Better checks the id and sig before verifying the event.

quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/nip01Core/crypto/EventExt.kt

@@ -27,12 +27,12 @@ import com.vitorpamplona.quartz.utils.Log
 fun Event.generateId(): String = EventHasher.hashId(pubKey, createdAt, kind, tags, content)
 
 fun Event.verifyId(): Boolean {
-    if (id.isEmpty()) return false
+    if (id.length != 64) return false
     return EventHasher.hashIdCheck(id, pubKey, createdAt, kind, tags, content)
 }
 
 fun Event.verifySignature(): Boolean {
-    if (id.isEmpty() || sig.isEmpty()) return false
+    if (id.length != 64 || pubKey.length != 64 || sig.length != 128) return false
     return Nip01Crypto.verify(Hex.decode(sig), Hex.decode(id), Hex.decode(pubKey))
 }
 

quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/utils/Hex.kt

@@ -146,7 +146,9 @@ object Hex {
 
     fun decode(hex: String): ByteArray {
         // faster version of hex decoder
-        require(hex.length and 1 == 0)
+        require(hex.length and 1 == 0) {
+            "Invalid hex $hex"
+        }
         return ByteArray(hex.length / 2) {
             (hexToByte[hex[2 * it].code] shl 4 or hexToByte[hex[2 * it + 1].code]).toByte()
         }