Security: WebSocket Room Access Control#2937

Closed

ghost wants to merge 76 commits into

mainfrom

unknown repository

Commits on Apr 12, 2026

feat: implement RIP-309 Phase 1 Fingerprint Check Rotation
Michael Sovereign
committed
fix: address Codex review for RIP-309 Phase 1
Michael Sovereign
committed
fix: complete RIP-309 integration with reward gating and signature fix
Michael Sovereign
committed
fix: integrate canonical RIP-309 rotation module for reward weighting
Michael Sovereign
committed

Commits on Apr 20, 2026

fix: bind _handle_get_state signature to msg_id and ttl (arity fix #2288)
MichaelSovereign
committed

Commits on May 2, 2026

Security: Hardened P2P sync with replay protection, nonces, and deterministic JSON
MichaelSovereign
committed
Security: Prevent mining reward type confusion in mempool and UTXO apply
MichaelSovereign
committed
Security: Hardened Server Proxy with path whitelisting and header forwarding
MichaelSovereign
committed
Security: Atomic balance checks and secure hash generation for Bridge API
MichaelSovereign
committed
Security: Fix voting precision by migrating from REAL to INTEGER weights
MichaelSovereign
committed
Enhancement: Added environment variable support and API authentication for auto-settler
MichaelSovereign
committed
Security: Implemented cryptographic authentication for bounty claims and contract updates
MichaelSovereign
committed
Enhancement: Added address validation and security checks for x402 configuration
MichaelSovereign
committed
Security: Fixed potential SQL injection in passport listing
MichaelSovereign
committed
Security: Protected Hall of Rust from SQL injection and data vandalism
MichaelSovereign
committed
Security: Hardened LLM JSON extraction in Sophia Governor
MichaelSovereign
committed
Security: Switched to full SHA-256 for machine identity to prevent collisions
MichaelSovereign
committed
Security: Added robustness to cache feature extraction to prevent crashes on empty data
MichaelSovereign
committed
Security: Switched from float to Decimal for precise financial calculations in payouts
MichaelSovereign
committed
Security: Switched from print to logging and improved error handling in claims eligibility
MichaelSovereign
committed
Security: Enforced commitment matching in BCOS attestation to prevent report tampering
MichaelSovereign
committed
Security: Added database-level CHECK constraints for transaction amounts to prevent negative value injection
MichaelSovereign
committed
Security: Hardened claim ID generation to prevent potential ID collisions
MichaelSovereign
committed
Security: Prevented field-level DoS in hardware binding by capping MAC address and flag storage
MichaelSovereign
committed
Security: Implemented HMAC authentication for P2P state and attestation endpoints to prevent data leakage
MichaelSovereign
committed
Security: Implemented atomic transactions for IP rate limiting to prevent race condition bypass
MichaelSovereign
committed
Security: Implemented input sanitization to prevent prompt injection in Sophia Inspector
MichaelSovereign
committed
Enhancement: Added environment variable support and timeout protection for Ergo anchoring
MichaelSovereign
committed
Security: Prevented Sybil attacks in Warthog rewards by enforcing unique WART addresses per epoch
MichaelSovereign
committed
Security: Enforced global uniqueness for GitHub accounts and wallets in airdrop to prevent double-claiming
MichaelSovereign
committed
Security: Implemented strict table whitelisting to prevent SQL injection in sync manager
MichaelSovereign
committed
Security: Improved error handling and logging in rewards settlement to prevent silent failures
MichaelSovereign
committed
Security: Implemented HMAC for subnet hashing to prevent rainbow table attacks on miner IPs
MichaelSovereign
committed
Security: Implemented monotonic and future-limit validation for block timestamps
MichaelSovereign
committed
Security: Implemented atomic fetch-and-lock for withdrawals to prevent double payout race conditions
MichaelSovereign
committed
Security: Implemented 'settling' status to prevent double settlement in case of server crash
MichaelSovereign
committed
Security: Hardened external subprocess calls and improved error handling in hardware fingerprinting
MichaelSovereign
committed
Security: Prevented network mapping by removing internal peer history from sync status response
MichaelSovereign
committed
Security: Hardened consensus probe with secure HTTP requests and error sanitization
MichaelSovereign
committed
Enhancement: Implemented fee-based mempool prioritization to prevent transaction spam
MichaelSovereign
committed
Enhancement: Added application-level support for transaction fees in TX handler
MichaelSovereign
committed
Security: Prevented authentication bypass in governor inbox when admin key is unconfigured
MichaelSovereign
committed
Security: Enforced strict admin authentication for passport updates and log entries
MichaelSovereign
committed
Security: Doubled Beacon agent ID length to prevent hash collisions in large-scale deployments
MichaelSovereign
committed
Security: Prevented authentication bypass in review service when admin key is unconfigured
MichaelSovereign
committed
Security: Added registration pool limits and deterministic JSON hashing in Elya Service
MichaelSovereign
committed
Security: Hardened file hashing and added algorithm validation in ROM fingerprint database
MichaelSovereign
committed
Security: Fixed potential SQL injection in GPU node filtering by implementing job type whitelisting
MichaelSovereign
committed
Security: Prevented directory traversal in badge metadata storage by sanitizing IDs
MichaelSovereign
committed
Enhancement: Added multi-chain address validation support for RustChain, Base, and Ethereum
MichaelSovereign
committed
Security: Implemented serial number validation and placeholder blocking in hardware binding
MichaelSovereign
committed
Security: Improved double-mining detection by joining with IP metadata and streamlining queries
MichaelSovereign
committed
Security: Implemented basic SSRF protection for LLM endpoints in Sophia Governor
MichaelSovereign
committed
Security: Implemented global mempool size limit to prevent resource exhaustion attacks
MichaelSovereign
committed
Security: Hardened nonce validation by checking transaction history to prevent replay during potential state drifts
MichaelSovereign
committed
Security: Implemented atomic transactions for fingerprint rate limiting to prevent TOCTOU bypass
MichaelSovereign
committed
Security: Prevented Link Injection and Phishing by disabling untrusted X-Forwarded-Host header in feed builders
MichaelSovereign
committed
Security: Implemented score clamping and total re-calculation in BCOS PDF generator to prevent misleading certificates
MichaelSovereign
committed
Enhancement: Added exponential backoff retry logic to payout worker for improved reliability
MichaelSovereign
committed
Security: Implemented input sanitization and type enforcement for WebSocket broadcasts in Elya Service
MichaelSovereign
committed
Security: Hardened oEmbed video ID extraction and prevented Host Injection in embed routes
MichaelSovereign
committed
Security: Prevented authentication bypass in lock ledger when admin key is unconfigured
MichaelSovereign
committed
Security: Implemented permission validation for pinned TLS certificates to prevent MitM via certificate tampering
MichaelSovereign
committed
Bugfix: Fixed broken XML syntax in Atom feed thumbnail generation
MichaelSovereign
committed
Security: Switched to Decimal for precise balance conversion during UTXO genesis migration
MichaelSovereign
committed
Security: Switched to Decimal for precise financial calculations in UTXO transfer endpoint
MichaelSovereign
committed
Security: Hardened WebSocket configuration by restricting CORS and reducing max buffer size
MichaelSovereign
committed
Security: Hardened withdrawal archive storage with directory isolation and strict file permissions
MichaelSovereign
committed
Security: Implemented strict public key validation for epoch enrollment to prevent identity spoofing
MichaelSovereign
committed
Security: Improved Merkle hash calculation efficiency and implemented row limits to prevent DoS
MichaelSovereign
committed
Security: Implemented automatic mempool cleanup to prevent resource exhaustion from expired transactions
MichaelSovereign
committed
Enhancement: Standardized error responses in Elya Service for better integration with block explorer
MichaelSovereign
committed
Security: Hardened wallet hopping detection with stricter thresholds and extended history analysis
MichaelSovereign
committed
Security: Enforced admin authentication for UTXO statistics endpoint to prevent information disclosure
MichaelSovereign
committed
Enhancement: Added server time collection to consensus probe for improved synchronization diagnostics
MichaelSovereign
committed
Security: Implemented room name validation for WebSocket subscriptions to prevent unauthorized channel access
MichaelSovereign
committed