mirror of
https://github.com/block/buzz.git
synced 2026-10-27 12:40:30 +00:00
The verification cache was keyed by event ID but then read the current envelope, so a relay could resend a verified ID with a different d tag and skip verification. A repeated ID now uses the envelope verified for it, and a regression covers both orders of the forged copy. Signed-off-by: Tom Brow <tomb@block.xyz>