I mentioned on discord that you should check that a user is not using the globalpk as their value for pubkey=. I see you added this check for tokens but not assets. Please add it for assets as well. I've found at least one issue regarding this. It allows for twice as efficient marker spamming via tokenv2bids.