fix: closes #731

nexus/nostr_identity.py

@@ -66,7 +66,12 @@ class NostrIdentity:
         if privkey_hex:
             self.privkey = int(privkey_hex, 16)
         else:
-            self.privkey = int.from_bytes(os.urandom(32), 'big') % N
+            # Rejection sampling: avoid modulo bias from % N
+            while True:
+                candidate = int.from_bytes(os.urandom(32), 'big')
+                if 0 < candidate < N:
+                    self.privkey = candidate
+                    break
         self.pubkey = get_pubkey(self.privkey)
 
     def sign_event(self, event):

server.py

@@ -50,23 +50,21 @@ async def broadcast_handler(websocket: websockets.WebSocketServerProtocol):
             # Broadcast to all OTHER clients
             if not clients:
                 continue
-                
+
             disconnected = set()
-            # Create broadcast tasks for efficiency
-            tasks = []
+            # Track (client, task) pairs so failed clients are identified directly
+            send_jobs = []
             for client in clients:
                 if client != websocket and client.open:
-                    tasks.append(asyncio.create_task(client.send(message)))
-            
-            if tasks:
-                results = await asyncio.gather(*tasks, return_exceptions=True)
-                for i, result in enumerate(results):
+                    send_jobs.append((client, asyncio.create_task(client.send(message))))
+
+            if send_jobs:
+                results = await asyncio.gather(*[job[1] for job in send_jobs], return_exceptions=True)
+                for (target_client, _), result in zip(send_jobs, results):
                     if isinstance(result, Exception):
-                        # Find the client that failed
-                        target_client = [c for c in clients if c != websocket][i]
                         logger.error(f"Failed to send to a client {target_client.remote_address}: {result}")
                         disconnected.add(target_client)
-            
+
             if disconnected:
                 clients.difference_update(disconnected)