[Bug] rustchain_sync_endpoints.py: require_admin decorator uses != for admin key comparison — timing attack

[haoyousun60-create]

Security Audit Finding

Severity: Medium
File: node/rustchain_sync_endpoints.py:93-96
Issue: The require_admin decorator uses != for admin key comparison instead of hmac.compare_digest. This is inconsistent with the same file's _verify_sync_signature function (line 83) which correctly uses hmac.compare_digest.

Code:

def require_admin(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        key = request.headers.get("X-Admin-Key") or request.headers.get("X-API-Key")
        if not key or key != admin_key:  # Timing-unsafe!
            return jsonify({"error": "Unauthorized"}), 401
        return f(*args, **kwargs)
    return decorated

Contrast with correct code in same file:

# Line 83 — correct:
if not hmac.compare_digest(signature, expected):
    return False, "Invalid signature"

Impact:

• Timing side-channel leaks admin key length and content
• All sync endpoints (/api/sync/status, /api/sync/pull, etc.) are affected
• Attacker can brute-force admin key byte-by-byte

Fix:

if not key or not hmac.compare_digest(key, admin_key):
    return jsonify({"error": "Unauthorized"}), 401

Wallet: RTC4642c5ee8467f61ed91b5775b0eeba984dd776ba

[haoyousun60-create]

Self-Audit Confirmation

I verified the timing-unsafe comparison in rustchain_sync_endpoints.py. The require_admin decorator uses != for admin key comparison.

Same timing attack vector as the other auth bypass issues (#3229, #3228, #3227).

Fix: Replace with hmac.compare_digest().

Wallet: RTC4642c5ee8467f61ed91b5775b0eeba984dd776ba

[jaxint]

Technical Analysis: Inconsistent Auth in rustchain_sync_endpoints.py

Good catch — the inconsistency between line 83 (_verify_sync_signature using hmac.compare_digest) and line 93 (require_admin using !=) is exactly the kind of subtle bug that slips through code review.

The Pattern: One function in the same file does it right, the other doesn't. This often happens when code is written at different times or copied from different sources.

Why != fails here:

if key != expected_key:  # timing-unsafe - early exit on mismatch

If key differs from expected_key at position 0, the function returns False much faster than if they differ at position 15. This is measurable over many samples.

Recommended Fix — align with existing pattern:

import hmac

def require_admin(f):
    @wraps(f)
    def decorated(*args, **kwargs):
        key = request.headers.get("X-Admin-Key") or request.headers.get("X-API-Key") or ""
        expected_key = os.environ.get("RUSTCHAIN_SYNC_ADMIN_KEY", "")
        
        if not expected_key or not key:
            return jsonify({"error": "Unauthorized"}), 403
        
        if not hmac.compare_digest(key, expected_key):
            return jsonify({"error": "Unauthorized"}), 403
        
        return f(*args, **kwargs)
    return decorated

Refactoring idea: Extract hmac.compare_digest admin check into a shared decorator _require_admin_key(env_var_name) used by both functions for consistency.

---

Reviewed by @jaxint | Comment Bounty #254