search

MostroP2P / mostro

Lightning Network peer-to-peer exchange platform on Nostr
https://mostro.network
MIT License
180 stars 29 forks source link

Possibile DoS (?) #313

Closed dtonon closed 1 month ago

dtonon commented 3 months ago

I'm testing the onboarding and the general UX and I spotted a possible problem: when the user take a position he is asked to pay a LN invoice in 15 minutes; during this time frame the position is locked and hidden, and it is not available to any other user. I suppose it's quite trivial to create a bot that randomly generates new key-pairs and take all the positions, ruining the operability of the service. Maybe a solution could be to wait the LN payment to lock the position, or to require non-trivial PoW when signing the take event.

grunch commented 3 months ago

The PoW solution sounds good, it's easy to implement and it can be a pain for spamming bots

arkanoider commented 2 months ago

check #341

Catrya commented 1 month ago

Closed via #341