fix: improve legacy quote signature fallback

Log accepted legacy NUT-20 quote signatures on mint-side verification
for single and batch mint requests.

Preserve the original mint rejection when wallet legacy fallback
preparation, signing, or retry fails, while logging the fallback error.

Reject legacy batch signing when request quotes and quote metadata are
not positionally aligned.

Author: thesimplekid

crates/cashu/src/nuts/nut20.rs

@@ -119,12 +119,21 @@ where
 
         let signature = Signature::from_str(signature).map_err(|_| Error::InvalidSignature)?;
 
-        let msg_to_sign = self.msg_to_sign();
+        let quote_id = self.quote.to_string();
+        let msg_to_sign = mint_quote_msg_to_sign(&quote_id, &self.outputs);
 
         match pubkey.verify(&msg_to_sign, &signature) {
-            Ok(()) => Ok(()),
-            Err(_) => pubkey.verify(&self.legacy_msg_to_sign(), &signature),
-        }?;
+            Ok(()) => return Ok(()),
+            Err(_) => {
+                let legacy_msg = legacy_mint_quote_msg_to_sign(&quote_id, &self.outputs);
+                pubkey.verify(&legacy_msg, &signature)?;
+                tracing::warn!(
+                    quote_id = %quote_id,
+                    output_count = self.outputs.len(),
+                    "Accepted legacy mint quote signature format"
+                );
+            }
+        }
 
         Ok(())
     }

crates/cashu/src/nuts/nut29.rs

@@ -117,13 +117,23 @@ where
         let signature = signature
             .parse::<Signature>()
             .map_err(|_| super::nut20::Error::InvalidSignature)?;
-        let msg = self.msg_to_sign(quote);
+        let quote_id = quote.to_string();
+        let msg = mint_quote_msg_to_sign(&quote_id, &self.outputs);
 
         match pubkey.verify(&msg, &signature) {
-            Ok(()) => Ok(()),
-            Err(_) => pubkey.verify(&self.legacy_msg_to_sign(quote), &signature),
+            Ok(()) => return Ok(()),
+            Err(_) => {
+                let legacy_msg = legacy_mint_quote_msg_to_sign(&quote_id, &self.outputs);
+                pubkey
+                    .verify(&legacy_msg, &signature)
+                    .map_err(|_| super::nut20::Error::InvalidSignature)?;
+                tracing::warn!(
+                    quote_id = %quote_id,
+                    output_count = self.outputs.len(),
+                    "Accepted legacy batch mint quote signature format"
+                );
+            }
         }
-        .map_err(|_| super::nut20::Error::InvalidSignature)?;
 
         Ok(())
     }
@@ -240,6 +250,28 @@ mod tests {
             .expect("verification should succeed with correct key");
     }
 
+    #[test]
+    fn test_sign_and_verify_batch_quote_legacy_roundtrip() {
+        let secret_key = SecretKey::generate();
+        let pubkey = secret_key.public_key();
+        let quote_id = "test-quote-id-legacy".to_string();
+        let outputs = vec![dummy_blinded_message(), dummy_blinded_message()];
+        let request = BatchMintRequest {
+            quotes: vec![quote_id.clone()],
+            quote_amounts: None,
+            outputs,
+            signatures: None,
+        };
+
+        let signature = request
+            .sign_quote_legacy(&quote_id, &secret_key)
+            .expect("legacy signing should succeed");
+
+        request
+            .verify_quote_signature(&quote_id, &signature, &pubkey)
+            .expect("verification should fall back to the legacy message format");
+    }
+
     #[test]
     fn test_verify_batch_quote_wrong_key() {
         let signing_key = SecretKey::generate();
@@ -371,26 +403,4 @@ mod tests {
         assert!(!Settings::new(None, Some(vec!["bolt11".to_string()])).is_empty());
         assert!(!Settings::new(Some(10), Some(vec!["bolt11".to_string()])).is_empty());
     }
-
-    #[test]
-    fn msg_to_sign_concatenates_quote_and_each_output_secret() {
-        let quote_id = "quote-id".to_string();
-        let output_1 = dummy_blinded_message();
-        let output_2 = dummy_blinded_message();
-        let expected = format!(
-            "{}{}{}",
-            quote_id,
-            output_1.blinded_secret.to_hex(),
-            output_2.blinded_secret.to_hex()
-        )
-        .into_bytes();
-        let request = BatchMintRequest {
-            quotes: vec![quote_id.clone()],
-            quote_amounts: None,
-            outputs: vec![output_1, output_2],
-            signatures: None,
-        };
-
-        assert_eq!(request.msg_to_sign(&quote_id), expected);
-    }
 }

crates/cdk/src/wallet/issue/saga/mod.rs

@@ -88,18 +88,44 @@ async fn post_mint_request_with_legacy_fallback(
         {
             Ok(response) => Ok(response),
             Err(error) if should_retry_with_legacy_quote_signature(&error) => {
-                let Some(secret_key) = wallet.mint_quote_signing_key(quote_info).await? else {
-                    return Err(error);
+                let secret_key = match wallet.mint_quote_signing_key(quote_info).await {
+                    Ok(Some(secret_key)) => secret_key,
+                    Ok(None) => return Err(error),
+                    Err(fallback_error) => {
+                        tracing::warn!(
+                            original_error = %error,
+                            fallback_error = %fallback_error,
+                            "Could not prepare legacy mint quote signature retry; returning original mint error"
+                        );
+                        return Err(error);
+                    }
                 };
 
                 tracing::info!(
                     "Mint request rejected with new NUT-20 signature format; retrying legacy format"
                 );
 
                 let mut retry_request = request.clone();
-                retry_request.sign_legacy(secret_key)?;
+                if let Err(fallback_error) = retry_request.sign_legacy(secret_key) {
+                    tracing::warn!(
+                        original_error = %error,
+                        fallback_error = %fallback_error,
+                        "Could not sign legacy mint quote retry; returning original mint error"
+                    );
+                    return Err(error);
+                }
 
-                wallet.client.post_mint(payment_method, retry_request).await
+                match wallet.client.post_mint(payment_method, retry_request).await {
+                    Ok(response) => Ok(response),
+                    Err(fallback_error) => {
+                        tracing::warn!(
+                            original_error = %error,
+                            fallback_error = %fallback_error,
+                            "Legacy mint quote signature retry failed; returning original mint error"
+                        );
+                        Err(error)
+                    }
+                }
             }
             Err(error) => Err(error),
         },
@@ -115,10 +141,23 @@ async fn post_mint_request_with_legacy_fallback(
             {
                 Ok(response) => Ok(response),
                 Err(error) if should_retry_with_legacy_quote_signature(&error) => {
-                    let Some(legacy_signatures) =
-                        legacy_batch_signatures(wallet, request, quote_infos).await?
-                    else {
-                        return Err(error);
+                    let legacy_signatures = match legacy_batch_signatures(
+                        wallet,
+                        request,
+                        quote_infos,
+                    )
+                    .await
+                    {
+                        Ok(Some(legacy_signatures)) => legacy_signatures,
+                        Ok(None) => return Err(error),
+                        Err(fallback_error) => {
+                            tracing::warn!(
+                                original_error = %error,
+                                fallback_error = %fallback_error,
+                                "Could not prepare legacy batch mint quote signature retry; returning original mint error"
+                            );
+                            return Err(error);
+                        }
                     };
 
                     tracing::info!(
@@ -132,6 +171,14 @@ async fn post_mint_request_with_legacy_fallback(
                         .client
                         .post_batch_mint(payment_method, retry_request)
                         .await
+                        .map_err(|fallback_error| {
+                            tracing::warn!(
+                                original_error = %error,
+                                fallback_error = %fallback_error,
+                                "Legacy batch mint quote signature retry failed; returning original mint error"
+                            );
+                            error
+                        })
                 }
                 Err(error) => Err(error),
             }
@@ -156,6 +203,10 @@ async fn legacy_batch_signatures(
     for ((quote_id, quote_info), signature) in
         request.quotes.iter().zip(quote_infos).zip(signatures)
     {
+        if quote_info.id.as_str() != quote_id.as_str() {
+            return Ok(None);
+        }
+
         if signature.is_some() {
             let Some(secret_key) = wallet.mint_quote_signing_key(quote_info).await? else {
                 return Ok(None);
@@ -964,7 +1015,7 @@ mod tests {
     use cdk_common::nuts::MintQuoteState;
 
     use super::*;
-    use crate::nuts::{BlindSignature, BlindedMessage, MintResponse};
+    use crate::nuts::{BatchMintRequest, BlindSignature, BlindedMessage, MintResponse};
     use crate::wallet::test_utils::{
         create_test_db, create_test_wallet_with_mock, test_mint_quote, test_mint_url,
         MockMintConnector,
@@ -1022,7 +1073,9 @@ mod tests {
             .expect("prepare mint saga");
 
         mock_client.push_post_mint_response(Err(Error::SignatureMissingOrInvalid));
-        mock_client.push_post_mint_response(Err(Error::SignatureMissingOrInvalid));
+        mock_client.push_post_mint_response(Err(Error::Custom(
+            "legacy retry should not replace original error".to_string(),
+        )));
 
         let result = prepared.execute().await;
 
@@ -1079,7 +1132,9 @@ mod tests {
             .expect("prepare batch mint saga");
 
         mock_client.push_post_batch_mint_response(Err(Error::SignatureMissingOrInvalid));
-        mock_client.push_post_batch_mint_response(Err(Error::SignatureMissingOrInvalid));
+        mock_client.push_post_batch_mint_response(Err(Error::Custom(
+            "legacy retry should not replace original error".to_string(),
+        )));
 
         let result = prepared.execute().await;
 
@@ -1126,6 +1181,28 @@ mod tests {
         assert_eq!(first_request.outputs, legacy_request.outputs);
     }
 
+    #[tokio::test]
+    async fn test_legacy_batch_signatures_rejects_misaligned_quote_infos() {
+        let db = create_test_db().await;
+        let mint_url = test_mint_url();
+        let mock_client = Arc::new(MockMintConnector::new());
+        let wallet = create_test_wallet_with_mock(db, mock_client).await;
+
+        let request = BatchMintRequest {
+            quotes: vec!["request-quote-id".to_string()],
+            quote_amounts: None,
+            outputs: vec![],
+            signatures: Some(vec![Some("signature-placeholder".to_string())]),
+        };
+        let quote_infos = vec![test_mint_quote(mint_url)];
+
+        let result = legacy_batch_signatures(&wallet, &request, &quote_infos)
+            .await
+            .expect("alignment check should not fail");
+
+        assert!(result.is_none());
+    }
+
     #[tokio::test]
     async fn test_execute_rejects_signature_with_mismatched_amount() {
         let db = create_test_db().await;