Cashu is an open e-cash protocol using blind signatures, often used with Bitcoin through Lightning Network. The wallet holds proofs issued by a particular mint, not signing authority over its bitcoin reserve.
Cashu is not one shared mint. A token identifies its issuer, unit and signing keyset; the same numeric amount need not mean the same currency or liability. Tokens from one mint are not automatically redeemable at another. The V4 format uses CBOR and contains proofs from one mint. [Cashu — NUT-00: Protocol and tokens] [Cashu — NUT-02: Keysets and fees] [Cashu — Project introduction]
The base protocol uses BDHKE on secp256k1. The wallet creates a secret and blinds its point, the mint signs it, and the wallet removes the blinding. Denominations have distinct keys: the mint knows the values of issued proofs even though it should not know their future unblinded form. [Cashu — NUT-00: Protocol and tokens]
An ordinary unconditional token can be copied. The recipient swaps it for new proofs with their own secrets; the mint invalidates the old inputs. UNSPENT is only a snapshot, not a reservation for the recipient. PENDING indicates ongoing processing and SPENT a proof already redeemed. [Cashu — NUT-03: Swap tokens] [Cashu — NUT-07: Token state check]
Optional NUT-12 adds a DLEQ proof that a signature matches the mint’s public key. A recipient with the right data can verify it offline. This does not reveal whether someone has since spent the token, whether the mint responds, or whether it has reserves. Offline verification therefore does not replace receiving through a swap. [Cashu — NUT-12: Offline signature validation]
NUT-02 distinguishes active=false from optional final_expiry. An inactive keyset no longer issues new tokens, but its proofs remain acceptable as inputs; after final expiry the specification no longer obliges the mint to honor them. The input_fee_ppk input fee is summed over the number and rates of proofs and rounded up. [Cashu — NUT-02: Keysets and fees]
During a melt the wallet supplies proofs for an external payment, often through Lightning Network. The quote specifies the amount, unit, expiry and any fee reserve; input fees may apply as well. HTTP 200 with PENDING does not confirm payment. The final outcome must be distinguished from acceptance of the request. [Cashu — NUT-05: Melting tokens]
Blinding does not remove amount, timing or connection information. NUT-03 recommends sorting requested denominations so their order does not reveal the split between payment and change. Sender queries about the state of transferred proofs can make it easier for the mint to link sender and recipient. [Cashu — NUT-03: Swap tokens] [Cashu — NUT-07: Token state check]
NUT-13 derives secrets and blinding factors from a seed using the keyset and counter. Version 01 uses HMAC-SHA256, while legacy 00 uses BIP32. Recovery needs the original keysets and signatures obtained through NUT-09, followed by spent-state checks. Without a cooperating mint, a seed guarantees neither signature recovery nor reserve withdrawal. [Cashu — NUT-13: Deterministic secrets] [Cashu — NUT-09: Restore signatures]
For the clearest picture, read this entry together with Fedimint, Chaumian eCash, Blind signature, Lightning Network, Counterparty risk, Satoshi. The reverse links also lead from Chaumian eCash, Blind signature, Fedimint, Fiduciary Media.