Skip to content

Security: Beacon API Authentication & Integrity#2873

Closed
MichaelSovereign wants to merge 12 commits intoScottcjn:mainfrom
MichaelSovereign:security-fix/beacon-auth-hardening
Closed

Security: Beacon API Authentication & Integrity#2873
MichaelSovereign wants to merge 12 commits intoScottcjn:mainfrom
MichaelSovereign:security-fix/beacon-auth-hardening

Conversation

@MichaelSovereign
Copy link
Copy Markdown
Contributor

Summary

This PR addresses critical authentication bypass vulnerabilities in the Beacon Atlas API.

Changes

  1. Cryptographic Signatures: Implemented which requires every state-changing request (claims, contract updates) to be signed by the agent's private key.
  2. Replay Protection: Added a mandatory timestamp and signature window (5 mins) for all authenticated requests.
  3. Authorization Checks: Added checks to ensure agents can only update contracts they are actually parties to.
  4. Data Integrity: Prevents unauthorized bounty hijacking and reputation manipulation.

Closes #7432

@MichaelSovereign MichaelSovereign requested a review from Scottcjn as a code owner May 2, 2026 05:12
@github-actions github-actions Bot added BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related tests Test suite changes size/L PR: 201-500 lines labels May 2, 2026
@Scottcjn Scottcjn closed this May 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related size/L PR: 201-500 lines tests Test suite changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants