Our own Cashu mint.
Our own Cloudflare front.
Real protocol, sandbox money.

This site hosts the lab for the Nutshell Strike-backend fee-cap finding (October 2026). Below you can connect your Cashu wallet to our mint, inspect it live, and reproduce the full mint → melt cycle against the vulnerable backend configuration — on infrastructure we own, with no third party involved.

01Live mint

CONNECT & INSPECT

MINT URL (NUT-06)

not connected

MINT INFO

Connect to load /v1/info.

02Connect your wallet

CASHU.ME (browser)

Open cashu.me → Settings → Mints
Add mint → paste https://lab-mint-proxy.thuglifex.workers.dev
Receive → Mint tokens to get test sats

MINIBITS / NUTSTASH (mobile & desktop)

Minibits: Mints tab → + → paste the mint URL
Nutstash: Mints → Add mint → paste the URL
Top up via the mint's Lightning invoice (auto-settles)

The mint runs Nutshell (Python, cashubtc/nutshell @ ac1c2e0) with a Lightning backend simulator and automatic settlement — sats are sandbox tokens, no real money.

03The finding this lab reproduces

Summary (sanitized). In Nutshell's Strike Lightning backend, the melt fee cap computed by the ledger is accepted by the driver and silently discarded — the payment executes with no fee bound. When the backend's actual fee exceeds the reserve quoted to the wallet, the ledger detects the negative difference, logs a single debug line, and finalizes the melt as PAID. A malicious routing peer can therefore skim actual_fee − quoted_reserve from the operator's balance on every melt, indefinitely and silently. Verified live on this exact mint build with a runnable PoC; full disclosure report and code are in the project repository.

REPRODUCED IMPACT (own PoC, 5 cycles)

config	melt	reserve	fee	result	loss
0% reserve	1,000	0	25	PAID ×5	125 sats
defaults	10,000	100	250	PAID ×5	750 sats
control	1,000	0	25	BLOCKED ×3	0

LEDGER'S OWN LOG, BEFORE FINALIZING PAID

No change to return: backend fee 250 exceeds
wallet's fee reserve 100 by 150.

…and the melt was recorded as PAID anyway.

04Run it yourself

FROM THE PROJECT FOLDER

component	command
This website	`cd mint-website && npm run dev` (port 7100)
The mint	`cd mint-node && ./start-mint.sh` (port 3338)
Cloudflare quick tunnel (no account)	`./cloudflare-tunnel.sh`
Full exploit PoC	`cd audit && SCENARIO=b python poc_strike_feecap.py`

Permanent hosting: npx wrangler pages deploy ./ --project-name=voluntary-bugs-lab (Cloudflare Pages — config in wrangler.toml).

Our own Cashu mint.Our own Cloudflare front.Real protocol, sandbox money.