register_if_fresh (crates/yip-rendezvous/src/server.rs:188) only enforces the counter while the entry is unexpired; once the 60s TTL lapses and sweep drops it, the node is first-seen again and any captured still-signature-valid RegisterSigned re-registers it, with the served reflexive = the replayer's src (re-pin every <60s). And reg_seq is in-memory (peer_manager.rs:512, saturating_add) resetting to 0 on yipd restart, so a restarted victim can't out-counter an attacker who pinned last_counter high. Reachability DoS on the rendezvous path. Fix: make the registration seq a TAI64N/wall-clock-derived monotone value (the same move #34 made for last_accepted_init_ts) — closes both post-expiry replay and the restart reset in one move.
See docs/2026-07-25-project-review-and-roadmap.md for the full review synthesis.
register_if_fresh(crates/yip-rendezvous/src/server.rs:188) only enforces the counter while the entry is unexpired; once the 60s TTL lapses and sweep drops it, the node is first-seen again and any captured still-signature-validRegisterSignedre-registers it, with the served reflexive = the replayer's src (re-pin every <60s). Andreg_seqis in-memory (peer_manager.rs:512, saturating_add) resetting to 0 on yipd restart, so a restarted victim can't out-counter an attacker who pinned last_counter high. Reachability DoS on the rendezvous path. Fix: make the registration seq a TAI64N/wall-clock-derived monotone value (the same move #34 made for last_accepted_init_ts) — closes both post-expiry replay and the restart reset in one move.See docs/2026-07-25-project-review-and-roadmap.md for the full review synthesis.