fix(nut11): getNSigsRefund defaults to 1 on empty-values tag (review #238)

Copilot review: getNSigsRefund() called values.get(0) without an emptiness
check. The deserializers accept a key-only tag array (size 1), which yields an
empty values list and would throw IndexOutOfBoundsException — a DoS vector via
a crafted secret. Now returns the default 1 when the tag is present but carries
no value, matching the tag-absent path. Regression test added.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: tcheeric

cashu-lib-common/src/main/java/xyz/tcheeric/cashu/common/nut11/P2PKSecret.java

@@ -94,17 +94,20 @@ public int getNSigs() {
 
     /**
      * NUT-11 refund-path signature threshold. Defaults to {@code 1} when the
-     * {@code n_sigs_refund} tag is absent — per NUT-11 the refund path requires
-     * a single signature by default, and existing escrows minted before this
-     * tag existed must keep their current 1-of-N refund behavior unchanged.
+     * {@code n_sigs_refund} tag is absent <em>or carries no value</em> — per
+     * NUT-11 the refund path requires a single signature by default, and
+     * existing escrows minted before this tag existed must keep their current
+     * 1-of-N refund behavior unchanged. Guarding the empty-values case also
+     * stops a malformed secret (key-only tag array) from throwing
+     * {@link IndexOutOfBoundsException} here.
      */
     public int getNSigsRefund() {
         Tag tag = super.getTag(P2PKTag.n_sigs_refund.name());
         if (tag == null) {
             return 1;
         }
-        List<?> values = super.getTag(P2PKTag.n_sigs_refund.name()).getValues();
-        return values != null ? (int) values.get(0) : 1;
+        List<?> values = tag.getValues();
+        return (values != null && !values.isEmpty()) ? (int) values.get(0) : 1;
     }
 
     public String getSigFlag() {

cashu-lib-common/src/test/java/xyz/tcheeric/cashu/entities/P2PKSecretTest.java

@@ -6,6 +6,8 @@
 import xyz.tcheeric.cashu.common.nut10.WellKnownSecret;
 import xyz.tcheeric.cashu.common.nut11.P2PKSecret;
 
+import java.util.List;
+
 import static org.assertj.core.api.Assertions.assertThat;
 
 class P2PKSecretTest {
@@ -67,6 +69,22 @@ void shouldSetAndGetNSigsRefund() {
         assertThat(secret.getNSigsRefund()).isEqualTo(2);
     }
 
+    /**
+     * A malformed secret whose {@code n_sigs_refund} tag carries no value (a key-only tag array,
+     * which the deserializers accept) must fall back to the default of 1 rather than throwing
+     * {@link IndexOutOfBoundsException} — otherwise a crafted secret could DoS verification.
+     */
+    @Test
+    void shouldDefaultNSigsRefundToOneWhenTagHasNoValue() {
+        // Arrange
+        byte[] secretData = Hex.decode("deadbeef");
+        P2PKSecret secret = new P2PKSecret(secretData);
+        secret.setTag(P2PKSecret.P2PKTag.n_sigs_refund.name(), List.of()); // present but empty
+
+        // Act / Assert
+        assertThat(secret.getNSigsRefund()).isEqualTo(1);
+    }
+
     /**
      * Ensures the n_sigs_refund tag round-trips through JSON serialization the
      * same way the existing n_sigs tag does.