fourth audit that asked one question: can anyone lose money?
The most serious security one: if the same Cashu token was sent to two payment requests at the same moment, both turned "Paid ✓" while the shop received the money once. Now each shop receives one payment at a time.
The rest of the security and payment fixes:
- Late payments are collected again on busy shops. If the mint or your server was down for more than three days, a customer's payment could stay uncredited as long as new checkouts kept coming in.
- One price source can no longer move fiat prices. With the other providers down, a single bad answer could shift EUR, GBP or CAD prices by up to 25 %, and the wrong rate stuck.
- Backup mints are protected and looked after: removing one with open orders could hide a later payment, and money held there was never moved off retiring keysets.
- A store left behind by whoever claimed setup first (with their mint and their seed) could survive a recovery-code takeover. It is now removed.
But the interesting result: the worst risks to a shop's money were not attackers. They were things that quietly stop working. So 0.5.9 fixes those:
- Automatic withdrawals work above 10,000 sats. On a mint that reserves 1–2 % for Lightning fees, every automatic payout above roughly 10k sats failed, run after run, while the money piled up at the mint.
- Setup now asks where your money should go: paste your Lightning address, it is checked, and payouts happen by themselves. Or choose "Not now" and try it first.
- Customers are never told to pay twice. Paying at the last second used to show "Invoice expired, request a new one". Now the page says not to pay again, keeps checking, and turns to "Payment Complete" when the money arrives.
- Your shop hears about a payment at once, not on the next visitor.
- Alerts by email or a private Nostr DM (NIP-17) when customers can't pay, withdrawals keep failing, or a security update is out.
- A printable recovery sheet: your seed words plus every mint your store has used. The seed alone doesn't tell you which mints to restore from.
- No more white screens at install. Hosting problems now show a plain page with a message to send to your host.
One change in how you upgrade: the zip no longer has a folder of its own. Unpack it straight into your existing installation folder, keeping your data folder. If you unpack it into a new subfolder by mistake, setup notices and tells you which folder to delete.
- Standalone: unpack the new zip into your installation folder, replacing the old files, keeping your data folder.
- WordPress: upload the plugin and choose "Replace current with uploaded".
The database updates itself on your first visit.
About the audit: Opus 5.5 with the Cloudflare security-audit skill (https://github.com/cloudflare/security-audit-skill), plus separate passes for reliability, the customer at checkout, and a shop owner who has never used SSH. Every finding was reproduced in a sandbox and checked by independent verifiers before it counted.
👉 Download: https://github.com/jooray/cashupayserver/releases/tag/v0.5.9-alpha
Cashu Pay Server
npub18s…nalja
2026-10-31 15:17:00 UTC
Author Public Key
npub18scydh6yusrkhe67f8uz9mnxxt5znae59ctvhxxpzefkf7xwnx4q0naljaPublished at
2026-10-31 15:17:00 UTCEvent JSON
{
"id": "91755396fe68075ecfd4d5d5800fa9984d64b16962f685d3a4ff53f61464dc91",
"pubkey": "3c3046df44e4076be75e49f822ee6632e829f7342e16cb98c1165364f8ce99aa",
"created_at": 1793459820,
"kind": 1,
"tags": [],
"content": "CashuPayServer v0.5.9-alpha is out — together with yesterday's v0.5.8, the result of a fourth audit that asked one question: can anyone lose money?\n\nThe most serious security one: if the same Cashu token was sent to two payment requests at the same moment, both turned \"Paid ✓\" while the shop received the money once. Now each shop receives one payment at a time.\n\nThe rest of the security and payment fixes:\n\n- Late payments are collected again on busy shops. If the mint or your server was down for more than three days, a customer's payment could stay uncredited as long as new checkouts kept coming in.\n- One price source can no longer move fiat prices. With the other providers down, a single bad answer could shift EUR, GBP or CAD prices by up to 25 %, and the wrong rate stuck.\n- Backup mints are protected and looked after: removing one with open orders could hide a later payment, and money held there was never moved off retiring keysets.\n- A store left behind by whoever claimed setup first (with their mint and their seed) could survive a recovery-code takeover. It is now removed.\n\nBut the interesting result: the worst risks to a shop's money were not attackers. They were things that quietly stop working. So 0.5.9 fixes those:\n\n- Automatic withdrawals work above 10,000 sats. On a mint that reserves 1–2 % for Lightning fees, every automatic payout above roughly 10k sats failed, run after run, while the money piled up at the mint.\n- Setup now asks where your money should go: paste your Lightning address, it is checked, and payouts happen by themselves. Or choose \"Not now\" and try it first.\n- Customers are never told to pay twice. Paying at the last second used to show \"Invoice expired, request a new one\". Now the page says not to pay again, keeps checking, and turns to \"Payment Complete\" when the money arrives.\n- Your shop hears about a payment at once, not on the next visitor.\n- Alerts by email or a private Nostr DM (NIP-17) when customers can't pay, withdrawals keep failing, or a security update is out.\n- A printable recovery sheet: your seed words plus every mint your store has used. The seed alone doesn't tell you which mints to restore from.\n- No more white screens at install. Hosting problems now show a plain page with a message to send to your host.\n\nOne change in how you upgrade: the zip no longer has a folder of its own. Unpack it straight into your existing installation folder, keeping your data folder. If you unpack it into a new subfolder by mistake, setup notices and tells you which folder to delete.\n- Standalone: unpack the new zip into your installation folder, replacing the old files, keeping your data folder.\n- WordPress: upload the plugin and choose \"Replace current with uploaded\".\n\nThe database updates itself on your first visit.\n\nAbout the audit: Opus 5.5 with the Cloudflare security-audit skill (https://github.com/cloudflare/security-audit-skill), plus separate passes for reliability, the customer at checkout, and a shop owner who has never used SSH. Every finding was reproduced in a sandbox and checked by independent verifiers before it counted.\n\n👉 Download: https://github.com/jooray/cashupayserver/releases/tag/v0.5.9-alpha",
"sig": "23f9b1e3a6181408795419824fb8d463b26db6b5e21fa9f3e12f9617a18d56f90b908a9fbafe82017c8f24582a51db080824c4e136b04e4f0ef3528a15431a7d"
}