pull down to refresh
Oh no, the point is not that your clients have to trust your intent, but instead trust your security posture. No matter how much you may claim "but we never get any funds" any hacker that DOES infilitrate YOUR service will be able to:
- Falsify claims to the client that the client was paid (i.e. webhook), including potentially receiving product / service from the client because the client does not implement actually checking their actual wallet.
- Change the exchange rate to make the client lose money when paid with Bitcoin.
- Replace the ZPUB of your client with their own.
If the client DOES implement checking their actual wallet... they might as well just implement the rest, which is TINY compared to the work needed to validate that a payment has reached their own wallet.
reply
Both fair, and worth separating.
You are right that derivation is not the service. The verifier exists to make that explicit: it is a commodity you can and should reproduce yourself. What the hosted side does is the operational layer around it, a checkout page the customer sees, fiat to BTC pricing locked at invoice time, per invoice index allocation with no reuse or races, reorg and underpayment handling, and signed webhooks for fulfilment. None of that is cryptographic magic. It is the usual reason people use hosted anything over rolling their own, with the difference that here hosted costs you neither custody nor KYC, and every address it hands out is verifiable.
On the server lying about payment: correct, a paid notification is not proof, and the verifier does not cover it. But the blast radius is bounded, because the coins land in the merchant's own wallet, never ours. We cannot fake money arriving in your wallet. A merchant who wants zero trust confirms receipt in their own wallet or node before fulfilling; the webhook is a convenience signal, not the source of truth. The same tool should let you watch your own derived addresses for the actual funds, so the payment signal becomes something you check too, and I am going to add that.
And yes, a technical merchant can derive from their ZPUB and poll an explorer themselves. That is the self host path and it is legitimate, the same way BTCPay is. BoreLine is for the ones who do not want to run, secure, and keep that service up, and who still refuse to hand over custody or identity to avoid running it. If someone would rather run the script, they should. The point of publishing the verifier is that choosing hosted no longer means trusting us on the thing that matters.