From a74e94a9a756321d29e84f1478aa3c3e6aaba036 Mon Sep 17 00:00:00 2001
From: tomaioo <hongsaygio.com@gmail.com>
Date: Mon, 6 Jul 2026 05:26:59 -0700
Subject: [PATCH] fix(security): empty catch block in decodenpub swallows all
 error

The `decodeNpub` function in `bot/modules/nostr/lib.ts` has an empty catch block that silently swallows all errors, including potential security issues with malformed input. This makes debugging difficult and could mask attacks attempting to exploit the NIP-19 decoding.

Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com>
---
 bot/modules/nostr/lib.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/bot/modules/nostr/lib.ts b/bot/modules/nostr/lib.ts
index 9feed49c..44557c12 100644
--- a/bot/modules/nostr/lib.ts
+++ b/bot/modules/nostr/lib.ts
@@ -4,7 +4,9 @@ export const decodeNpub = (npub: string) => {
   try {
     const { type, data } = nip19.decode(npub);
     if (type === 'npub') return data;
-  } catch (err) {}
+  } catch (err) {
+    return null;
+  }
 };
 export const encodeNpub = (hex: string) => {
   return nip19.npubEncode(hex);