security(wallet): refuse signed transfers to unregistered bcn_ destinations (follow-up to #8357) - #8358
Merged
Conversation
…ations Follow-up to #8357 (Blake Prins, rustchain-bounties#398 Step 3). #8357 stops a squatter from claiming a pre-funded noncanonical bcn_ id at /beacon/join; this closes the other side so such orphan balances stop being created: /wallet/transfer/signed now returns 400 unregistered_bcn_destination when to_address is a bcn_ id with no Beacon Atlas row. Operator migrations keep using the admin /wallet/transfer path. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014RDgENXHE8sjiekfdvw3jn Signed-off-by: Scott <scottbphone12@gmail.com>
github-actions
Bot
added
BCOS-L1
Contributor
|
| Metric | Value |
|---|---|
| Trust Score | 43/100 |
| Certificate ID | BCOS-3d1f942e |
| Tier | L1 (not met) |
What does this mean?
The BCOS (Beacon Certified Open Source) engine scans for:
- SPDX license header compliance
- Known CVE vulnerabilities (OSV database)
- Static analysis findings (Semgrep)
- SBOM completeness
- Dependency freshness
- Test infrastructure evidence
- Review attestation tier
BCOS v2 Engine - Free & Open Source (MIT) - Elyan Labs
Scottcjn
deleted the
fix/signed-transfer-unregistered-bcn-destination
branch
September 6, 2026 02:06
Contributor
RTC RewardThis merged PR earned 5 RTC — sent to |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second half of the fix for @prins1bap-ui's #398 Step 3 finding. #8357 stopped a squatter from claiming a pre-funded noncanonical
bcn_id at/beacon/join; this stops the orphan balances from being created in the first place./wallet/transfer/signednow returns400 unregistered_bcn_destinationwhento_addressis abcn_id thatresolve_bcn_wallet()cannot find. Placed right after the sender review gate, before any state mutation. Operator migrations continue to use the admin/wallet/transferpath.test_wallet_transfer_signed_no_pubkey_disclosure.py+test_beacon_api_join.py: 12 pass.🤖 Generated with Claude Code
https://claude.ai/code/session_014RDgENXHE8sjiekfdvw3jn