fix: authenticate events before recording them, and anchor message freshness - #660

Closed

AndreaDiazCorreia wants to merge 11 commits into

fix/transport-downgrade-protectionfrom

fix/replay-and-censorship-protection

Commits on Aug 25, 2026

feat: defer dedup store write until after event authentication to prevent relay censorship
AndreaDiazCorreia
committed
1c6512f
feat: claim event ids in flight so concurrent deliveries are processed once
AndreaDiazCorreia
committed
201f22f
fix: recompute event id before signature verification to prevent metadata impersonation
AndreaDiazCorreia
committed
64e3ed4
fix: normalize all timestamps to milliseconds at model boundary to prevent dispute ordering corruption
AndreaDiazCorreia
committed
bddfada
feat: extract message timestamp from node-signed created_at to prevent replay freshness forgery
AndreaDiazCorreia
committed
5677b8b
feat: bound kind-14 created_at to prevent future-dated and ancient messages from being accepted
AndreaDiazCorreia
committed
e44ca63
feat: reject messages older than applied state to prevent replay attacks from modifying settled orders
AndreaDiazCorreia
committed
4dc86fd
feat: persist order freshness across restore to prevent replayed messages from re-arming settled orders
AndreaDiazCorreia
committed
6cda36a
feat: enforce trade key index monotonicity to prevent key reuse from daemon replay or race conditions
AndreaDiazCorreia
committed
f844b63
fix: check message freshness before consuming per-order state
AndreaDiazCorreia
committed
ce685dd
fix(restore): anchor the freshness mark to the snapshot's signed time
AndreaDiazCorreia
committed
cc7e5f9