1 files changed, 26 insertions, 14 deletions

diff --git a/src/btfaddr.cpp b/src/btfaddr.cpp
index ce2ac86..502220e 100644
--- a/src/btfaddr.cpp
+++ b/src/btfaddr.cpp
@@ -319,20 +319,32 @@ bool VerifyDescriptor(void* ctxv, const std::string& jsonStr,
         std::string onion;
         if (v.contains("onion"))
         {
-            if (v["onion"].is_string() && v.contains("sig3") && v["sig3"].is_string())
-            {
-                std::string onionNorm;
-                std::string onionRaw = v["onion"].get<std::string>();
-                if (NormalizeOnionEndpoint(onionRaw, onionNorm) && onionNorm == onionRaw)
-                {
-                    unsigned char sig3[64];
-                    unsigned char digest3[32];
-                    DescriptorDigestV3(expect_pubkey, enc, meeting_node, onionNorm, created, digest3);
-                    if (HexDecode(v["sig3"].get<std::string>(), sig3, 64) &&
-                        secp256k1_schnorrsig_verify(ctx, sig3, digest3, 32, &xpub))
-                        onion = onionNorm;
-                }
-            }
+            // A descriptor that carries an onion endpoint must prove it. The
+            // endpoint is covered by sig3 and only sig3, so any failure here --
+            // missing sig3, bad hex, unnormalised endpoint, bad signature --
+            // means the descriptor was tampered with, and a tampered
+            // descriptor is rejected outright. Upstream dropped just the onion
+            // and accepted the rest, which let any relay convert an onion
+            // descriptor into a rendezvous-only one by deleting a field.
+            //
+            // Residual, by design: removing BOTH "onion" and "sig3" still
+            // verifies, because the result is indistinguishable from a peer
+            // that never had an onion endpoint. Closing that requires binding
+            // the onion into the primary sig (the V2 digest), which every
+            // upstream 1.2.18/1.2.19 verifier would reject -- an upstream
+            // protocol change, not something this fork can do unilaterally.
+            if (!v["onion"].is_string()) return false;
+            if (!v.contains("sig3") || !v["sig3"].is_string()) return false;
+            std::string onionNorm;
+            std::string onionRaw = v["onion"].get<std::string>();
+            if (!NormalizeOnionEndpoint(onionRaw, onionNorm) || onionNorm != onionRaw)
+                return false;
+            unsigned char sig3[64];
+            unsigned char digest3[32];
+            DescriptorDigestV3(expect_pubkey, enc, meeting_node, onionNorm, created, digest3);
+            if (!HexDecode(v["sig3"].get<std::string>(), sig3, 64)) return false;
+            if (!secp256k1_schnorrsig_verify(ctx, sig3, digest3, 32, &xpub)) return false;
+            onion = onionNorm;
         }
 
         memcpy(out.pubkey, expect_pubkey, 32);