From 2f65941738f0933b768abfa4b484bfadb31cdad4 Mon Sep 17 00:00:00 2001 From: Jordan Mecom Date: Wed, 21 Oct 2026 15:09:17 -0700 Subject: [PATCH] Reduce unnecessary attack surface Validated changes: 02-early-execution/E02 Signed-off-by: Jordan Mecom --- crates/buzz-auth/src/nip42.rs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/crates/buzz-auth/src/nip42.rs b/crates/buzz-auth/src/nip42.rs index 8ee7c90890..1450f65a0b 100644 --- a/crates/buzz-auth/src/nip42.rs +++ b/crates/buzz-auth/src/nip42.rs @@ -53,8 +53,6 @@ pub fn verify_nip42_event( return Err(AuthError::InvalidSignature); } - buzz_core::verify_event(event).map_err(|_| AuthError::InvalidSignature)?; - let challenge = event .tags .find(TagKind::Challenge) @@ -65,6 +63,10 @@ pub fn verify_nip42_event( return Err(AuthError::ChallengeMismatch); } + // Reject proofs for another connection before hashing and Schnorr verification. + // Matching a challenge never replaces cryptographic verification. + buzz_core::verify_event(event).map_err(|_| AuthError::InvalidSignature)?; + let relay = event .tags .find(TagKind::Relay)