I’ve been building something for Zcash called ZecPay, and I wanted to finally share it with the community.
The idea came from a simple question: why does receiving a Zcash payment still sometimes feel more complicated than it needs to be?
Zcash gives us something powerful with private payments, but the experience around actually asking someone to pay you can still be improved.
So I built ZecPay as a simple payment page for receiving ZEC.
You can have your own page, share a link, show what you’re asking for, create simple payment requests and let someone pay you without creating an account or giving your funds to a third party.
I’m not trying to replace wallets or build another exchange. I’m trying to make the “someone wants to pay me in ZEC” part simpler.
It’s still a young project, so I’m sharing it because I want real people from the Zcash community to use it and tell me where it makes sense, where it doesn’t, and what I’m missing.
I explained the story behind it here:
And you can try ZecPay here:
If you think it’s promising, feedback, ideas, private messages or even a small tip are genuinely appreciated. I’d rather improve this together with people who actually use Zcash than build something in isolation.
Okay so, does it support UIVK-based auto-address generation? But then the issue is storage, so its basically just an address, in which case why would anyone trust your website not to manipulate the address… and much rather send it directly?
ZcashNames is a MUCH better choice for any potential users.
Not to mention that sites swapping payment addresses were and are the one of the largest vectors of crypto theft, such as via clipping attacks, but the issue is that since Zcash is shielded, it’s impossible to prove that you were stolen by! How do you even prove that the website didn’t change the address?
By sending the other party the address to confirm it? In which case… WHY WOULDNT THEY SEND IT DIRECTLY-
Hmm, I think you are mistaken the app. The address you use in ZecPay is yours - the one you get in your non-custodial wallet. The tool doesn’t generate anything or hold anything. It just a normal link where you create a profile to easier give potential people who can be customers, creators who want to get their payments in ZEC but not sharing that long address.
All you do in ZecPay is creating a profile with your address, yes, the one you take from your wallet and have a page in ZecPay. There’s nothing to connect, nothing to share with the tool or anything. If you still have issues “understanding” the concept this is a open-source project found here GitHub - alberdioni8406/zecpay-V1 · GitHub
Inspect the code and read the Readme.md. Another thing, this is just a shareable link containing your address and QR code to easiest merchants and people who actually use the currency for everyday things…and not in anyway competing with other tools but add more diversity in the ecosystem.
How can I possible swap an address that you control? The tool doesn’t involve any swaps and I don’t have access to users profiles once they created (this is one of the reasons I pasted the GitHub link so you can read the repo) and yes I rode your comment. Again:
ZecPay is that a profile link with a handle chosen by you. There’s no database, no connection ever happening in the tool and I can’t even know how many handles have been claimed.
I’ll correct one thing from my previous comment because I don’t have a problem admitting when I word something incorrectly.
When I said “there’s no database,” that was imprecise. You’re right that Prisma is used for database access, and I should have been more precise about the architecture instead of making that statement.
But that correction still doesn’t establish the claims you’re making.
Prisma existing in the project does not mean I can secretly swap another user’s Zcash address, modify their profile, or access their claimed handle. Those are separate claims that require you to actually identify where the code allows that to happen.
And the argument that “the same AI could be prompted to write code to do it” isn’t evidence that ZecPay does it. By that logic, practically any application could be accused of secretly doing something simply because its developer could theoretically write such code.
You also said we cannot see what code is running on the server. Exactly. So neither of us should pretend to know what the server is doing without evidence.
This is precisely why I published the GitHub repository openly. If you found an actual vulnerability, point me to the relevant file, function, endpoint, database operation, or request flow. I’ll look at it seriously and fix it if you’re right.
But I’m not going to keep defending ZecPay against hypothetical scenarios that haven’t been demonstrated in the actual code.
So, correction made on my side. If there is a real security issue, show me where it is. If not, I think we’ve gone far enough with assumptions.
We DO accuse every single application of doing that… ZcashNames survives because you can self host it, as the data is independently indexable.
I’m not? You are.
The issue is you DON’T need to modify the code! You need to modify the database, which is independent of what the application code can do. You can run a simple UPDATE query on the database to update ANY profile. That’s how SQL works!
Fair enough. I think I understand your concern now.
Yes, if an application uses a database, someone with sufficient database access could theoretically modify records directly. I never said SQL databases were magically immutable, and my earlier “there’s no database” wording was incorrect. I already acknowledged that.
But there is a difference between saying “a database administrator could technically modify a record” and saying “I can or will swap another user’s address.” The first is a general property of databases. The second is an accusation about my access, behavior, or the actual security of ZecPay, and you’ve provided no evidence that I have done that or that another user can have their address changed through the application.
At this point, I don’t think continuing this back-and-forth is productive.
I built ZecPay, published the repository publicly, and I’m open to legitimate technical criticism and security reports. If you identify a concrete vulnerability, I’ll investigate it. But I’m not going to keep arguing about hypothetical things that someone with database access could theoretically do.
I’ve acknowledged my mistake about Prisma/database architecture. If that’s not enough, that’s okay, but I’m done debating this particular point.