on_rdv verifies r.node_id == node && verify_record(r) (bin/yipd/src/peer_manager.rs:1022) but then probes PeerInfo.reflexive — the UNSIGNED field — and never uses the record's SIGNED endpoints. A malicious/compromised rendezvous answers Lookup(Y) with Y's genuine record + any reflexive it likes, steering Y's probes anywhere. PunchTo is worse: no record gate at all, and it calls begin_handshake when Idle, with reflexive filled from an unauthenticated Lookup source — a reflection/probe-steering primitive. Bounded by Noise-IK (wrong address just fails to authenticate), so probe-steering/reflection/connection-DoS, not impersonation. Fix: when a verified record is present, restrict/intersect the probe target to record.endpoints; treat reflexive as an extra candidate only. Sharper cousin of the mesh record-less PeerInfo follow-up noted in #100.
See docs/2026-07-25-project-review-and-roadmap.md for the full review synthesis.
on_rdv verifies
r.node_id == node && verify_record(r)(bin/yipd/src/peer_manager.rs:1022) but then probesPeerInfo.reflexive— the UNSIGNED field — and never uses the record's SIGNEDendpoints. A malicious/compromised rendezvous answers Lookup(Y) with Y's genuine record + any reflexive it likes, steering Y's probes anywhere.PunchTois worse: no record gate at all, and it calls begin_handshake when Idle, with reflexive filled from an unauthenticated Lookup source — a reflection/probe-steering primitive. Bounded by Noise-IK (wrong address just fails to authenticate), so probe-steering/reflection/connection-DoS, not impersonation. Fix: when a verified record is present, restrict/intersect the probe target torecord.endpoints; treat reflexive as an extra candidate only. Sharper cousin of the mesh record-less PeerInfo follow-up noted in #100.See docs/2026-07-25-project-review-and-roadmap.md for the full review synthesis.