OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement

Summary

Nostr inbound DM handling could perform crypto and dispatch work before sender and pairing policy enforcement, enabling unauthorized pre-auth computation.

Affected Packages / Versions

• Package: openclaw (npm)
• Affected: < 2026.3.22
• Fixed: >= 2026.3.22
• Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
• Latest published npm version checked: 2026.3.23-2

Fix Commit(s)

• 1ee9611079e81b9122f4bed01abb3d9f56206c77

Release Status

The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.

Code-Level Confirmation

• extensions/nostr/src/channel.ts now performs authorization before decrypting and dispatching inbound DM content.
• extensions/nostr/src/nostr-bus.ts adds pre-crypto authorization, size, and rate guardrails before expensive decrypt work.

OpenClaw thanks @kuranikaran for reporting.