oren_z0 on Nostr: If I recall correctly, in order to calculate/verify the digital signature you need to ...

If I recall correctly, in order to calculate/verify the digital signature you need to serialize the object to a string, calculate the sha256 of the payload which should give you the of the event-id, and verify that the signature matches the id & pubkey. But JSON objects could be serialized in different ways. Javascript JSON.serialize(...) could give sometimes '{"a":1,"b":2}' and sometimes '{"b":2,"a":1}' which could lead to unexpected results in the signature verification.

The only exception is the root object. Instead of serializing it to a string directly, the following array is serialized:

[
0,
<pubkey, as a lowercase hex string>,
<created_at, as a number>,
<kind, as a number>,
<tags, as an array of arrays of non-null strings>,
<content, as a string>
]

I guess it's ok for the root object because its serialization requires some manipulation anyways (removing the event-id and signature before serializing to get the event-id).