pull down to refresh
Good point. Sampled manual verification does not scale: a compromised host can serve correct addresses for the ones a merchant checks and substitute the rest.
The mitigation I am implementing is per invoice verification that runs on the merchant's side, against a key the server never provides. For each invoice the server returns only the derivation index and the issued address. A verifier the merchant runs re-derives m/0/index from their own zpub and confirms the match before the payment link is shared. Because the derivation code ships from the public repo and the key comes from the merchant, the server cannot satisfy the check with a substituted address.
Two forms, identical logic: a single self contained HTML file for users who would rather not run code, and a CLI script that can run on a schedule and exit nonzero on a mismatch for alerting. Neither sends the key anywhere.
This is additive. Derivation and settlement are unchanged; the verifier is an independent check on top, not a change to the flow.
On VLS and Greenlight: on chain receiving takes no signature, so there is no direct analogue to a signer that must co approve each invoice. The equivalent here is independent per address verification against the merchant's own key rather than protocol level approval. Useful framing though.
How many addresses can a human being practically validate by hand? A hijacked server can honestly show N honest addresses in the verify page, then hijack N+1... onwards, trusting that the human will not actually validate ALL the signatures.
Another compromise would be the Greenlight strategy built with VLS. Greenlight hosts CLN nodes, but the signer is a VLS that you host on your own hardware (ideally in a RaspPi in your basement). Invoices are signed by VLS, so that even if the CLN node is compromised, it cannot issue invoices unless VLS agrees it ends up getting paid to the VLS key.
Another compromise is to run CLBOSS so that you do not have to babysit a Lightning Network node. You still need a bitcoind but bitcoind is a lot more start-and-forget than LN nodes.