fix: htlc and p2pk conditions with spec update (#1435)

Author: thesimplekid

crates/cashu/src/nuts/nut10.rs

@@ -136,6 +136,12 @@ impl Proof {
     }
 
     /// Verify P2PK signature on [Proof]
+    ///
+    /// Per NUT-11, there are two spending pathways after locktime:
+    /// 1. Primary path (data + pubkeys): ALWAYS available
+    /// 2. Refund path (refund keys): available AFTER locktime
+    ///
+    /// The verification tries both paths - if either succeeds, the proof is valid.
     pub fn verify_p2pk(&self) -> Result<(), Error> {
         let secret: Nut10Secret = self.secret.clone().try_into()?;
         let spending_conditions: Conditions = secret
@@ -153,40 +159,70 @@ impl Proof {
             return Err(Error::IncorrectSecretKind);
         }
 
-        // Based on the current time, we must identify the relevant keys
+        // Get spending requirements (includes both primary and refund paths)
         let now = unix_time();
         let requirements = super::nut10::get_pubkeys_and_required_sigs(&secret, now)?;
 
         if requirements.preimage_needed {
             return Err(Error::PreimageNotSupportedInP2PK);
         }
 
-        // Handle "anyone can spend" case (locktime passed with no refund keys)
-        if requirements.required_sigs == 0 {
-            return Ok(());
-        }
-
         // Extract witness signatures
         let witness_signatures = match &self.witness {
             Some(witness) => witness.signatures(),
             None => None,
         };
-        let witness_signatures = witness_signatures.ok_or(Error::SignaturesNotProvided)?;
 
-        // Count valid signatures using relevant_pubkeys
         let msg: &[u8] = self.secret.as_bytes();
-        let valid_sig_count = valid_signatures(
-            msg,
-            &requirements.pubkeys,
-            &witness_signatures
-                .iter()
-                .map(|s| Signature::from_str(s))
-                .collect::<Result<Vec<_>, _>>()?,
-        )?;
 
-        // Check if we have enough valid signatures
-        if valid_sig_count >= requirements.required_sigs {
-            Ok(())
+        // Try primary path first (data + pubkeys)
+        // Per NUT-11: "Locktime Multisig conditions continue to apply"
+        {
+            let primary_valid = witness_signatures
+                .as_ref()
+                .and_then(|sigs| {
+                    sigs.iter()
+                        .map(|s| Signature::from_str(s))
+                        .collect::<Result<Vec<_>, _>>()
+                        .ok()
+                })
+                .and_then(|sigs| valid_signatures(msg, &requirements.pubkeys, &sigs).ok())
+                .is_some_and(|count| count >= requirements.required_sigs);
+
+            if primary_valid {
+                return Ok(());
+            }
+        }
+
+        // Primary path failed or no signatures - try refund path if available
+        {
+            if let Some(refund_path) = &requirements.refund_path {
+                // Anyone can spend (locktime passed, no refund keys)
+                if refund_path.required_sigs == 0 {
+                    return Ok(());
+                }
+
+                // Need signatures for refund path
+                let refund_valid = witness_signatures
+                    .as_ref()
+                    .and_then(|sigs| {
+                        sigs.iter()
+                            .map(|s| Signature::from_str(s))
+                            .collect::<Result<Vec<_>, _>>()
+                            .ok()
+                    })
+                    .and_then(|sigs| valid_signatures(msg, &refund_path.pubkeys, &sigs).ok())
+                    .is_some_and(|count| count >= refund_path.required_sigs);
+
+                if refund_valid {
+                    return Ok(());
+                }
+            }
+        }
+
+        // Neither path succeeded
+        if witness_signatures.is_none() {
+            Err(Error::SignaturesNotProvided)
         } else {
             Err(Error::SpendConditionsNotMet)
         }
@@ -1138,14 +1174,22 @@ mod tests {
 
         proof.sign_p2pk(signing_key_three.clone()).unwrap();
 
-        assert!(proof.verify_p2pk().is_err());
+        // Per NUT-11: primary path (pubkeys) is ALWAYS available, even after locktime
+        // Signing with a key from pubkeys should succeed
+        assert!(proof.verify_p2pk().is_ok());
 
         proof.witness = None;
 
+        // Sign with secret_key (pubkey = v_key, which is the data key and part of primary path)
+        // Per NUT-11: primary path is always available, and data key is part of primary path
         proof.sign_p2pk(secret_key).unwrap();
-        assert!(proof.verify_p2pk().is_err());
-        proof.sign_p2pk(signing_key_two).unwrap();
+        assert!(
+            proof.verify_p2pk().is_ok(),
+            "Data key signature should satisfy primary path"
+        );
 
+        // Adding more signatures still works (but wasn't needed for primary path)
+        proof.sign_p2pk(signing_key_two).unwrap();
         assert!(proof.verify_p2pk().is_ok());
     }
 
@@ -1725,15 +1769,17 @@ mod tests {
 
     #[test]
     fn test_sig_all_htlc_post_locktime() {
-        // The following is a valid SwapRequest with a multisig HTLC also locked to locktime and refund keys.
+        // The following is a valid SwapRequest with a multisig HTLC using the refund path.
+        // Per NUT-14: After locktime, the refund path is available when preimage is invalid/missing.
+        // The preimage is intentionally invalid (all zeros) to test the refund path.
         let valid_swap = r#"{
               "inputs": [
                 {
                   "amount": 2,
                   "id": "00bfa73302d12ffd",
                   "secret": "[\"HTLC\",{\"nonce\":\"c9b0fabb8007c0db4bef64d5d128cdcf3c79e8bb780c3294adf4c88e96c32647\",\"data\":\"ec4916dd28fc4c10d78e287ca5d9cc51ee1ae73cbfde08c6b37324cbfaac8bc5\",\"tags\":[[\"pubkeys\",\"039e6ec7e922abb4162235b3a42965eb11510b07b7461f6b1a17478b1c9c64d100\"],[\"locktime\",\"1\"],[\"refund\",\"02ce1bbd2c9a4be8029c9a6435ad601c45677f5cde81f8a7f0ed535e0039d0eb6c\",\"03c43c00ff57f63cfa9e732f0520c342123e21331d0121139f1b636921eeec095f\"],[\"n_sigs_refund\",\"2\"],[\"sigflag\",\"SIG_ALL\"]]}]",
                   "C": "0344b6f1471cf18a8cbae0e624018c816be5e3a9b04dcb7689f64173c1ae90a3a5",
-                  "witness": "{\"preimage\":\"0000000000000000000000000000000000000000000000000000000000000001\",\"signatures\":[\"98e21672d409cc782c720f203d8284f0af0c8713f18167499f9f101b7050c3e657fb0e57478ebd8bd561c31aa6c30f4cd20ec38c73f5755b7b4ddee693bca5a5\",\"693f40129dbf905ed9c8008081c694f72a36de354f9f4fa7a61b389cf781f62a0ae0586612fb2eb504faaf897fefb6742309186117f4743bcebcb8e350e975e2\"]}"
+                  "witness": "{\"preimage\":\"0000000000000000000000000000000000000000000000000000000000000000\",\"signatures\":[\"98e21672d409cc782c720f203d8284f0af0c8713f18167499f9f101b7050c3e657fb0e57478ebd8bd561c31aa6c30f4cd20ec38c73f5755b7b4ddee693bca5a5\",\"693f40129dbf905ed9c8008081c694f72a36de354f9f4fa7a61b389cf781f62a0ae0586612fb2eb504faaf897fefb6742309186117f4743bcebcb8e350e975e2\"]}"
                 }
               ],
               "outputs": [

crates/cashu/src/nuts/nut11/mod.rs

@@ -94,6 +94,13 @@ impl HTLCWitness {
 
 impl Proof {
     /// Verify HTLC
+    ///
+    /// Per NUT-14, there are two spending pathways:
+    /// 1. Receiver path (preimage + pubkeys): ALWAYS available
+    /// 2. Sender/Refund path (refund keys, no preimage): available AFTER locktime
+    ///
+    /// The verification tries to determine which path is being used based on
+    /// the witness provided, then validates accordingly.
     pub fn verify_htlc(&self) -> Result<(), Error> {
         let secret: Secret = self.secret.clone().try_into()?;
         let spending_conditions: Conditions = secret
@@ -111,65 +118,86 @@ impl Proof {
             return Err(Error::IncorrectSecretKind);
         }
 
-        // Get the appropriate spending conditions based on locktime
+        // Get the spending requirements (includes both receiver and refund paths)
         let now = unix_time();
         let requirements =
             super::nut10::get_pubkeys_and_required_sigs(&secret, now).map_err(Error::NUT11)?;
 
-        // While a Witness is usually needed in a P2PK or HTLC proof, it's not
-        // always needed. If we are past the locktime, and there are no refund
-        // keys, then the proofs are anyone-can-spend:
-        //     NUT-11: "If the tag locktime is the unix time and the mint's local
-        //              clock is greater than locktime, the Proof becomes spendable
-        //              by anyone, except if [there are no refund keys]"
-        // Therefore, this function should not extract any Witness unless it
-        // is needed to get a preimage or signatures.
-
-        // If preimage is needed (before locktime), verify it
-        if requirements.preimage_needed {
-            // Extract HTLC witness
-            let htlc_witness = match &self.witness {
-                Some(Witness::HTLCWitness(witness)) => witness,
-                _ => return Err(Error::IncorrectSecretKind),
-            };
-
-            // Verify preimage using shared function
-            super::nut10::verify_htlc_preimage(htlc_witness, &secret)?;
-        }
-
-        if requirements.required_sigs == 0 {
-            return Ok(());
-        }
-
-        // if we get here, the preimage check (if it was needed) has been done
-        // and we know that at least one signature is required. So, we extract
-        // the witness.signatures and count them:
-
-        // Extract witness signatures
+        // Try to extract HTLC witness - must be correct type
         let htlc_witness = match &self.witness {
             Some(Witness::HTLCWitness(witness)) => witness,
-            _ => return Err(Error::IncorrectSecretKind),
+            _ => {
+                // Wrong witness type or no witness
+                // If refund path is available with 0 required sigs, anyone can spend
+                if let Some(refund_path) = &requirements.refund_path {
+                    if refund_path.required_sigs == 0 {
+                        return Ok(());
+                    }
+                }
+                return Err(Error::IncorrectSecretKind);
+            }
         };
-        let witness_signatures = htlc_witness
-            .signatures
-            .as_ref()
-            .ok_or(Error::SignaturesNotProvided)?;
 
-        // Convert signatures from strings
-        let signatures: Vec<Signature> = witness_signatures
-            .iter()
-            .map(|s| Signature::from_str(s))
-            .collect::<Result<Vec<_>, _>>()?;
-
-        // Count valid signatures using relevant_pubkeys
-        let msg: &[u8] = self.secret.as_bytes();
-        let valid_sig_count = valid_signatures(msg, &requirements.pubkeys, &signatures)?;
-
-        // Check if we have enough valid signatures
-        if valid_sig_count >= requirements.required_sigs {
-            Ok(())
+        // Try to verify the preimage and capture the specific error if it fails
+        let preimage_result = super::nut10::verify_htlc_preimage(htlc_witness, &secret);
+
+        // Determine which path to use:
+        // - If preimage is valid → use receiver path (always available)
+        // - If preimage is invalid/missing → try refund path (if available)
+        if preimage_result.is_ok() {
+            // Receiver path: preimage valid, now check signatures against pubkeys
+            if requirements.required_sigs == 0 {
+                return Ok(());
+            }
+
+            let witness_signatures = htlc_witness
+                .signatures
+                .as_ref()
+                .ok_or(Error::SignaturesNotProvided)?;
+
+            let signatures: Vec<Signature> = witness_signatures
+                .iter()
+                .map(|s| Signature::from_str(s))
+                .collect::<Result<Vec<_>, _>>()?;
+
+            let msg: &[u8] = self.secret.as_bytes();
+            let valid_sig_count = valid_signatures(msg, &requirements.pubkeys, &signatures)?;
+
+            if valid_sig_count >= requirements.required_sigs {
+                Ok(())
+            } else {
+                Err(Error::NUT11(super::nut11::Error::SpendConditionsNotMet))
+            }
+        } else if let Some(refund_path) = &requirements.refund_path {
+            // Refund path: preimage not valid/provided, but locktime has passed
+            // Check signatures against refund keys
+            if refund_path.required_sigs == 0 {
+                // Anyone can spend (locktime passed, no refund keys)
+                return Ok(());
+            }
+
+            let witness_signatures = htlc_witness
+                .signatures
+                .as_ref()
+                .ok_or(Error::SignaturesNotProvided)?;
+
+            let signatures: Vec<Signature> = witness_signatures
+                .iter()
+                .map(|s| Signature::from_str(s))
+                .collect::<Result<Vec<_>, _>>()?;
+
+            let msg: &[u8] = self.secret.as_bytes();
+            let valid_sig_count = valid_signatures(msg, &refund_path.pubkeys, &signatures)?;
+
+            if valid_sig_count >= refund_path.required_sigs {
+                Ok(())
+            } else {
+                Err(Error::NUT11(super::nut11::Error::SpendConditionsNotMet))
+            }
         } else {
-            Err(Error::NUT11(super::nut11::Error::SpendConditionsNotMet))
+            // No valid preimage and refund path not available (locktime not passed)
+            // Return the specific error from preimage verification
+            preimage_result
         }
     }
 
@@ -411,25 +439,26 @@ mod tests {
 
     /// Tests that verify_htlc requires BOTH locktime expired AND no refund keys for "anyone can spend".
     ///
-    /// This test catches the mutation that replaces `&&` with `||` at line 83.
-    /// The logic should be: (locktime expired AND no refund keys) → anyone can spend.
-    /// If mutated to OR, it would allow spending when locktime passed even if refund keys exist.
+    /// This test verifies that when locktime has passed and refund keys are present,
+    /// a signature from the refund keys is required (not anyone-can-spend).
     ///
-    /// Mutant testing: Catches mutations that replace `&&` with `||` in the locktime check.
+    /// Per NUT-14: After locktime, the refund path requires signatures from refund keys.
+    /// The "anyone can spend" case only applies when locktime passed AND no refund keys.
     #[test]
     fn test_htlc_locktime_and_refund_keys_logic() {
         use crate::nuts::nut01::PublicKey;
         use crate::nuts::nut11::Conditions;
 
-        let preimage_bytes = [42u8; 32]; // 32-byte preimage
-        let hash = Sha256Hash::hash(&preimage_bytes);
+        let correct_preimage_bytes = [42u8; 32]; // 32-byte preimage
+        let hash = Sha256Hash::hash(&correct_preimage_bytes);
         let hash_str = hash.to_string();
 
+        // Use WRONG preimage to force using refund path (not receiver path)
+        let wrong_preimage_bytes = [99u8; 32];
+
         // Test: Locktime has passed (locktime=1) but refund keys ARE present
-        // With correct logic (&&): Since refund_keys.is_none() is false, the "anyone can spend"
-        //                          path is NOT taken, so signature is required
-        // With mutation (||): Since locktime.lt(&unix_time()) is true, it WOULD take the
-        //                     "anyone can spend" path immediately - WRONG!
+        // Since we provide wrong preimage, receiver path fails, so we try refund path.
+        // Refund path with refund keys present should require a signature.
         let refund_pubkey = PublicKey::from_hex(
             "02a9acc1e48c25eeeb9289b5031cc57da9fe72f3fe2861d264bdc074209b107ba2",
         )
@@ -448,8 +477,8 @@ mod tests {
         let secret: SecretString = nut10_secret.try_into().unwrap();
 
         let htlc_witness = HTLCWitness {
-            preimage: hex::encode(&preimage_bytes),
-            signatures: None, // No signature provided
+            preimage: hex::encode(&wrong_preimage_bytes), // Wrong preimage!
+            signatures: None,                             // No signature provided
         };
 
         let proof = Proof {
@@ -464,13 +493,15 @@ mod tests {
             dleq: None,
         };
 
-        // Should FAIL because even though locktime passed, refund keys are present
-        // so the "anyone can spend" shortcut shouldn't apply. A signature is required.
-        // With && this correctly fails. With || it would incorrectly pass.
+        // Should FAIL because:
+        // 1. Wrong preimage means receiver path fails
+        // 2. Falls back to refund path (locktime passed)
+        // 3. Refund keys are present, so signature is required
+        // 4. No signature provided
         let result = proof.verify_htlc();
         assert!(
             result.is_err(),
-            "Should fail when locktime passed but refund keys present without signature"
+            "Should fail when using refund path with refund keys but no signature"
         );
     }
 }