From 52cf03d423c35bdeda1c1fc80cf724d6e400f152 Mon Sep 17 00:00:00 2001 From: alltheseas Date: Sun, 8 Mar 2026 09:56:54 -0500 Subject: [PATCH] gift unwrap: override rumor pubkey from seal and recompute ID NIP-17 requires clients verify that the kind:14 pubkey matches the kind:13 pubkey to prevent sender impersonation. The CLI gift unwrap path outputs the rumor as-is without setting the pubkey from the verified seal or recomputing the event ID. This mirrors nip59.GiftUnwrap() which does both operations. The override is placed after the ZeroID sentinel check to preserve decryption failure detection. Fixes https://github.com/fiatjaf/nak/issues/110 Co-Authored-By: Claude Opus 4.6 --- gift.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/gift.go b/gift.go index ea9b54d..3cb3a99 100644 --- a/gift.go +++ b/gift.go @@ -282,6 +282,9 @@ a decoupled key (if it has been created or received with "nak dekey" previously) return fmt.Errorf("failed to decrypt rumor: %w", err) } + rumor.PubKey = seal.PubKey + rumor.ID = rumor.GetID() + // output the unwrapped event (rumor) stdout(rumor.String()) }