All issues

Search results

security(wallet): password API accepts &str — caller cannot zeroize original allocation

Status: Open.

#221 In AlphaB135/BitQuan;

· AlphaB135 opened on Jul 25, 2026

security(rpc): basic auth password stored as plaintext String for server lifetime

Status: Open.

#222 In AlphaB135/BitQuan;

· AlphaB135 opened on Jul 25, 2026

security(rpc): token bucket u32 overflow disables rate limiting after ~49 days

Status: Open.

#220 In AlphaB135/BitQuan;

· AlphaB135 opened on Jul 25, 2026

security(rpc): n_blocks parameter in generate RPC has no upper bound — admin DoS

Status: Open.

#217 In AlphaB135/BitQuan;

· AlphaB135 opened on Jul 25, 2026

security(rpc): JWT error messages leak timing window and security policy details

Status: Open.

#218 In AlphaB135/BitQuan;

· AlphaB135 opened on Jul 25, 2026

security(network): peer height not verified against PoW — Sybil height inflation DoS

Status: Open.

#219 In AlphaB135/BitQuan;

· AlphaB135 opened on Jul 25, 2026

security(rpc): no JWT token revocation — stolen refresh token valid for 7 days

Status: Open.

#216 In AlphaB135/BitQuan;

· AlphaB135 opened on Jul 25, 2026

security(wallet): same derived key used for both AES-GCM and HMAC-SHA256 in backup — key reuse

Status: Open.

#215 In AlphaB135/BitQuan;

· AlphaB135 opened on Jul 25, 2026

security(wallet): Mobile Argon2id KDF profile trivially brute-forceable (8 MiB, t=1)

Status: Open.

#213 In AlphaB135/BitQuan;

· AlphaB135 opened on Jul 25, 2026

security(wallet): decrypted key material not zeroized after use — persists in heap/swap

Status: Open.

#214 In AlphaB135/BitQuan;

· AlphaB135 opened on Jul 25, 2026

security(consensus): fp_pow2 linear interpolation error may cause consensus split between nodes

Status: Open.

#210 In AlphaB135/BitQuan;

· AlphaB135 opened on Jul 25, 2026

security(consensus): validate_block passes None for total_fees — fee validation broken

Status: Open.

#209 In AlphaB135/BitQuan;

· AlphaB135 opened on Jul 25, 2026