Skip to content

Security: Hardware Binding Storage Hardening#2885

Closed
MichaelSovereign wants to merge 24 commits intoScottcjn:mainfrom
MichaelSovereign:security-fix/hw-binding-dos
Closed

Security: Hardware Binding Storage Hardening#2885
MichaelSovereign wants to merge 24 commits intoScottcjn:mainfrom
MichaelSovereign:security-fix/hw-binding-dos

Conversation

@MichaelSovereign
Copy link
Copy Markdown
Contributor

Summary

This PR prevents a potential field-level Denial of Service (DoS) vulnerability in the hardware binding system.

Changes

  1. MAC List Capping: Implemented a limit of 20 unique MAC addresses per machine identity and added duplicate detection using a set. This prevents the text field from growing indefinitely.
  2. Flag Management: Simplified flag updates to prevent infinite string concatenation in the column.
  3. Data Integrity: Ensures that the database records remain within reasonable size limits even if a malicious actor attempts to spam registration updates with varying hardware identifiers.

Closes #6460

@MichaelSovereign MichaelSovereign requested a review from Scottcjn as a code owner May 2, 2026 05:21
@github-actions github-actions Bot added BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related tests Test suite changes size/XL PR: 500+ lines labels May 2, 2026
Copy link
Copy Markdown
Contributor

@jaxint jaxint left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR Review: Hardware Binding Storage Hardening

Summary

This PR addresses a security vulnerability in the RustChain codebase.

Key Changes

  • node/anti_double_mining.py: +2 -1
  • node/arch_cross_validation.py: +7 -2
  • node/auto_epoch_settler.py: +13 -6

Assessment

Approve — Meaningful security fix.


Reviewed by: jaxint
Wallet: AhqbFaPBPLMMiaLDzA9WhQcyvv4hMxiteLhPk3NhG1iG

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related size/XL PR: 500+ lines tests Test suite changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants