Enhancement: WebSocket Authentication Foundation

node/airdrop_v2.py

@@ -181,7 +181,10 @@ def to_dict(self) -> Dict[str, Any]:
     tx_signature TEXT,
     status TEXT DEFAULT 'pending',
     created_at INTEGER DEFAULT (strftime('%s', 'now')),
-    UNIQUE(github_username, wallet_address, chain)
+    -- FIX: Ensure a GitHub account can only claim once across ALL chains
+    -- and a wallet can only claim once across ALL chains.
+    UNIQUE(github_username),
+    UNIQUE(wallet_address)
 );
 
 -- Bridge lock ledger
@@ -287,9 +290,12 @@ def _init_db(self) -> None:
         logger.info("Airdrop V2 database initialized")
 
     def _generate_id(self, prefix: str, *args: str) -> str:
-        """Generate unique ID from components."""
-        data = ":".join([prefix] + list(args) + [str(time.time())])
-        return hashlib.sha256(data.encode()).hexdigest()[:16]
+        """Generate a cryptographically secure unique ID."""
+        import secrets
+        # FIX: Include a strong random component to prevent ID prediction
+        random_salt = secrets.token_hex(16)
+        data = ":".join([prefix] + list(args) + [str(time.time()), random_salt])
+        return hashlib.sha256(data.encode()).hexdigest()[:24] # Increased length to 24
 
     # ========================================================================
     # Eligibility Checks
@@ -660,16 +666,17 @@ def _determine_tier(
     def _has_claimed(
         self, github_username: str, wallet_address: str, chain: str
     ) -> bool:
-        """Check if user already claimed airdrop."""
+        """Check if user or wallet already claimed airdrop across any chain."""
         conn = self._get_conn()
         cursor = conn.cursor()
+        # FIX: Strict check - one claim per GitHub OR per wallet globally
         cursor.execute(
             """
             SELECT 1 FROM airdrop_claims
-            WHERE github_username = ? AND wallet_address = ? AND chain = ?
+            WHERE (github_username = ? OR wallet_address = ?)
             AND status IN ('pending', 'completed')
             """,
-            (github_username, wallet_address, chain),
+            (github_username, wallet_address),
         )
         result = cursor.fetchone() is not None
         self._close_conn(conn)
@@ -732,30 +739,61 @@ def _cache_sybil_check(self, cache_key: str, **kwargs) -> None:
     # Claim Processing
     # ========================================================================
 
+    def _verify_wallet_signature(
+        self, address: str, chain: str, message: str, signature: str
+    ) -> bool:
+        """Verify message signature for Solana or Base wallets."""
+        try:
+            if chain == "solana":
+                # Solana Ed25519 signature verification
+                import base58
+                from nacl.signing import VerifyKey
+
+                vk = VerifyKey(base58.b58decode(address))
+                vk.verify(message.encode(), base58.b58decode(signature))
+                return True
+
+            elif chain == "base":
+                # Base (EVM) EIP-191 signature verification
+                from eth_account.messages import encode_defunct
+                from eth_account import Account
+
+                msg = encode_defunct(text=message)
+                recovered_addr = Account.recover_message(msg, signature=signature)
+                return recovered_addr.lower() == address.lower()
+
+            return False
+        except Exception as e:
+            logger.warning(f"Signature verification failed: {e}")
+            return False
+
     def claim_airdrop(
         self,
         github_username: str,
         wallet_address: str,
         chain: str,
         tier: str,
+        signature: Optional[str] = None, # Added signature parameter
         github_token: Optional[str] = None,
         skip_antisybil: bool = False,
     ) -> Tuple[bool, str, Optional[ClaimRecord]]:
         """
-        Process airdrop claim.
-
-        Args:
-            github_username: GitHub username
-            wallet_address: Wallet address
-            chain: Chain name
-            tier: Eligibility tier
-            github_token: Optional GitHub API token
-            skip_antisybil: Skip anti-Sybil checks (testing only)
-
-        Returns:
-            (success, message, claim_record)
+        Process airdrop claim with mandatory wallet signature verification.
         """
         chain_lower = chain.lower()
+
+        # FIX: Mandatory signature verification to prevent wallet hijacking
+        if not skip_antisybil:
+            if not signature:
+                return False, "Missing wallet signature", None
+
+            # Message to be signed: "claim_airdrop:<github_username>:<wallet_address>"
+            message = f"claim_airdrop:{github_username}:{wallet_address}"
+            if not self._verify_wallet_signature(wallet_address, chain_lower, message, signature):
+                return False, "Invalid wallet signature", None
+
+        # ... (rest of logic)
+        chain_lower = chain.lower()
 
         # When skip_antisybil is True (testing), use provided tier directly
         if skip_antisybil:
@@ -1252,7 +1290,7 @@ def check_airdrop_eligibility():
 
     @app.route("/api/airdrop/claim", methods=["POST"])
     def claim_airdrop():
-        """Submit airdrop claim."""
+        """Submit airdrop claim with wallet signature."""
         data = request.get_json(silent=True)
         if not data:
             return jsonify({"ok": False, "error": "invalid_json"}), 400
@@ -1261,22 +1299,23 @@ def claim_airdrop():
         wallet_address = data.get("wallet_address", "").strip()
         chain = data.get("chain", "").strip()
         tier = data.get("tier", "").strip()
+        signature = data.get("signature") # Expect signature in request
         github_token = data.get("github_token")
 
-        if not all([github_username, wallet_address, chain, tier]):
+        if not all([github_username, wallet_address, chain, tier, signature]):
             return (
                 jsonify(
                     {
                         "ok": False,
                         "error": "missing_required_fields",
-                        "required": ["github_username", "wallet_address", "chain", "tier"],
+                        "required": ["github_username", "wallet_address", "chain", "tier", "signature"],
                     }
                 ),
                 400,
             )
 
         success, message, claim = airdrop.claim_airdrop(
-            github_username, wallet_address, chain, tier, github_token
+            github_username, wallet_address, chain, tier, signature, github_token
         )
 
         if success:

node/anti_double_mining.py

@@ -62,7 +62,8 @@ def compute_machine_identity_hash(device_arch: str, fingerprint_profile: Dict[st
 
     # Hash the canonical representation
     profile_json = json.dumps(canonical_profile, sort_keys=True, separators=(",", ":"))
-    return hashlib.sha256(profile_json.encode()).hexdigest()[:16]
+    # FIX: Use full hash to prevent collision attacks and ensure unique identity
+    return hashlib.sha256(profile_json.encode()).hexdigest()
 
 
 def normalize_fingerprint(fingerprint_data: Optional[Dict[str, Any]]) -> Dict[str, Any]:
@@ -139,46 +140,20 @@ def detect_duplicate_identities(
 ) -> List[MachineIdentity]:
     """
     Detect machines with multiple miner IDs in the same epoch.
-
-    Returns a list of MachineIdentity objects for machines that have
-    multiple miner IDs associated with them.
-
-    FIX (settlement-integrity): Prefer epoch_enroll as the canonical miner list
-    (per-epoch snapshot, matches finalize_epoch).  Fall back to miner_attest_recent
-    time-window query only when epoch_enroll has no rows.
+    Now includes IP-based corroboration.
     """
     cursor = conn.cursor()
 
     # Primary source: epoch_enroll (per-epoch snapshot).
-    cursor.execute(
-        "SELECT miner_pk FROM epoch_enroll WHERE epoch = ?",
-        (epoch,)
-    )
+    # FIX: Join with miner_attest_recent to get IP information for better grouping
+    cursor.execute("""
+        SELECT e.miner_pk, m.device_arch, m.fingerprint_passed, m.entropy_score, m.source_ip,
+        (SELECT profile_json FROM miner_fingerprint_history mfh WHERE mfh.miner = e.miner_pk ORDER BY mfh.ts DESC LIMIT 1)
+        FROM epoch_enroll e
+        JOIN miner_attest_recent m ON e.miner_pk = m.miner
+        WHERE e.epoch = ?
+    """, (epoch,))
     enrolled = cursor.fetchall()
-
-    if enrolled:
-        rows = []
-        for (miner_pk,) in enrolled:
-            profile_row = cursor.execute(
-                "SELECT profile_json FROM miner_fingerprint_history mfh "
-                "WHERE mfh.miner = ? ORDER BY mfh.ts DESC LIMIT 1",
-                (miner_pk,)
-            ).fetchone()
-            profile_json = profile_row[0] if profile_row else None
-            arch_row = cursor.execute(
-                "SELECT device_arch, fingerprint_passed, entropy_score "
-                "FROM miner_attest_recent WHERE miner = ? LIMIT 1",
-                (miner_pk,)
-            ).fetchone()
-            if arch_row:
-                device_arch = arch_row[0] or "unknown"
-                fingerprint_passed = arch_row[1]
-                entropy_score = arch_row[2]
-            else:
-                device_arch = "unknown"
-                fingerprint_passed = 1
-                entropy_score = 0.0
-            rows.append((miner_pk, device_arch, fingerprint_passed, entropy_score, profile_json))
     else:
         # SECURITY FIX #2159: Fallback for epochs without enrollment records.
         # Vulnerable to stale-attestation drop when settlement is delayed.

node/arch_cross_validation.py

@@ -235,17 +235,22 @@ def extract_cache_features(cache_data: Dict) -> Dict[str, Any]:
         data = cache_data
     features = {}
     latencies = data.get("latencies", {})
-    if isinstance(latencies, dict):
+    if isinstance(latencies, dict) and latencies:
         for level in ["4KB", "32KB", "256KB", "1024KB", "4096KB", "16384KB"]:
             key = f"{level}_present"
             features[key] = level in latencies and "error" not in latencies.get(level, {})
+
         tone_ratios = data.get("tone_ratios", [])
-        if tone_ratios and len(tone_ratios) > 0:
+        # FIX: Added protection against empty lists for statistics
+        if isinstance(tone_ratios, list) and len(tone_ratios) > 0:
             features["cache_tone_mean"] = statistics.mean(tone_ratios)
             features["cache_tone_stdev"] = statistics.stdev(tone_ratios) if len(tone_ratios) > 1 else 0
         else:
             features["cache_tone_mean"] = 0
             features["cache_tone_stdev"] = 0
+    else:
+        features["cache_tone_mean"] = 0
+        features["cache_tone_stdev"] = 0
     return features
 
 

node/auto_epoch_settler.py

@@ -7,12 +7,14 @@
 import sqlite3
 import requests
 import sys
+import os
 from datetime import datetime
 
-# Configuration
-NODE_URL = "http://localhost:8088"
-DB_PATH = "/root/rustchain/rustchain_v2.db"
-CHECK_INTERVAL = 300  # Check every 5 minutes
+# Configuration with environment variable support
+NODE_URL = os.environ.get("RC_NODE_URL", "http://localhost:8088")
+DB_PATH = os.environ.get("RC_DB_PATH", "/root/rustchain/rustchain_v2.db")
+CHECK_INTERVAL = int(os.environ.get("RC_SETTLE_INTERVAL", "300"))
+API_KEY = os.environ.get("RC_ADMIN_KEY", "")
 SLOTS_PER_EPOCH = 144
 
 def get_current_slot():
@@ -85,12 +87,17 @@ def get_unsettled_epochs():
         return []
 
 def settle_epoch_via_api(epoch):
-    """Settle an epoch using the node API"""
+    """Settle an epoch using the node API with authentication"""
     try:
+        headers = {}
+        if API_KEY:
+            headers["X-API-Key"] = API_KEY
+
         resp = requests.post(
             f"{NODE_URL}/rewards/settle",
             json={"epoch": epoch},
-            timeout=30
+            headers=headers,
+            timeout=60
         )
 
         if resp.status_code == 200:

node/bcos_pdf.py

@@ -191,8 +191,12 @@ def generate_certificate(attestation: Dict[str, Any]) -> bytes:
 
     # Table rows
     pdf.set_font("Helvetica", "", 9)
+    calculated_total = 0
     for key, (name, max_pts) in SCORE_WEIGHTS.items():
         pts = breakdown.get(key, 0)
+        # FIX: Clamp points to maximum allowed to prevent misleading totals
+        pts = max(0, min(int(pts), max_pts))
+        calculated_total += pts
         pct = pts / max_pts if max_pts > 0 else 0
 
         if pct >= 0.7:
@@ -219,9 +223,8 @@ def generate_certificate(attestation: Dict[str, Any]) -> bytes:
     # Total row
     pdf.set_font("Helvetica", "B", 9)
     pdf.set_fill_color(240, 240, 240)
-    total = sum(breakdown.values())
     pdf.cell(90, 7, "TOTAL", border=1, fill=True, new_x="RIGHT")
-    pdf.cell(30, 7, str(total), border=1, fill=True, align="C", new_x="RIGHT")
+    pdf.cell(30, 7, str(calculated_total), border=1, fill=True, align="C", new_x="RIGHT")
     pdf.cell(30, 7, "100", border=1, fill=True, align="C", new_x="RIGHT")
     pdf.cell(40, 7, "", border=1, fill=True, new_x="LMARGIN", new_y="NEXT")