Skip to content

Security/hardening: Executor signature verification disabled; token counts self-reported on Finish #1474

Closed @Aphelios01-sdk opened 2026-07-18 03:05 UTC 1 comment Updated 2026-07-18 03:08 UTC

Summary

On-chain policy disables executor signature verification on both Start-first and Finish-first paths. Payment-critical CompletionTokenCount / PromptTokenCount come from MsgFinishInference and drive escrow payouts up to reserved max.

Integrity then relies on peer validation / invalidation. That residual control is weaker when ClaimValidationEnabled is false (related issue).

Source also notes a TODO: TA signature should include inferenceId to prevent modified-prompt substitution.

Paths

  • inference-chain/x/inference/keeper/msg_server_start_inference.go
  • inference-chain/x/inference/keeper/msg_server_finish_inference.go
  • inference-chain/x/inference/calculations/inference_state.go

Suggested remediation

  1. Re-enable executor signatures over response/prompt hashes + token counts + inferenceId
  2. Bind TA signature to inferenceId (resolve TODO)
  3. Cross-check tokens during validation against payloads when available

Disclosure

May be intentional design — filing for visibility / defense-in-depth. Happy to discuss on HackerOne if preferred.

💬 Comments (1)

@Aphelios01-sdk commented 2026-07-18 03:08 UTC

Closing to focus disclosure on the highest-priority finding: https://github.com/gonka-ai/gonka/issues/1470 (SSRF via InferenceUrl). Other items can be re-opened or filed via HackerOne if needed.

🔄 Auto-synced from Issue #1474 every hour.