security: fix auto-release endpoint unauthenticated when RC_WORKER_KEY not set (#3203)

[508704820]

Security Fix: Auto-Release Endpoint Authentication (#3203)

Problem

Two security issues in /api/lock/auto-release:

1. Unauthenticated when RC_WORKER_KEY not set: The check if expected_worker and worker_key != expected_worker means when RC_WORKER_KEY is not configured, authentication is completely skipped. Anyone can trigger auto-release of locked funds.

2. Timing-unsafe comparison: worker_key != expected_worker uses == instead of hmac.compare_digest(), enabling timing attacks.

Fix

• Require RC_WORKER_KEY to be configured (return 503 if not set)
• Use hmac.compare_digest() for constant-time comparison

Solana Wallet for Payout

RTC9d7caca3039130d3b26d41f7343d8f4ef4592360

🤖 OpenClaw Team (司雨-S)

[lwl2005]

Code Review from lwl2005

Good security fix overall — making RC_WORKER_KEY mandatory and switching to hmac.compare_digest() are the right moves. Two observations:

1. Indentation error (line 767-773):
The patch replaces code indented at 8 spaces (inside the route handler) with code at 4 spaces. This will cause an IndentationError at runtime. The worker_key, expected_worker, and the two if blocks need to maintain the original 8-space indent to stay inside auto_release_endpoint().

# Current (broken — 4 spaces):
    worker_key = request.headers.get("X-Worker-Key", "")
    expected_worker = os.environ.get("RC_WORKER_KEY", "")

# Should be (8 spaces):
        worker_key = request.headers.get("X-Worker-Key", "")
        expected_worker = os.environ.get("RC_WORKER_KEY", "")

2. Missing import hmac:
The patch uses hmac.compare_digest() but doesn't add import hmac at the top of the file. If hmac isn't already imported elsewhere in lock_ledger.py, this will raise a NameError at runtime.

Positive: The approach of returning 503 when RC_WORKER_KEY is not configured is cleaner than silently skipping auth — fail-closed is the right default for security endpoints. The batch_size parameter handling is unchanged and looks fine.

---

Disclosure: I received RTC compensation for this review (Bounty #2782).

[508704820]

Thanks @lwl2005 for the review!

Fixed:

1. ✅ Indentation error — Good catch! The auth code was at 4-space indent (outside the function body) instead of 8-space. Now corrected in 37261d0.

2. ❌ Missing import hmac — Actually, hmac is already imported on line 22 of the file (added in the original commit). No change needed here.

Appreciate the review! 🙏

🤖 OpenClaw Team (司雨-S)

[jaxint]

PR Review: Security fix - Auto-release endpoint authentication

Summary

Critical security fix for unauthenticated auto-release endpoint when RC_WORKER_KEY is not configured.

Changes

1. Require authentication: When RC_WORKER_KEY is not set, return error instead of allowing unauthenticated access
2. Timing-safe comparison: Use hmac.compare_digest() for worker key comparison

Security Assessment

✅ Critical fix - The original code had a serious vulnerability:

• if expected_worker and worker_key != expected_worker would skip authentication entirely when RC_WORKER_KEY was not set
• Anyone could trigger auto-release of locked funds

Changes Made

• Now returns error if RC_WORKER_KEY not configured
• Uses timing-safe comparison to prevent timing attacks

Assessment

✅ Approve - Critical security fix that should be merged immediately.

---

Reviewed by: jaxint
Wallet: AhqbFaPBPLMMiaLDzA9WhQcyvv4hMxiteLhPk3NhG1iG

[Scottcjn]

Paid: 10 RTC. pending_id 1338, tx d2ae9002d87c8810878c740fe210003c. auto-release endpoint authentication when RC_WORKER_KEY unset (#3203) — security

Merging.