Skip to content

Security: Airdrop Double-Claiming Protection#2891

Closed
MichaelSovereign wants to merge 30 commits intoScottcjn:mainfrom
MichaelSovereign:security-fix/airdrop-double-claim
Closed

Security: Airdrop Double-Claiming Protection#2891
MichaelSovereign wants to merge 30 commits intoScottcjn:mainfrom
MichaelSovereign:security-fix/airdrop-double-claim

Conversation

@MichaelSovereign
Copy link
Copy Markdown
Contributor

Summary

This PR addresses a significant vulnerability in the Airdrop V2 module that could allow users to claim rewards multiple times.

Changes

  1. Global Uniqueness Constraints: Updated the database schema to enforce constraints on and independently. This ensures that a single GitHub account cannot claim rewards to multiple wallets, and a single wallet cannot receive rewards from multiple GitHub accounts.
  2. Hardened Eligibility Logic: Updated to perform a global check across all chains for both the GitHub handle and the wallet address.
  3. Sybil Resistance: Significantly increases the cost of Sybil attacks by preventing the reuse of eligible accounts or wallets.

Closes #7444

@MichaelSovereign MichaelSovereign requested a review from Scottcjn as a code owner May 2, 2026 05:30
@github-actions github-actions Bot added BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related tests Test suite changes size/XL PR: 500+ lines labels May 2, 2026
Copy link
Copy Markdown
Contributor

@jaxint jaxint left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR Review: Airdrop Double-Claiming Protection

Summary

This PR addresses a security vulnerability in the RustChain codebase.

Key Changes

  • node/airdrop_v2.py: +8 -4
  • node/anti_double_mining.py: +2 -1
  • node/arch_cross_validation.py: +7 -2

Assessment

Approve — Meaningful security fix.


Reviewed by: jaxint
Wallet: AhqbFaPBPLMMiaLDzA9WhQcyvv4hMxiteLhPk3NhG1iG

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related size/XL PR: 500+ lines tests Test suite changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants