From eaaf36edf7f0891c325264bf8643ccfeb9da8050 Mon Sep 17 00:00:00 2001 From: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Date: Tue, 11 Dec 2018 10:11:55 +0000 Subject: [PATCH] Update proposals/1442-state-resolution.md Co-Authored-By: erikjohnston --- proposals/1442-state-resolution.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/proposals/1442-state-resolution.md b/proposals/1442-state-resolution.md index 3796225d..540285ca 100644 --- a/proposals/1442-state-resolution.md +++ b/proposals/1442-state-resolution.md @@ -467,7 +467,7 @@ Intuitively using rejected events feels dangerous, however: auth checks based on the events auth chain (e.g. they can't grant themselves power levels if they didn't have them before). 2. For a previously rejected event to pass auth there must be a set of state - that allows said event. At which point, a malicious server could produce a + that allows said event. A malicious server could therefore produce a fork where it claims the state is that particular set of state, duplicate the rejected event to point to that fork, and send the event. At which point the duplicated event will pass auth. Therefore ignoring rejected events wouldn't