Solution 09 is susceptable to replay attacks about learntocrypto HOT 2 OPEN

Ah, I was confused by the wording, it does say to sign the hash, not the transaction but it can be misinterpreted:

When you generate a new hash for a transaction, sign it using the secret key

The it in “sign it” could refer to the hash (which it should) or to the transaction. Given that the latter implementation has a security implication, I feel we should be explicit here:

When you generate a new hash for a transaction, sign the hash using the secret key

I’ll issue a PR for that if that’s cool.

from learntocrypto.

Please do, this was the intention! :)

from learntocrypto.