fix: authenticate events before recording them, and anchor message freshness - #660

Open

AndreaDiazCorreia wants to merge 11 commits into

fix/transport-downgrade-protectionfrom

fix/replay-and-censorship-protection

Commits on Aug 20, 2026

feat: defer dedup store write until after event authentication to prevent relay censorship
AndreaDiazCorreia
committed
5f8400b
feat: claim event ids in flight so concurrent deliveries are processed once
AndreaDiazCorreia
committed
449c071
fix: recompute event id before signature verification to prevent metadata impersonation
AndreaDiazCorreia
committed
76a3a42
fix: normalize all timestamps to milliseconds at model boundary to prevent dispute ordering corruption
AndreaDiazCorreia
committed
e76c47d
feat: extract message timestamp from node-signed created_at to prevent replay freshness forgery
AndreaDiazCorreia
committed
a5e0dad
feat: bound kind-14 created_at to prevent future-dated and ancient messages from being accepted
AndreaDiazCorreia
committed
15c626d
feat: reject messages older than applied state to prevent replay attacks from modifying settled orders
AndreaDiazCorreia
committed
e0d0c65
feat: persist order freshness across restore to prevent replayed messages from re-arming settled orders
AndreaDiazCorreia
committed
d6aad58
feat: enforce trade key index monotonicity to prevent key reuse from daemon replay or race conditions
AndreaDiazCorreia
committed
5ee4abe
fix: check message freshness before consuming per-order state
AndreaDiazCorreia
committed
740b929
fix(restore): anchor the freshness mark to the snapshot's signed time
AndreaDiazCorreia
committed
ab18f3c