Security: install.sh downloads and executes remote code without verification

[smallshao]

Bug Report: Potential Security Issue in install.sh Script

Bug Title

install.sh script downloads and executes remote Python script without proper verification

Severity Tier

Medium (10 RTC) - Security issue that could lead to arbitrary code execution

Bug Description

The install.sh script downloads and executes a Python miner script from a remote URL without:

1. Verifying the script's integrity (checksum/hash verification)
2. Using HTTPS for the download (some URLs use HTTP)
3. Providing a way to verify the authenticity of the downloaded script

Steps to Reproduce

1. Examine the install.sh script in the RustChain repository

2. Look at lines that download and execute remote code:

   MINER_URL="https://raw.githubusercontent.com/Scottcjn/Rustchain/main/miners/rustchain_universal_miner.py"
   FINGERPRINT_URL="https://raw.githubusercontent.com/Scottcjn/Rustchain/main/miners/fingerprint_checks.py"
   NODE_URL="https://50.28.86.131"
   
   # Later in the script:
   curl -fsSL "$MINER_URL" -o "$INSTALL_DIR/rustchain_universal_miner.py"
   python3 "$INSTALL_DIR/rustchain_universal_miner.py" --wallet "$WALLET" --node "$NODE_URL" &

3. Notice that:

   • The script is downloaded via curl -fsSL (follow redirects, silent, location)
   • No hash/checksum verification is performed
   • The script is immediately executed with python3
   • User's wallet information is passed to the downloaded script

Expected Behavior

1. The installer should verify the integrity of downloaded scripts using checksums or cryptographic signatures
2. All downloads should use HTTPS
3. Users should be able to verify the authenticity of the scripts before execution
4. Consider using package managers or signed releases for distribution

Actual Behavior

1. Scripts are downloaded without verification
2. Downloaded scripts are executed immediately with user credentials
3. No mechanism for users to verify what they're running

Security Implications

1. MITM Attacks: If the GitHub raw content is compromised or intercepted, attackers could inject malicious code
2. Supply Chain Attack: If the repository is compromised, all users running the installer would be affected
3. Credential Theft: The miner script receives wallet information which could be exfiltrated by malicious code

Screenshot/Evidence

# Relevant code from install.sh (lines 25-30 and 150-160):
MINER_URL="https://raw.githubusercontent.com/Scottcjn/Rustchain/main/miners/rustchain_universal_miner.py"
# ...
curl -fsSL "$MINER_URL" -o "$INSTALL_DIR/rustchain_universal_miner.py"
python3 "$INSTALL_DIR/rustchain_universal_miner.py" --wallet "$WALLET" --node "$NODE_URL" &

Suggested Fix

1. Add checksum verification:

   # Add expected SHA256 hashes
   MINER_HASH="expected_sha256_hash_here"
   FINGERPRINT_HASH="expected_sha256_hash_here"
   
   # Verify after download
   downloaded_hash=$(sha256sum "$INSTALL_DIR/rustchain_universal_miner.py" | cut -d' ' -f1)
   if [ "$downloaded_hash" != "$MINER_HASH" ]; then
       echo "ERROR: Hash verification failed!"
       exit 1
   fi

2. Use signed releases from GitHub Releases instead of raw.githubusercontent.com

3. Provide verification instructions in the documentation

4. Consider using package managers like pip, brew, or apt for distribution

Impact

• All users who install RustChain miner using the install.sh script are potentially affected
• The issue affects the trust and security of the installation process
• Could lead to loss of funds if wallet information is compromised

Reproduction Environment

• OS: macOS (but affects all platforms)
• Script Version: Latest from main branch
• Date: 2026-03-31

Additional Notes

This bug was found during a security review of the installation process. While the current maintainers may be trustworthy, the installation pattern sets a dangerous precedent and could be exploited if any part of the delivery chain is compromised.

The fix is relatively simple to implement and would significantly improve the security posture of the RustChain installation process.

[github-actions]

Welcome to RustChain! Thanks for opening your first issue.

New here? Check out these resources:

• CONTRIBUTING.md — how to earn RTC bounties
• Good First Issues — easy starter tasks (5-10 RTC)
• Bounty Board — all open bounties

Earn RTC tokens by contributing code, docs, or security fixes. Every merged PR gets paid!

1 RTC = $0.10 USD | pip install clawrtc to start mining

[Scottcjn]

Valid observation. The install script downloads and runs remote code without SHA-256 verification — standard curl | bash pattern risk. Adding a checksum file and verification step would harden this.

Note: PR #2034 attempted to fix this but had its own issues and was closed. The underlying concern is real.

Payment: 5 RTC

Please share your RTC wallet address.

[Dlove123]

🎯 Claiming This Bounty

I will fix the install.sh security issues:

1. Add checksum/hash verification for downloaded scripts
2. Enforce HTTPS for all downloads
3. Add signature verification option

ETA: <1 hour

---

💰 Payment Information

PayPal: 979749654@qq.com
ETH (Ethereum): 0x31e323edC293B940695ff04aD1AFdb56d473351D
GitHub: Dlove123

---

Starting work now! 🚀