[ PR0M3TH3AN/bitlogin ] Audit round 2: resource ceilings, key lifecycle, local gate, courtesy logout
BL-21 (medium): untrusted relays and crafted bunker URIs can no longer
buy CPU, memory, or sockets. Frames over 256K chars are dropped before
JSON.parse; buffered queries run every cheap check (id shape, replay
dedup, capacity) BEFORE Schnorr verification and carry a per-query
verification budget (3x limit, floor 50) so distinct forged events
exhaust the budget rather than the CPU; bunker URIs are deduplicated
and capped at 8 relays. The audit's exact probe -- thousands of replayed
copies against limit 1 -- now costs one verification, bounded by test.
https://github.com/PR0M3TH3AN/bitlogin/commit/bb9788588f47188c651642619c7b60c6895c5aee
nostr-summary / Nostr Summary
npub10l…sv2ux
2026-08-04 18:01:43 UTC
Author Public Key
npub10l479fv64qn03a3n0dqsryu74tyzl48xef0nc7u0z09q8tfx72ls7sv2uxPublished at
2026-08-04 18:01:43 UTCEvent JSON
{
"id": "91bc301f1327e262ca3eef7b27cf0362d7914d92c1ea7d918f56da7d5f3f33b7",
"pubkey": "7febe2a59aa826f8f6337b4101939eaac82fd4e6ca5f3c7b8f13ca03ad26f2bf",
"created_at": 1785866503,
"kind": 1,
"tags": [
[
"proxy",
"https://github.com/PR0M3TH3AN/bitlogin/commit/bb9788588f47188c651642619c7b60c6895c5aee",
"web"
]
],
"content": "[ PR0M3TH3AN/bitlogin ] Audit round 2: resource ceilings, key lifecycle, local gate, courtesy logout\n\nBL-21 (medium): untrusted relays and crafted bunker URIs can no longer\nbuy CPU, memory, or sockets. Frames over 256K chars are dropped before\nJSON.parse; buffered queries run every cheap check (id shape, replay\ndedup, capacity) BEFORE Schnorr verification and carry a per-query\nverification budget (3x limit, floor 50) so distinct forged events\nexhaust the budget rather than the CPU; bunker URIs are deduplicated\nand capped at 8 relays. The audit's exact probe -- thousands of replayed\ncopies against limit 1 -- now costs one verification, bounded by test.\nhttps://github.com/PR0M3TH3AN/bitlogin/commit/bb9788588f47188c651642619c7b60c6895c5aee",
"sig": "1992a5ba48f84270ec5cbe6335d084a1f28bc1a0c95a0bd11091d0a10adc543b30371ff5e10dd07085ee0af0337f6148c34fc73fca3173d5f40235ad7e57a0b6"
}