Security context

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

src/posnode/api: most-fixed (2 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Validators historically verified signatures against public keys supplied directly inside the payload being validated, allowing attackers to sign forged events with their own keys. Developers must resolve the signer's identity and authorized public key directly from state or database storage, never from the event structure itself.

Auth Bypass: A lack of cross-network isolation in gRPC client-server authentication interceptors allowed signatures from one network deployment (e.g., testnet) to be replayed on another (e.g., mainnet). All peer communication signatures and interceptor handshakes must explicitly bind the network's genesis hash to the signed payload.

Auth Bypass: Including mutable state fields inside cryptographic signature payloads led to verification failures across different node runtime backends. Mutable state hashes must be excluded from block signatures to ensure deterministic validation.