fix: anchor transport resolution and authenticate v1 message senders - #659

Closed

AndreaDiazCorreia wants to merge 17 commits into

mainfrom

fix/transport-downgrade-protection

Commits on Aug 25, 2026

test: add comprehensive coverage for NostrUtils.isValidEventSignature
AndreaDiazCorreia
committed
7e72871
test: verify kind-38385 info event signature before accepting
AndreaDiazCorreia
committed
27d6d22
fix: reject superseded kind-38385 info events to prevent config rollback
AndreaDiazCorreia
committed
676a45f
feat: add monotonic protocol version store to prevent transport downgrade attacks
AndreaDiazCorreia
committed
5af9d9f
feat: anchor transport resolution to the highest verified protocol version
AndreaDiazCorreia
committed
2dc2394
feat: unify transport resolution through anchoredProtocolVersionFor
AndreaDiazCorreia
committed
80da80a
feat: authenticate NIP-59 seal signer to prevent message forgery
AndreaDiazCorreia
committed
1528e02
fix: prevent protocol version store write reordering and clarify legacy version semantics
AndreaDiazCorreia
committed
9372ae8
fix: request info event without order history cutoff to prevent protocol version loss
AndreaDiazCorreia
committed
f210fb4
feat: distinguish absent protocol_version from malformed to prevent misinterpreting unknown as legacy
AndreaDiazCorreia
committed
cde189b
feat: apply NIP-01 addressable event ordering to info event replacement
AndreaDiazCorreia
committed
4eece37
fix: defer protocol version persistence until init merges early records to prevent session loss
AndreaDiazCorreia
committed
36470a2
fix: anchor the protocol version to signed evidence time, not the higher number
AndreaDiazCorreia
committed
8d5fb9a
fix: keep a version this client cannot speak out of the protocol anchor
AndreaDiazCorreia
committed
1251a0b
fix: stop the node model from reading a malformed protocol_version as v1
AndreaDiazCorreia
committed
e945758
docs: note that the info filter's limit is per relay, not per subscription
AndreaDiazCorreia
committed
afa5232
docs: bring the transport docs in line with the resolver and the anchor
AndreaDiazCorreia
committed
95c01ae

Navigation Menu

Uh oh!

fix: anchor transport resolution and authenticate v1 message senders - #659

fix: anchor transport resolution and authenticate v1 message senders#659
AndreaDiazCorreia wants to merge 17 commits into
mainfrom
fix/transport-downgrade-protection

Commits on Aug 25, 2026

test: add comprehensive coverage for NostrUtils.isValidEventSignature

test: verify kind-38385 info event signature before accepting

fix: reject superseded kind-38385 info events to prevent config rollback

feat: add monotonic protocol version store to prevent transport downgrade attacks

feat: anchor transport resolution to the highest verified protocol version

feat: unify transport resolution through anchoredProtocolVersionFor

feat: authenticate NIP-59 seal signer to prevent message forgery

fix: prevent protocol version store write reordering and clarify legacy version semantics

fix: request info event without order history cutoff to prevent protocol version loss

feat: distinguish absent protocol_version from malformed to prevent misinterpreting unknown as legacy

feat: apply NIP-01 addressable event ordering to info event replacement

fix: defer protocol version persistence until init merges early records to prevent session loss

fix: anchor the protocol version to signed evidence time, not the higher number

fix: keep a version this client cannot speak out of the protocol anchor

fix: stop the node model from reading a malformed protocol_version as v1

docs: note that the info filter's limit is per relay, not per subscription

docs: bring the transport docs in line with the resolver and the anchor