Security Audit: Systematic review across inference chain, bridge, subnet, and API layers #1053
Summary
Systematic security audit covering four major components of the Gonka network. Found 1 Critical, 5 High, 10+ Medium severity issues across the codebase. Fix PRs submitted for the top 3 findings.
Update 2026-04-20 (self-review): After re-auditing against the submission quality bar, findings #3, #8, #16, #21 are withdrawn (see "Withdrawn findings" section below). Same self-review also closed PRs #1077 and #1058.
Fix PRs Submitted
| PR | Severity | Issue |
|---|---|---|
| #1050 | High | Non-deterministic float64 in validation consensus path — chain fork risk |
| #1051 | High | Partial state update in claim rewards — permanent fund loss |
| #1052 | Medium-High | PoC V2 missing permission check — any account can submit validations |
Additional Findings (No PR Yet)
Critical
1. Admin API has zero authentication
- decentralized-api/internal/server/admin/server.go:60-102
- Only LoggingMiddleware applied. Destructive endpoints (DELETE nodes/:id, POST tx/send, GET export/db, GET config) accessible to anyone who reaches the admin port.
- Impact: Full compromise — create/delete nodes, send arbitrary chain transactions, dump database and config.
- Recommendation: Add authentication middleware (API key or mTLS). This should be treated as a private disclosure — reporting here for visibility but recommend immediate action.
High
2. SSRF via executor URL from chain state
- decentralized-api/internal/server/public/post_chat_handler.go:380
- executor.Url + "/v1/chat/completions" — malicious participant registers with internal URL (e.g., http://169.254.169.254). NoRedirectClient blocks redirects but doesn't validate against private IP ranges.
- Impact: Access to cloud metadata, internal services.
4. Unauthenticated GET endpoints on transport server
- subnet/transport/server.go:112-116 — /diffs, /mempool, /signatures skip auth (acknowledged by TODO).
- Impact: Leak session state, validator signatures, mempool contents.
5. Verbose error disclosure to clients
- decentralized-api/internal/server/middleware/error_handler.go:23-34
- TransparentErrorHandler returns raw err.Error() for all non-echo errors, leaking internal URLs, stack traces, node topology.
Medium
6. Warm key cache poisoning (bridge)
- subnet/bridge/rest.go:173 — sync.Map caches auth results permanently. Revoked warm keys remain authorized until process restart.
7. Rate limiter bulk eviction creates burst window
- subnet/transport/ratelimit.go:42-43 — When entries exceed 1000, entire map is cleared. Attacker sends from 1000+ addresses to reset all rate limits.
9. Unbounded diffs array in catch-up path
- subnet/transport/server.go:391-400 — No cap on diffs per request. CPU/memory exhaustion vector.
10. CORS wildcard default
- proxy/entrypoint.sh:244 — CORS_ALLOW_ORIGIN defaults to "*", enabling cross-site request abuse.
11. Debug endpoints exposed on public server
- decentralized-api/internal/server/public/server.go:130-131 — /v1/debug/* registered with no auth guard.
12. Subnet escrow remainder underflow
- inference-chain/x/inference/keeper/msg_server_settle_subnet_escrow.go:66 — Cost aggregation differs between VerifySubnetSettlement and SettleSubnetEscrow, potentially underpaying validators.
13. ETH withdrawal uses low-level call without gas limit
- proposals/ethereum-bridge-contact/contracts/BridgeContract.sol:368 — call{value: cmd.amount}("") forwards all gas to arbitrary recipient.
14. Epoch cleanup doesn't clean processedRequests (bridge)
- proposals/ethereum-bridge-contact/contracts/BridgeContract.sol:583-591 — Storage grows unboundedly.
Low
15. submitGroupKey allows epoch 1 without signature — BridgeContract.sol:302-307
17. Hardcoded password in testnet scripts — test-net-cloud/nebius/bridge/bridge-pool-fund.sh:60
18. Keyring backend "test" in production config — decentralized-api/config-prod.yaml:9
19. completedResponses map grows unbounded — subnet/host/host.go:83
20. pendingTxKeys dedup set grows to 100K — subnet/user/user.go:528
Withdrawn findings (2026-04-20 self-review)
These were either scoped to internal/user-side processes or duplicates of already-withdrawn PRs:
- #3 Subnet proxy (subnetctl) zero auth —
subnetctlis a user-side local CLI proxy (seesubnet/docs/proxy.md), run by the escrow owner on localhost. Not a multi-tenant service. - #8 Unbounded request body on subnet proxy — same reason as #3.
- #16 SSRF via escrowID in REST bridge —
baseURLis operator-controlled (config), making this a same-origin internal path. Same class as already-withdrawn #1064. - #21 TokenomicsData uint64 overflow — direct duplicate of already-withdrawn #1062 (theoretical accumulation > 2^64, not reachable).
Methodology
- Manual code review of all four layers (inference chain, bridge, subnet, API)
- Focus on: fund safety, consensus determinism, authentication/authorization, resource exhaustion, input validation
- Cross-referenced with existing issues (#979, #933, #883, #885) to avoid duplicates
Note on Responsible Disclosure
Finding #1 (Admin API no auth) is Critical severity. Per the bounty program guidelines, critical issues should be reported privately. I'm including it here for completeness but recommend the team prioritize this fix immediately. Happy to discuss privately if needed.
I plan to submit additional fix PRs for the remaining findings if the team is interested.
💬 Comments (3)
2026-04-20 self-review update: withdrawing findings #3, #8, #16, #21 (see "Withdrawn findings" section in the updated body). Same review pass closed PRs #1077 and #1058.
Rationale:
- #3, #8 (subnetctl zero-auth, unbounded body) — subnetctl is a user-side local CLI proxy for the escrow owner (localhost:8080), not a multi-tenant service. Threat model doesn't apply.
- #16 (SSRF via escrowID in REST bridge) — baseURL is operator-controlled config, so this is a same-origin internal-path concern, same class as the earlier withdrawn #1064.
- #21 (TokenomicsData uint64 overflow) — direct duplicate of already-withdrawn #1062; requires > 2^64 accumulation which is not reachable in practice.
Keeping the queue focused on actionable findings. The other 17 items (including the Critical #1 and the High findings #2/#4/#5) remain valid.
Cleanup summary (2026-04-20)
Per maintainer feedback on PR quality, I've completed a self-audit of all submissions under this umbrella. Summary:
Withdrawn (target removed code)
-
1082, #1083 — both targeted
AssignTrainingTask/CreateDummyTrainingTaskin the training module which was removed in #1009 (2026-04-07). Closed with apology.
Withdrawn from this audit (previous waves)
- F3, F8, F16, F21 sub-findings in this issue body — dropped after re-verification against current code.
Revised after self-review
All 8 remaining open PRs were run through gonka-ai/ai-reviewer personas (skeptic + chain_security / dapi-behavioral-correctness). Full review output posted as comments on each PR.
Code changes pushed in response to ai-reviewer findings: - #1054 — log original error server-side before generic response - #1055 — add IPv4-mapped IPv6 to SSRF blocklist; document DNS-rebinding as follow-up - #1063 — include query string in signed payload (closes parameter-tampering replay) - #1050 — rewrote body to reflect actual severity (preventive, not "chain fork")
Remaining 8 open PRs
| PR | Severity (revised) | Status |
|---|---|---|
| #1050 consensus float64 | Low (preventive) | ready |
| #1052 PoC V2 permissions | Medium | ready |
| #1054 error handler leak | Low | revised, ready |
| #1055 SSRF partial mitigation | Medium | revised, ready |
| #1056 rate limiter eviction | Low-Medium | ready |
| #1057 warm key TTL | Low-Medium | ready |
| #1060 debug endpoints | Low | ready |
| #1063 GET auth | Medium | revised, ready |
Going forward I'll only submit PRs after running ai-reviewer locally and validating against current master.
🔄 Auto-synced from Issue #1053 every hour.
Payout Address
If any of the findings or fix PRs (#1050, #1051, #1052, #1054, #1055, #1056, #1057) are eligible for bounty rewards, please send to:
Happy to discuss any of the findings in more detail or submit additional fixes for the remaining issues listed above.