Don't forget to check the credential against the seen list

crates/lox-library/src/migration.rs

@@ -41,6 +41,7 @@ use zkp::ProofError;
 use zkp::Transcript;
 
 use super::cred;
+use super::dup_filter::SeenType;
 use super::{BridgeAuth, IssuerPubKey};
 use super::{CMZ_A, CMZ_A_TABLE, CMZ_B, CMZ_B_TABLE};
 
@@ -387,6 +388,12 @@ impl BridgeAuth {
             },
         )?;
 
+        // Ensure the id has not been seen before, and add it to the
+        // seen list.
+        if self.id_filter.filter(&req.id) == SeenType::Seen {
+            return Err(ProofError::VerificationFailure);
+        }
+
         // Blind issuing of the new Lox credential
 
         // Choose a random server id component to add to the client's