GRANOLA/00
TESTNET ONLY · TESTNUT ECASH

Wallet profile: …

01 / Public order book

Swap Deez Nuts

Send an order

Post an order

Your balance is checked before the signed order is published.

An order is a public signed intention. Funds move only during the verified settlement flow. Granola converts the price to an exact cents-per-SAT ratio before signing.

A peer-to-peer Cashu exchange

Public orders.
Private settlement.

Granola is a decentralized exchange layer on top of Cashu. Nostr carries public orders and private coordination; Cashu settles atomic swaps between wallets and across mints.

02 / Wallet

Your Cashu balance

03 / Private settlement

Settle the trade

Granola connects Cashu wallets across mints. Nostr carries the market and private coordination. The protocol ensures no token gets lost and no additional party gets added.

04 / Custody

Back up or delete your wallet

Your proofs live only in this browser profile’s IndexedDB. A backup contains spendable bearer tokens.

Danger zone

05 / Trace

Local activity

    Secrets, encoded tokens, and mint quote IDs stay out of this log.

    For agents, too

    A wallet agents can call.

    Open developer tools and use window.granola. Read redacted state, publish orders, and advance swaps without exposing bearer material.

    Manual test tutorial ↗ · Read the API contract ↗

    Protocol flow

    How a Cashu swap crosses mints

    Nostr carries the order and the private coordination. The same hash links both Cashu legs: one party reveals the preimage on the first mint, and the other uses it to claim the second leg.

    View Mermaid source 
    sequenceDiagram
    actor Alice
    participant Nostr
    actor Carol
    participant Mint

    Alice-->>Nostr: Generate new \n ephemeral PubKey
    Alice->>Nostr: Publish Order

    Nostr->>Carol: Fetches 8338 events \n Sees order
    Carol-->>Nostr: Generate new \n ephemeral PubKey
    Carol->>Alice: Sends DM \n with pay request \n via Nostr
    Alice->>Carol: Generates H\n sends HTLC_c to PubKey
    Carol-->>Mint: Verify HTLC_c
    Carol->>Alice: Sends HTLC_a with the same H
    Carol-->>Mint: Subscribe \n to HTLC_a
    Alice->>Mint: Swaps HTLC_a token revealing preimage
    Mint-->>Carol: State change with preimage
    Carol->>Mint: Swaps HTLC_c token
    Three private messages Open the settlement handshake

    Granola’s current settlement flow uses three authenticated DMs. After the third message, both wallets advance from independently verified mint state — no private ACK or receipt messages are needed.

    1. 01

      Taker → maker order key

      reserve_propose

      Requests this exact order and fill amount. It binds the current public projection, trade terms, and the taker’s fresh session, Cashu settlement, and refund keys.

    2. 02

      Maker order key → taker session

      reserve_accept

      Publishes the reserved projection and carries the maker’s offer-side HTLC. The lock, deadlines, mint/keyset, and settlement hash are signed together.

    3. 03

      Taker session → maker session

      quote_lock

      After validating the first leg, the taker creates the payment-side HTLC with the same hash. This is the final private message.

    After quote_lock

    The maker claims the payment leg. The taker learns the preimage from the mint witness and claims the offer leg. The maker publishes the signed fill projection; the taker verifies it.

    What matters

    Know the trust boundary.

    01

    Trust the mint, not the user.

    A peer message is coordination, not proof. Verified mint state and the spend witness decide whether a leg actually settled.

    02

    Ephemeral keys, no management.

    Every reservation gets fresh Nostr, Cashu settlement, and refund keys. Granola scopes and stores them for the swap; you never manage a key ceremony.

    03

    Nostr coordinates. It does not custody.

    Relays carry orders and encrypted coordination. Proofs, preimages, balances, and private keys stay out of public events.

    04

    Atomic under mint assumptions.

    One hash links both legs and bounded locktimes provide recovery. Safety still depends on participating mints enforcing the required Cashu capabilities.

    05

    All local, no servers.

    Your wallet and session state run in the browser. Granola has no account, matching, or custody server; Nostr relays and Cashu mints are the external protocol infrastructure.

    06

    No escrow.

    Only you and the mint custody your funds.