Skip to content

fix: prevent sparse-entropy overlap bypass in collision checks#397

Merged
Scottcjn merged 1 commit intoScottcjn:mainfrom
createkr:fix/issue-396-entropy-sparse-bypass
Feb 26, 2026
Merged

fix: prevent sparse-entropy overlap bypass in collision checks#397
Scottcjn merged 1 commit intoScottcjn:mainfrom
createkr:fix/issue-396-entropy-sparse-bypass

Conversation

@createkr
Copy link
Contributor

Summary

Hardens and profile comparison to prevent sparse-entropy payloads from weakening collision decisions.

Changes

  • add shared core entropy field list + helper counters
  • compare fields only when both stored/current values are non-zero (true comparable overlap)
  • require minimum comparable overlap () before collision matching
  • treat zero-overlap comparison as low-confidence ()
  • add regression tests for sparse-overlap bypass pattern and overlap-quality behavior

Validation

  • manual sanity script with temp DB verifies sparse-overlap payload does not trigger weak collision decisions

Fixes #396

@github-actions github-actions bot added BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related tests Test suite changes size/M PR: 51-200 lines labels Feb 26, 2026
@Scottcjn Scottcjn merged commit 7fc212d into Scottcjn:main Feb 26, 2026
6 checks passed
@Scottcjn
Copy link
Owner

Merged. Good security fix - the sparse entropy bypass was a real vulnerability. Note: the original bug was reported by @yw13931835525-cyber in issue #383.

@Scottcjn
Copy link
Owner

Payment confirmed — 15 RTC sent to wallet RTC1d48...2f35 for sparse-entropy overlap security fix. Good catch on the attack vector.

Batched with PR #394 (5 RTC) and PR #389 (5 RTC) = 25 RTC total. Pending ID: 430, confirms in 24h.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

BCOS-L1 Beacon Certified Open Source tier BCOS-L1 (required for non-doc PRs) node Node server related size/M PR: 51-200 lines tests Test suite changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[SECURITY] Entropy collision bypass in hardware_binding_v2.py (sparse entropy evasion)

2 participants