From b125c4f759b2dcd60eeb785732e911c0a75c50ef Mon Sep 17 00:00:00 2001
From: Chris Duncan <chris@zoso.dev>
Date: Sat, 29 Aug 2026 02:17:20 -0700
Subject: [PATCH] Move mutex lock out of try block so it does not clear buffers
 from underneath the currently executing function.

---
 src/lib/derive.ts | 2 +-
 src/lib/sign.ts   | 2 +-
 src/lib/verify.ts | 8 +++++---
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/src/lib/derive.ts b/src/lib/derive.ts
index 338f7cc..ae9f834 100644
--- a/src/lib/derive.ts
+++ b/src/lib/derive.ts
@@ -12,8 +12,8 @@ export function derive (prv: unknown, out?: unknown): string | Uint8Array<ArrayB
 	const privateKey = normalize('private key', KEY_BYTELENGTH, KEY_BYTELENGTH, prv)
 	const publicKey = new Uint8Array(KEY_BYTELENGTH)
 	let buffer = new Uint8Array(exports.memory.buffer)
+	Mutex.lock()
 	try {
-		Mutex.lock()
 		for (let i = 0; i < KEY_BYTELENGTH; i++) {
 			buffer[Pointers.INPUT_PRV + i] = privateKey[i]
 		}
diff --git a/src/lib/sign.ts b/src/lib/sign.ts
index bd71a4e..a7aafc4 100644
--- a/src/lib/sign.ts
+++ b/src/lib/sign.ts
@@ -14,8 +14,8 @@ export function sign (msg: unknown, prv: unknown, pub: unknown, out?: unknown):
 	const publicKey = normalize('public key', KEY_BYTELENGTH, KEY_BYTELENGTH, pub)
 	const signature = new Uint8Array(SIGNATURE_BYTELENGTH)
 	let buffer = new Uint8Array(exports.memory.buffer)
+	Mutex.lock()
 	try {
-		Mutex.lock()
 		for (let i = 0; i < message.byteLength; i++) {
 			buffer[Pointers.INPUT_MSG + i] = message[i]
 		}
diff --git a/src/lib/verify.ts b/src/lib/verify.ts
index f9124bf..c001ea7 100644
--- a/src/lib/verify.ts
+++ b/src/lib/verify.ts
@@ -7,8 +7,8 @@ const { BLOCKHASH_BYTELENGTH, KEY_BYTELENGTH, MAX_MESSAGE_BYTELENGTH, MAX_VERIFY
 
 export function verify (sig: unknown, msg: unknown, pub: unknown): boolean {
 	let buffer = new Uint8Array(exports.memory.buffer)
+	Mutex.lock()
 	try {
-		Mutex.lock()
 		const message = normalize('message', 0, MAX_MESSAGE_BYTELENGTH, msg)
 		const publicKey = normalize('public key', KEY_BYTELENGTH, KEY_BYTELENGTH, pub)
 		const signature = normalize('signature', SIGNATURE_BYTELENGTH, SIGNATURE_BYTELENGTH, sig)
@@ -22,7 +22,9 @@ export function verify (sig: unknown, msg: unknown, pub: unknown): boolean {
 			buffer[Pointers.INPUT_SIG + i] = signature[i]
 		}
 		exports.verify(message.byteLength)
-		buffer = new Uint8Array(exports.memory.buffer)
+		if (exports.memory.buffer !== buffer.buffer) {
+			throw new Nano25519TypeError('WASM memory buffer detached')
+		}
 		const verified = buffer[Pointers.OUTPUT_VERIFY]
 		return verified === 0
 	} finally {
@@ -41,8 +43,8 @@ export function verify_blocks (pub: unknown, data: unknown): boolean[] {
 	}
 	const verified = new Uint8Array(count)
 	let buffer = new Uint8Array(exports.memory.buffer)
+	Mutex.lock()
 	try {
-		Mutex.lock()
 		const publicKey = normalize('public key', KEY_BYTELENGTH, KEY_BYTELENGTH, pub)
 		for (let i = 0; i < KEY_BYTELENGTH; i++) {
 			buffer[Pointers.INPUT_PUB + i] = publicKey[i]
-- 
2.52.0