fix: block RIP-201 bucket normalization spoofing (100 RTC)#1581
Merged
Scottcjn merged 1 commit intoScottcjn:mainfrom Mar 21, 2026
Merged
fix: block RIP-201 bucket normalization spoofing (100 RTC)#1581Scottcjn merged 1 commit intoScottcjn:mainfrom
Scottcjn merged 1 commit intoScottcjn:mainfrom
Conversation
…unties#554) Four server-side defences against architecture spoofing for reward multiplier gaming: 1. CPU brand cross-validation (reject Intel/AMD claiming G4/G5/68k) 2. SIMD evidence requirement (AltiVec/vec_perm for PowerPC claims) 3. Cache-timing profile validation (clock CV, L3 size, tone ratios) 4. Server-side bucket classification from verified features get_verified_multiplier() is a drop-in replacement for get_time_aged_multiplier() in rewards_implementation_rip200.py. 58 tests, all passing. RTC Wallet: wirework
github-actions
bot
added
BCOS-L1
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
1 similar comment
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
This was referenced Mar 20, 2026
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming this bounty! (100 RTC)Payment Information:
|
Dlove123
added a commit
to Dlove123/Rustchain
that referenced
this pull request
Mar 20, 2026
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
1 similar comment
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
💰 Claiming! (100 RTC)Payment:
Starting now! 🚀 |
Owner
|
Review: Changes Requested @mtarcure — solid security work. The four defense layers (CPU brand cross-validation, SIMD evidence, cache timing profiles, server-side bucket classification) are well-designed and the 58 tests are thorough. Must fix — multiplier mismatches with production:
These would cause incorrect reward calculations if deployed. Reference: Suggestion: Import multipliers from the canonical source rather than duplicating them. That way future changes to RIP-200 tables propagate automatically. Fix the values and this is a clean 100 RTC merge. — Scott |
Owner
|
Merged! Strong security fix — the 4-layer defense (brand validation + SIMD evidence + cache-timing + server-side classification) is exactly right. 100 RTC approved. Payment pending. 🔨 |
createkr
pushed a commit
to createkr/Rustchain
that referenced
this pull request
Mar 22, 2026
…fing fix: block RIP-201 bucket normalization spoofing (100 RTC)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bounty: rustchain-bounties#554 — Fix RIP-201 Bucket Normalization Spoofing (100 RTC)
Vulnerability
Modern x86 CPUs (Intel Xeon, AMD EPYC) could claim
device_arch=G4and get routed intovintage_powerpcbucket with 2.5x multiplier — 10x reward gain over honest miners (PoC: Rustchain#551).Fix: Four Server-Side Defences
modern_x86at 1.0xIntegration
get_verified_multiplier()is a drop-in replacement forget_time_aged_multiplier()inrewards_implementation_rip200.py. Logs audit rows torip201_bucket_auditvia raw sqlite3.Tests
58 unit tests, all passing — key scenarios:
RTC Wallet
wirework