Summary
When a Cashu melt's bolt11 destination is a mint quote on the same mint, cdk-mintd settles it internally — no Lightning payment occurs, so the melt result carries no payment_preimage. trusted_wallet/cashu/mod.rs (rev 4e9d230) expect()s a preimage on the success path and panics:
thread 'tokio-rt-worker' panicked at .../orange-sdk/src/trusted_wallet/cashu/mod.rs:
Melt succeeded but no preimage for quote: 80876079-f874-4735-a987-ae4277417d29
Repro
Two wallets on the same mint (cdk-mintd 0.16). Wallet A holds trusted (Cashu) balance; wallet B creates a bolt11 mint quote; A pays B's invoice via pay()'s melt path (amount ≤ A's trusted balance). The mint marks B's quote paid via internal settlement (attempt_internal_settlement in cdk's melt saga) and returns the melt as PAID with payment_preimage: None. A panics.
Funds are safe — the melt has settled and the receiver mints normally — but the sender process dies mid-send. On mobile (UniFFI) the unwind across the FFI boundary aborts the app, so any user paying another user of the same mint from their trusted balance hard-crashes.
Expected
A PAID melt without a preimage is legitimate (NUT-05 marks the preimage optional; internal settlement is the canonical case). The success path should emit PaymentSuccessful with payment_preimage: None instead of unwrapping.
Observed 2026-07-11 on signet (self-hosted cdk-mintd, Mutinynet). Downstream report with logs: emergent-money/graduated-wallet#374. Note this path is exercised by orange-sdk's own model: any wallet whose trusted float covers the payment amount and whose payee shares its mint takes it — it's the expected flow for small payments between users of one mint.
Summary
When a Cashu melt's bolt11 destination is a mint quote on the same mint, cdk-mintd settles it internally — no Lightning payment occurs, so the melt result carries no
payment_preimage.trusted_wallet/cashu/mod.rs(rev4e9d230)expect()s a preimage on the success path and panics:Repro
Two wallets on the same mint (cdk-mintd 0.16). Wallet A holds trusted (Cashu) balance; wallet B creates a bolt11 mint quote; A pays B's invoice via
pay()'s melt path (amount ≤ A's trusted balance). The mint marks B's quote paid via internal settlement (attempt_internal_settlementin cdk's melt saga) and returns the melt asPAIDwithpayment_preimage: None. A panics.Funds are safe — the melt has settled and the receiver mints normally — but the sender process dies mid-send. On mobile (UniFFI) the unwind across the FFI boundary aborts the app, so any user paying another user of the same mint from their trusted balance hard-crashes.
Expected
A
PAIDmelt without a preimage is legitimate (NUT-05 marks the preimage optional; internal settlement is the canonical case). The success path should emitPaymentSuccessfulwithpayment_preimage: Noneinstead of unwrapping.Observed 2026-07-11 on signet (self-hosted cdk-mintd, Mutinynet). Downstream report with logs: emergent-money/graduated-wallet#374. Note this path is exercised by orange-sdk's own model: any wallet whose trusted float covers the payment amount and whose payee shares its mint takes it — it's the expected flow for small payments between users of one mint.