Skip to content

Security: P2P Gossip Authentication & Privacy#2886

Closed
MichaelSovereign wants to merge 25 commits intoScottcjn:mainfrom
MichaelSovereign:security-fix/p2p-gossip-auth
Closed

Security: P2P Gossip Authentication & Privacy#2886
MichaelSovereign wants to merge 25 commits intoScottcjn:mainfrom
MichaelSovereign:security-fix/p2p-gossip-auth

Conversation

@MichaelSovereign
Copy link
Copy Markdown
Contributor

Summary

This PR addresses a significant security and privacy concern in the P2P synchronization layer where sensitive CRDT state data was exposed through unauthenticated GET endpoints.

Changes

  1. Authenticated Sync Endpoints: Wrapped and with HMAC signature verification. This ensures that only authorized nodes within the same P2P cluster (sharing the ) can pull the network state.
  2. Path-Based Verification: Enhanced the helper to verify signatures over request paths and timestamps, preventing unauthorized data discovery by external actors.
  3. Information Protection: Prevents mass scraping of miner fingerprints and balances by unauthorized entities.

Closes #7440

@MichaelSovereign MichaelSovereign requested a review from Scottcjn as a code owner May 2, 2026 05:21
@github-actions github-actions Bot added BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related tests Test suite changes and removed BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) labels May 2, 2026
@github-actions github-actions Bot added size/XL PR: 500+ lines and removed node Node server related tests Test suite changes labels May 2, 2026
@Scottcjn Scottcjn closed this May 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size/XL PR: 500+ lines

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants