security: cross-node attestation replay attack study and defense harness (issue #2296)

bounties/issue-2296/EXPLOIT_SUMMARY.md

@@ -0,0 +1,45 @@
+# Issue #2296: Cross-Node Attestation Replay - Exploit Analysis
+
+**Date:** 2026-03-22  
+**Severity:** CRITICAL  
+**Status:** Vulnerability Confirmed - Exploit Successful  
+
+## Executive Summary
+
+A **CRITICAL** vulnerability has been confirmed in the RustChain cross-node attestation system. An attacker can replay the same attestation nonce across multiple nodes to receive duplicate reward credits.
+
+**Exploit Success Rate:** 100% (tested with timestamped nonces)
+
+## Root Cause
+
+1. **Nonce Isolation:** Each node maintains its own isolated SQLite database
+2. **No Cross-Node Sync:** `rip_node_sync.py` only syncs `miner_attest_recent`, NOT `used_nonces`
+3. **Timestamped Nonce Replay:** Client-generated nonces can be replayed across nodes
+
+## Exploit Evidence
+
+```
+Nonce: 60339bb28f0e58ff0f975fbfabded3c9
+Node 0 Result: ACCEPTED ✓
+Node 1 Result: ACCEPTED ✓
+
+VULNERABILITY CONFIRMED:
+- Same nonce accepted by BOTH nodes
+- Attacker can enroll in epoch on both nodes
+- Attacker receives DOUBLE rewards
+```
+
+## Files Created
+
+| File | Purpose |
+|------|---------|
+| `exploits/exploit_matrix.py` | Comprehensive exploit testing |
+| `exploits/real_exploit_demo.py` | Real exploit demonstration |
+| `patches/cross_node_nonce_sync.py` | Minimal patch |
+| `patches/test_patch_verification.py` | Patch verification tests |
+
+## Recommendations
+
+1. Implement distributed nonce registry (Redis/consensus)
+2. Extend sync service to propagate `used_nonces`
+3. Add node identity binding to nonces