[CRITICAL] Auth bypass — SEP-10 signature verification missing #24

Activity

1. DeFiVC

   added

   bugSomething isn't workingSomething isn't working

   securitySecurity concernSecurity concern

   critical

   on Jun 20, 2026
2. grantfox-oss

   added

   GrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSS

   Maybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox reward

   Official CampaignCampaign: Official CampaignCampaign: Official Campaign

   on Jun 20, 2026
3. AbelOsaretin commented on Jun 20, 2026

   

   AbelOsaretin

   on Jun 20, 2026 – with GrantFox OSS

   Contributor

   More actions

   I'd like to work on this issue.
   The verifyChallenge method in src/modules/auth/auth.service.ts:78 uses a plain string comparison (signedChallenge !== stored.challengeToken) instead of proper cryptographic verification. This means any client that simply echoes back the challenge token string bypasses authentication entirely — no Stellar private key required. This is a complete authentication bypass that allows attackers to impersonate any user on the platform.
   My approach
   Replace the naive string comparison with proper SEP-10 signature verification using the Stellar SDK's built-in helpers. The fix will decode the transaction envelope, verify the cryptographic signature against the claimed public key, validate time bounds to prevent replay attacks, and confirm the source account matches the authenticated user.
   Implementation plan

   1. Import Stellar SDK verification utilities
      • Add Transaction and TransactionBuilder imports from stellar-sdk
      • Add Keypair import for public key verification
      • Add time-bound checking utilities (e.g., DateTime from luxon if already in deps, or native Date)
   2. Replace string comparison in verifyChallenge at line 78
      • Decode the signed challenge using Transaction.fromEnvelopeXDR() instead of comparing raw strings
      • Extract the signature from the decoded transaction using tx.signatures
      • Verify the signature matches the user's stored public key using Keypair.fromPublicKey(publicKey).verify(tx.hash(), signature)
      • Remove the signedChallenge !== stored.challengeToken comparison entirely
   3. Add time-bound validation
      • After decoding the transaction envelope, check tx.timeBounds.minTime and tx.timeBounds.maxTime
      • Reject challenges where now < minTime or now > maxTime to prevent stale/replay attacks
      • Use a reasonable expiration window (e.g., 5 minutes) matching SEP-10 best practices
   4. Verify source account matches
      • Confirm tx.source matches stored.publicKey (or the user's Stellar address from the database)
      • This prevents an attacker from using a legitimately signed SEP-10 challenge issued for a different account
   5. Update tests for the new verification logic
      • Add test cases for valid SEP-10 signed challenges (should pass authentication)
      • Add test cases for expired challenges (should be rejected)
      • Add test cases for challenges signed by a different key (should be rejected)
      • Add test cases for malformed/invalid XDR envelopes (should be rejected gracefully)
        Impact

   • Eliminates a complete authentication bypass that allows impersonation of any user without their private key.
   • Aligns the auth flow with the SEP-10 specification, the industry-standard authentication protocol for Stellar-based applications.
   • Prevents replay attacks through time-bound validation, ensuring stale challenges cannot be reused.
   • Establishes proper cryptographic verification as a foundation for all future auth-related features.
     I'm ready to start immediately and can have a PR up within a reasonable timeline. Happy to adjust the plan if you have preferences on any of the details.
4. grantfox-oss

   assigned

   AbelOsaretin

   on Jun 20, 2026
5. grantfox-oss commented on Jun 20, 2026

   

   grantfox-ossBot

   on Jun 20, 2026 – with GrantFox OSS

   More actions

   🦊 GrantFox — @AbelOsaretin has been assigned to this issue as part of the Official Campaign campaign!

   Next steps:

   1. Open a Pull Request referencing this issue (e.g., Closes #24)
   2. Your PR will be reviewed by the ChainLearnOfficial maintainers

   Good luck! Track your progress on GrantFox.
6. grantfox-oss commented on Jun 20, 2026

   

   grantfox-ossBot

   on Jun 20, 2026 – with GrantFox OSS

   More actions

   🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!

   @AbelOsaretin's PR #39 was approved and merged by @DeFiVC.

   🏆 @AbelOsaretin: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (223 total points). Track your full progress on GrantFox.

   👏 Great work, @AbelOsaretin! Keep contributing to ChainLearnOfficial.
7. DeFiVC

   closed this as completedin #39on Jun 20, 2026