security: API Auth & Rate Limiting Red Team — 1C/2H/3M/1L — Bounty #57

[LaphoqueRC]

API Auth Hardening — Bounty #57 (100 RTC)

Findings: 1 Critical, 2 High, 3 Medium, 1 Low

• C1: Zero authentication on governance + mining endpoints
• H1: No rate limiting + suppressed logs
• H2: Wildcard CORS enables cross-origin attacks
• M1: RPC endpoint exposes all internal methods
• M2: No input validation on dynamic routes
• M3: No body size limit (OOM DoS)
• L1: Exception details leaked to client

Deliverables

• security/api-auth/report.md — Full report
• security/api-auth/api_exploit_poc.py — 5 PoCs with local mock server

Closes #57
RTC Wallet: RTC2fe3c33c77666ff76a1cd0999fd4466ee81250ff

[github-actions]

Welcome to RustChain! Thanks for your first pull request.

Before we review, please make sure:

• Your PR has a BCOS-L1 or BCOS-L2 label
• New code files include an SPDX license header
• You've tested your changes against the live node

Bounty tiers: Micro (1-10 RTC) | Standard (20-50) | Major (75-100) | Critical (100-150)

A maintainer will review your PR soon. Thanks for contributing!