Skip to content

Fix 2FA security and configure expired-swap penalty - #1278

Merged
fejilaup-cloud merged 5 commits into
AtomicIP:mainfrom
abduldayantech:fix/2fa-and-expired-swap-penalty
Oct 21, 2026
Merged

fejilaup-cloud merged 5 commits into
AtomicIP:mainfrom
abduldayantech:fix/2fa-and-expired-swap-penalty

Conversation

@abduldayantech

@abduldayantech abduldayantech commented Oct 17, 2026 •

Copy link
Copy Markdown
Contributor

Closes #1180
Closes #1181
Closes #1182
Closes #1183

Summary

  • Require JWT authentication for all 2FA endpoints and bind each request to the authenticated user.
  • Prevent replacing an existing 2FA configuration during enrollment.
  • Replace placeholder TOTP acceptance with RFC 6238 HMAC-SHA1 verification, a ±1 time-step window, and atomic replay protection.
  • Make the expired-swap seller reputation penalty admin-configurable (0–100), defaulting to 10.

Validation

  • git diff --check passed.
  • Confirmed the RFC 6238 SHA-1 test vector (287082 at Unix time 59).
  • Rust tests/build not run: cargo is unavailable in the environment.

Commits

  • e8d8ac9 fix(api): authenticate 2FA endpoints
  • 08e86cd fix(api): prevent 2FA secret replacement
  • fd83a3b feat(contract): configure expired swap penalty
  • c3db46f fix(api): implement replay-safe TOTP verification

abduldayantech and others added 4 commits October 17, 2026 08:45
Bind 2FA operations to the JWT-authenticated user and require access tokens for enable, verify, and backup-code routes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Reject a second 2FA enrollment rather than replacing a user's existing secret and backup codes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add an admin-controlled seller reputation penalty for expired swaps, with a default of 10 points and validation between 0 and 100.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Verify six-digit codes with HMAC-SHA1 and a ±1-step RFC 6238 window, then atomically record accepted steps to prevent replay.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@drips-wave

drips-wave Bot commented Oct 17, 2026

Copy link
Copy Markdown

@abduldayantech Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@fejilaup-cloud
fejilaup-cloud merged commit e62ed0e into AtomicIP:main Oct 21, 2026
0 of 4 checks passed
gabrielujelistic-collab pushed a commit to Stellar-drive/stellar-drive-atomic-ip that referenced this pull request Nov 9, 2026
…red-swap-penalty

Fix 2FA security and configure expired-swap penalty
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants