2.3 KiB
-
[2026-04-10 22:40] RED TEAM REPORT: Quasar PQZ Consensus - 2026-04-10. SUMMARY: 3 critical, 3 high, 3 medium, 2 low, 2 info findings. CRITICAL-1: Fake finality via OpFinalized (quasar.go:493-520) - no cert verification. CRITICAL-2: Hash-operation binding broken in handleProposal (quasar.go:421-467). CRITICAL-3: Zero authentication on management API (mgmt.go). HIGH-1: Validator ID spoofing. HIGH-2: Proposal spam OOM. HIGH-3: Unbounded HTTP body. Recommendation: DO-NOT-SHIP.
-
[2026-04-10 22:40] BLUE TEAM AUDIT 2026-04-10: Quasar PQZ consensus has 6 production-blocking findings. CRITICAL-1: handleFinalized trusts peer finality without proof (quasar.go:493). CRITICAL-2: HTTP mgmt API no auth (mgmt.go:204). CRITICAL-3: ZAP control plane no auth (mgmt.go:261). HIGH-4: handleProposal hash/payload mismatch (quasar.go:422). HIGH-5: handleVote ignores sender identity (quasar.go:471). HIGH-6: No key persistence/rotation/revocation. MEDIUM: zapstore encryption optional, no HTTP body limits, no WriteTimeout, backup file perms. CLEAN: SQL injection (all parameterized), XSS (React escaping). Red should attack: OpFinalized fabrication, unauthenticated HTTP writes, hash/opJSON mismatch signing, validator identity spoofing, stream manipulation via ZAP, OOM via large POST body.
-
[2026-04-10 23:41] RED TEAM REPORT: pubsub security fixes review (2026-04-10). 7 findings: 1 CRITICAL, 2 HIGH, 2 MEDIUM, 1 LOW, 1 INFO. R-CRIT-1: ZAP HMAC chicken-and-egg. R-HIGH-1: HTTP auth timing leak. R-HIGH-2: Peer-validator binding bypass. R-MED-1: Finalized ops not persisted. R-MED-2: Weak encryption key accepted. R-LOW-1: Health endpoint info leak. R-INFO-1: Hybrid naming remnants.
-
[2026-04-10 23:42] BLUE REPORT 2026-04-10: Pubsub security fix validation. Fix 1 (HTTP auth) PASS with timing side-channel finding. Fix 2 (ZAP HMAC) FAIL CRITICAL - circular MAC computation over msg.Bytes() includes the MAC field itself. Fix 3 (peer binding) PASS with unbounded peerValidators map. Fix 4 (persistence) PASS but only height persisted, not finalized ops. Fix 5 (encryption enforcement) PASS. Fix 6 (backup perms 0o600) PASS. Fix 7 (naming cleanup) PASS. No tests cover auth middleware paths. Red priority vectors: HMAC bypass, HTTP token timing attack, peer identity hijack, restart consensus state, store encryption enforcement, body bomb on submit endpoint, pending queue exhaustion.