fix: wallet-based rate limiting prevents X-Forwarded-For spoofing (Bounty #2246)#1722
Closed
kuanglaodi2-sudo wants to merge 1 commit intoScottcjn:mainfrom
Closed
Conversation
…unty #2246) Bounty: Scottcjn/rustchain-bounties#2246 SECURITY FIX - Two-layer rate limiting defense: 1. PRIMARY: Wallet-based rate limiting - Prevents XFF spoofing bypass entirely - Attackers cannot rotate IPs without also rotating wallets 2. SECONDARY: IP-based rate limiting (retained) - Catches simple abusers Key changes: - get_client_ip(): Removed unconditional XFF trust; only trust XFF from explicitly configured trusted proxy IPs - can_drip_by_wallet(): NEW - primary rate limit check by wallet - can_drip_by_ip(): Renamed from can_drip() - secondary check - Dual rate limit checks in drip() endpoint Wallet: C4c7r9WPsnEe6CUfegMU9M7ReHD1pWg8qeSfTBoRcLbg
|
Welcome to RustChain! Thanks for your first pull request. Before we review, please make sure:
Bounty tiers: Micro (1-10 RTC) | Standard (20-50) | Major (75-100) | Critical (100-150) A maintainer will review your PR soon. Thanks for contributing! |
github-actions
bot
added
size/XL
Owner
This was referenced Mar 31, 2026
Contributor
Author
|
👋 Hi @Scottcjn — I'm checking in on the status of payouts for my closed PRs. Here's what I'm tracking as owed:
PR #1734 and #1885 are confirmed merged. Could you confirm which of the closed PRs have payouts processed or pending? Also — my wallet address is |
This was referenced Mar 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Fix: Faucet X-Forwarded-For Spoofing Bypass (Bounty #2246)
Vulnerability
The faucet (
faucet.py) trustedX-Forwarded-Forheader from any localhost connection. Attackers could bypass IP-based rate limits by setting arbitrary XFF values:Fix Applied: Two-Layer Rate Limiting
Layer 1 - PRIMARY: Wallet-based rate limiting
can_drip_by_wallet()checks wallet address, not IPLayer 2 - SECONDARY: IP-based rate limiting
can_drip_by_ip()retained as fallbackSecurity improvement in
get_client_ip():remote_addrdirectly in all other casesFiles Changed
faucet.py- Complete security fix (+261/-23 lines)Testing
rate_limit_typein error responsesPayout
C4c7r9WPsnEe6CUfegMU9M7ReHD1pWg8qeSfTBoRcLbg