Offline payment systems force several hard problems into the same room: untrusted transport, replay attacks, concurrent delivery, and eventual settlement.
Treat the relay as hostile #
The device carrying a payment message should not need to be trusted. Sign the payload, bind the signature to the amount and participants, and include a nonce plus an expiry window. Encryption protects privacy; signatures protect integrity and authorship.
Settlement must be idempotent #
The same signed payment may reach the server through multiple relays. Settlement therefore needs an atomic uniqueness check on the transaction identity. The first valid submission wins; later copies receive the same outcome without moving money twice.
Offline does not mean unlimited #
Risk controls still matter. Short validity windows, device-bound keys, and conservative offline limits reduce exposure until the system reconnects.
The larger lesson is useful beyond payments: design the protocol around what an attacker can copy, delay, reorder, and replay.