627 lines
17 KiB
Markdown
627 lines
17 KiB
Markdown
# Code Review Findings - XMRig Proxy Enterprise Audit
|
|
|
|
**Generated:** 2025-12-31
|
|
**Reviewed by:** 8 Parallel Opus Code Reviewers
|
|
**Target:** XMRig-based C++ Stratum Proxy (347 source files)
|
|
|
|
---
|
|
|
|
## Summary
|
|
|
|
| Domain | Critical | High | Medium | Total |
|
|
|--------|----------|------|--------|-------|
|
|
| Entry Point & App Lifecycle | 2 | 2 | 2 | 6 |
|
|
| Core Controller & Config | 1 | 4 | 1 | 6 |
|
|
| Proxy Core (Server, Miner, Events) | 4 | 5 | 1 | 10 |
|
|
| Proxy TLS & Workers | 3 | 2 | 2 | 7 |
|
|
| Splitter System | 2 | 3 | 0 | 5 |
|
|
| Network & Stratum Client | 3 | 5 | 1 | 9 |
|
|
| HTTP/HTTPS & REST API | 1 | 3 | 3 | 7 |
|
|
| Base I/O & Kernel | 2 | 2 | 3 | 7 |
|
|
| **TOTAL** | **18** | **26** | **13** | **57** |
|
|
|
|
---
|
|
|
|
## Critical Issues
|
|
|
|
### CRIT-001: Double-Delete in Controller Destructor and stop()
|
|
- **File:** `src/core/Controller.cpp:45,73-74`
|
|
- **Domain:** Entry Point & App Lifecycle
|
|
- **Confidence:** 100%
|
|
|
|
`m_proxy` deleted in both destructor and `stop()` method. If `stop()` called before destructor, double-free causes crash/heap corruption.
|
|
|
|
**Fix:** Add null check in destructor or stop(), set to nullptr after delete.
|
|
|
|
---
|
|
|
|
### CRIT-002: UV Event Loop Closed Without Draining Handles
|
|
- **File:** `src/App.cpp:78-79`
|
|
- **Domain:** Entry Point & App Lifecycle
|
|
- **Confidence:** 95%
|
|
|
|
`uv_loop_close()` called immediately after `uv_run()` without ensuring handles closed. Returns UV_EBUSY (ignored), leaking resources.
|
|
|
|
**Fix:** Loop until `uv_loop_close()` succeeds, calling `uv_run(UV_RUN_ONCE)`.
|
|
|
|
---
|
|
|
|
### CRIT-003: Missing JSON Type Validation in BindHost Constructor
|
|
- **File:** `src/proxy/BindHost.cpp:67-72`
|
|
- **Domain:** Core Controller & Config
|
|
- **Confidence:** 95%
|
|
|
|
Direct `GetString()`, `GetUint()`, `GetBool()` calls without checking field existence/type. Crashes on malformed config (DoS).
|
|
|
|
**Fix:** Add `HasMember()` and type checks before accessing JSON fields.
|
|
|
|
---
|
|
|
|
### CRIT-004: Race Condition in Events System - Non-Atomic Ready Flag
|
|
- **File:** `src/proxy/Events.cpp:37-56`
|
|
- **Domain:** Proxy Core
|
|
- **Confidence:** 95%
|
|
|
|
`m_ready` flag is bool, not atomic. Multiple threads can pass check simultaneously, causing event corruption.
|
|
|
|
**Fix:** Use `std::atomic<bool>` or mutex to protect event dispatch.
|
|
|
|
---
|
|
|
|
### CRIT-005: Memory Pool (MemPool) Not Thread-Safe
|
|
- **File:** `src/base/net/tools/MemPool.h:45-73`
|
|
- **Domain:** Proxy Core
|
|
- **Confidence:** 100%
|
|
|
|
`allocate()` and `deallocate()` modify shared STL containers without synchronization. Called from libuv callbacks (multi-threaded). Heap corruption guaranteed under load.
|
|
|
|
**Fix:** Add mutex to protect all MemPool operations.
|
|
|
|
---
|
|
|
|
### CRIT-006: Static Event Buffer Shared Across All Events
|
|
- **File:** `src/proxy/events/Event.h:52`
|
|
- **Domain:** Proxy Core
|
|
- **Confidence:** 90%
|
|
|
|
All events use single static 4KB buffer with placement new. Concurrent events corrupt each other's memory.
|
|
|
|
**Fix:** Use heap allocation for events or implement thread-safe event pool.
|
|
|
|
---
|
|
|
|
### CRIT-007: Storage Counter Overflow - ID Collision
|
|
- **File:** `src/base/net/tools/Storage.h:37-42,81`
|
|
- **Domain:** Proxy Core
|
|
- **Confidence:** 85%
|
|
|
|
`m_counter` increments without bounds check. After 2^32/2^64 connections, IDs wrap causing wrong miner deletion, use-after-free.
|
|
|
|
**Fix:** Add overflow detection and ID recycling mechanism.
|
|
|
|
---
|
|
|
|
### CRIT-008: Unchecked SSL_write Return Value
|
|
- **File:** `src/base/net/tls/ServerTls.cpp:65`
|
|
- **Domain:** TLS & Workers
|
|
- **Confidence:** 90%
|
|
|
|
`SSL_write()` return value ignored. Silent data loss, corrupted protocol messages.
|
|
|
|
**Fix:** Check return value, handle partial writes and errors.
|
|
|
|
---
|
|
|
|
### CRIT-009: TLS setCiphers() Returns True on Failure
|
|
- **File:** `src/base/net/tls/TlsContext.cpp:165-174`
|
|
- **Domain:** TLS & Workers
|
|
- **Confidence:** 100%
|
|
|
|
Copy-paste bug: function logs error but returns `true` on cipher config failure. Server runs with weak default ciphers.
|
|
|
|
**Fix:** Return `false` on line 173.
|
|
|
|
---
|
|
|
|
### CRIT-010: Unbounded Memory Growth in m_results Map
|
|
- **File:** `src/proxy/splitters/nicehash/NonceMapper.cpp:148,264-276`
|
|
- **Domain:** Splitter System
|
|
- **Confidence:** 95%
|
|
|
|
Submit contexts stored in map, only removed on pool response. Network issues = unbounded memory growth.
|
|
|
|
**Fix:** Add timestamp to SubmitCtx, cleanup stale entries in gc().
|
|
|
|
---
|
|
|
|
### CRIT-011: NonceSplitter gc() Vector Out-of-Bounds Access
|
|
- **File:** `src/proxy/splitters/nicehash/NonceSplitter.cpp:93-97`
|
|
- **Domain:** Splitter System
|
|
- **Confidence:** 90%
|
|
|
|
While loop calls `m_upstreams.back()` without empty check. If all mappers suspended, crashes on empty vector.
|
|
|
|
**Fix:** Add `!m_upstreams.empty()` to while condition.
|
|
|
|
---
|
|
|
|
### CRIT-012: Unchecked SSL_write/BIO_write in Stratum TLS
|
|
- **File:** `src/base/net/stratum/Tls.cpp:84-89,104-107`
|
|
- **Domain:** Network & Stratum
|
|
- **Confidence:** 95%
|
|
|
|
Return values ignored. Silent data loss, TLS state corruption.
|
|
|
|
**Fix:** Check return values, handle errors appropriately.
|
|
|
|
---
|
|
|
|
### CRIT-013: Missing TLS Certificate Verification
|
|
- **File:** `src/base/net/stratum/Tls.cpp:35-48`
|
|
- **Domain:** Network & Stratum
|
|
- **Confidence:** 100%
|
|
|
|
No `SSL_CTX_set_verify()` call. Certificates not validated unless fingerprint provided. Vulnerable to MITM attacks.
|
|
|
|
**Fix:** Add `SSL_CTX_set_verify(m_ctx, SSL_VERIFY_PEER, nullptr)`.
|
|
|
|
---
|
|
|
|
### CRIT-014: Timing Attack in API Token Authentication
|
|
- **File:** `src/base/api/Httpd.cpp:193-197`
|
|
- **Domain:** HTTP API
|
|
- **Confidence:** 100%
|
|
|
|
Uses `strncmp()` for token comparison. Attacker can extract token character-by-character via timing.
|
|
|
|
**Fix:** Use `CRYPTO_memcmp()` for constant-time comparison.
|
|
|
|
---
|
|
|
|
### CRIT-015: Race Condition in Signal Handler
|
|
- **File:** `src/base/io/Signals.cpp:61-88`
|
|
- **Domain:** Base I/O & Kernel
|
|
- **Confidence:** 95%
|
|
|
|
Signal handler calls `LOG_WARN()` which takes mutex, allocates memory. Not async-signal-safe. Deadlock or heap corruption.
|
|
|
|
**Fix:** Only forward signal to listener, log in main event loop context.
|
|
|
|
---
|
|
|
|
### CRIT-016: Potential Buffer Overflow in Log Formatting
|
|
- **File:** `src/base/io/log/Log.cpp:96-101`
|
|
- **Domain:** Base I/O & Kernel
|
|
- **Confidence:** 85%
|
|
|
|
Magic number `32` in buffer size calculation. Large timestamps + messages can underflow available size.
|
|
|
|
**Fix:** Add explicit bounds checking before vsnprintf.
|
|
|
|
---
|
|
|
|
### CRIT-017: Private Key File Written with Insecure Permissions
|
|
- **File:** `src/base/net/tls/TlsGen.cpp:128-134`
|
|
- **Domain:** TLS & Workers
|
|
- **Confidence:** 90%
|
|
|
|
Private key file created with default permissions (0644 = world-readable).
|
|
|
|
**Fix:** Add `chmod(m_certKey, 0600)` on Unix.
|
|
|
|
---
|
|
|
|
### CRIT-018: Missing NULL Check in BindHost JSON Constructor (Duplicate)
|
|
- **File:** `src/proxy/BindHost.cpp:67,71-72`
|
|
- **Domain:** TLS & Workers
|
|
- **Confidence:** 95%
|
|
|
|
Same as CRIT-003 - found by multiple reviewers, confirming severity.
|
|
|
|
---
|
|
|
|
## High Priority Issues
|
|
|
|
### HIGH-001: Missing uv_stop() in Shutdown Path
|
|
- **File:** `src/App.cpp:121-129`
|
|
- **Domain:** Entry Point
|
|
- **Confidence:** 85%
|
|
|
|
`close()` doesn't call `uv_stop()`. UV loop continues until handles naturally close. Delayed/hung shutdown.
|
|
|
|
---
|
|
|
|
### HIGH-002: Use-After-Free Risk in Signal/Console Callbacks
|
|
- **File:** `src/base/io/Signals.cpp:87`, `Console.cpp:74`
|
|
- **Domain:** Entry Point
|
|
- **Confidence:** 80%
|
|
|
|
`m_listener` accessed after `App::close()` resets handles. Race between close and pending events.
|
|
|
|
---
|
|
|
|
### HIGH-003: Integer Overflow in strtol Conversion
|
|
- **File:** `src/core/config/ConfigTransform.cpp:85`
|
|
- **Domain:** Config
|
|
- **Confidence:** 85%
|
|
|
|
`strtol()` cast to `uint64_t` without overflow/error checking. Negative values wrap, no error detection.
|
|
|
|
---
|
|
|
|
### HIGH-004: Port Number Parsing Without Bounds Check
|
|
- **File:** `src/proxy/BindHost.cpp:136,158`
|
|
- **Domain:** Config
|
|
- **Confidence:** 90%
|
|
|
|
Port parsed via `strtol()`, cast to `uint16_t` without validating 0-65535 range.
|
|
|
|
---
|
|
|
|
### HIGH-005: Double-Delete Risk in Controller (Config Review)
|
|
- **File:** `src/core/Controller.cpp:43-46,69-75`
|
|
- **Domain:** Config
|
|
- **Confidence:** 85%
|
|
|
|
Same as CRIT-001, confirmed by second reviewer.
|
|
|
|
---
|
|
|
|
### HIGH-006: Missing Null Pointer Check in Controller Methods
|
|
- **File:** `src/core/Controller.cpp:65,78-99`
|
|
- **Domain:** Config
|
|
- **Confidence:** 90%
|
|
|
|
`proxy()` returns potentially null `m_proxy` without checks. Crashes if called before `init()`.
|
|
|
|
---
|
|
|
|
### HIGH-007: Unbounded Vector Growth in StatsData::latency
|
|
- **File:** `src/proxy/StatsData.h:96,138`
|
|
- **Domain:** Proxy Core
|
|
- **Confidence:** 100%
|
|
|
|
One entry per accepted share, forever. Memory exhaustion guaranteed.
|
|
|
|
---
|
|
|
|
### HIGH-008: NULL Dereference in Server::create() - Dead Code
|
|
- **File:** `src/proxy/Server.cpp:89-92`
|
|
- **Domain:** Proxy Core
|
|
- **Confidence:** 80%
|
|
|
|
`new` throws on failure, doesn't return NULL. Check is dead code, real failures unhandled.
|
|
|
|
---
|
|
|
|
### HIGH-009: Missing Validation in Miner::parseRequest()
|
|
- **File:** `src/proxy/Miner.cpp:354-355`
|
|
- **Domain:** Proxy Core
|
|
- **Confidence:** 85%
|
|
|
|
`doc["method"].GetString()` called without validating field exists. Crash on malformed client request.
|
|
|
|
---
|
|
|
|
### HIGH-010: Non-Atomic Counters in Counters Class
|
|
- **File:** `src/proxy/Counters.h:42-67`
|
|
- **Domain:** Proxy Core
|
|
- **Confidence:** 90%
|
|
|
|
Static counters modified from multiple threads without atomics. Statistics incorrect, potential corruption.
|
|
|
|
---
|
|
|
|
### HIGH-011: Use-After-Free in Miner Shutdown Path
|
|
- **File:** `src/proxy/Miner.cpp:547-577`
|
|
- **Domain:** Proxy Core
|
|
- **Confidence:** 85%
|
|
|
|
Complex callback chain. Miner can be accessed after removal from storage if shutdowns overlap.
|
|
|
|
---
|
|
|
|
### HIGH-012: Integer Overflow in ExtraNonce Allocation
|
|
- **File:** `src/proxy/splitters/extra_nonce/ExtraNonceStorage.cpp:37,99`
|
|
- **Domain:** Splitter
|
|
- **Confidence:** 90%
|
|
|
|
`m_extraNonce` increments forever, but only 32 bits used. Nonce collision after 4B connections.
|
|
|
|
---
|
|
|
|
### HIGH-013: Race Condition in NonceStorage::remove()
|
|
- **File:** `src/proxy/splitters/nicehash/NonceStorage.cpp:103-110,122-126`
|
|
- **Domain:** Splitter
|
|
- **Confidence:** 85%
|
|
|
|
Dead slots only cleared during setJob from same client. Different clients = slots never recycled.
|
|
|
|
---
|
|
|
|
### HIGH-014: Potential Use-After-Free in submitCtx()
|
|
- **File:** `src/proxy/splitters/nicehash/NonceMapper.cpp:264-278`
|
|
- **Domain:** Splitter
|
|
- **Confidence:** 85%
|
|
|
|
Miner lookup after context retrieval. Redundant map lookup, miner may have disconnected.
|
|
|
|
---
|
|
|
|
### HIGH-015: Timing Attack in Certificate Fingerprint
|
|
- **File:** `src/base/net/stratum/Tls.cpp:186`
|
|
- **Domain:** Network
|
|
- **Confidence:** 85%
|
|
|
|
`strncasecmp()` for fingerprint comparison. Timing attack vulnerability.
|
|
|
|
---
|
|
|
|
### HIGH-016: Buffer Overflow Risk in LineReader
|
|
- **File:** `src/base/net/tools/LineReader.cpp:57-71`
|
|
- **Domain:** Network
|
|
- **Confidence:** 85%
|
|
|
|
Silently drops oversized messages without error. Protocol desync, DoS vector.
|
|
|
|
---
|
|
|
|
### HIGH-017: Weak TLS Configuration - Missing Modern Options
|
|
- **File:** `src/base/net/stratum/Tls.cpp:47`
|
|
- **Domain:** Network
|
|
- **Confidence:** 80%
|
|
|
|
Only disables SSLv2/SSLv3. TLS 1.0/1.1 still allowed (deprecated, vulnerable).
|
|
|
|
---
|
|
|
|
### HIGH-018: SOCKS5 Protocol Validation Insufficient
|
|
- **File:** `src/base/net/stratum/Socks5.cpp:29-48`
|
|
- **Domain:** Network
|
|
- **Confidence:** 82%
|
|
|
|
Accesses `data[0]`, `data[1]` without buffer length check. Malicious SOCKS5 proxy can crash.
|
|
|
|
---
|
|
|
|
### HIGH-019: Race Condition in DNS Resolution
|
|
- **File:** `src/base/net/dns/DnsUvBackend.cpp:74-91`
|
|
- **Domain:** Network
|
|
- **Confidence:** 80%
|
|
|
|
Multiple resolution requests race on shared state. Inconsistent results possible.
|
|
|
|
---
|
|
|
|
### HIGH-020: No HTTP Request Body Size Limit
|
|
- **File:** `src/base/net/http/HttpContext.cpp:261`
|
|
- **Domain:** HTTP API
|
|
- **Confidence:** 95%
|
|
|
|
Body appended without limit. Memory exhaustion via large POST.
|
|
|
|
---
|
|
|
|
### HIGH-021: No HTTP Connection Limits
|
|
- **File:** `src/base/net/tools/TcpServer.cpp:71`
|
|
- **Domain:** HTTP API
|
|
- **Confidence:** 90%
|
|
|
|
Unlimited connections accepted. Connection exhaustion DoS.
|
|
|
|
---
|
|
|
|
### HIGH-022: No HTTP Request Timeout
|
|
- **File:** `src/base/net/http/HttpServer.cpp:43-59`
|
|
- **Domain:** HTTP API
|
|
- **Confidence:** 90%
|
|
|
|
No timeout on requests. Slowloris attack vector.
|
|
|
|
---
|
|
|
|
### HIGH-023: Memory Leak in BindHost Parsing
|
|
- **File:** `src/proxy/BindHost.cpp:108-112,132-135,154-157`
|
|
- **Domain:** TLS & Workers
|
|
- **Confidence:** 85%
|
|
|
|
Raw `new char[]` not freed if String copies instead of taking ownership.
|
|
|
|
---
|
|
|
|
### HIGH-024: File Descriptor Leak on Error Path
|
|
- **File:** `src/base/io/log/FileLogWriter.cpp:75-84`
|
|
- **Domain:** Base I/O
|
|
- **Confidence:** 90%
|
|
|
|
If `uv_fs_open` succeeds but check fails, fd leaked (set to -1 without close).
|
|
|
|
---
|
|
|
|
### HIGH-025: Race Condition in FileLogWriter Async Flush
|
|
- **File:** `src/base/io/log/FileLogWriter.cpp:138-152`
|
|
- **Domain:** Base I/O
|
|
- **Confidence:** 88%
|
|
|
|
`m_pos` updated before async write completes. Out-of-order writes corrupt log.
|
|
|
|
---
|
|
|
|
---
|
|
|
|
## Medium Priority Issues
|
|
|
|
### MED-001: Windows Background Mode Closes Invalid Handle
|
|
- **File:** `src/App_win.cpp:44-45`
|
|
- **Domain:** Entry Point
|
|
- **Confidence:** 90%
|
|
|
|
`CloseHandle()` on standard handle - should not be closed manually.
|
|
|
|
---
|
|
|
|
### MED-002: Resource Leaks on Early Return Paths
|
|
- **File:** `src/App.cpp:46-74`
|
|
- **Domain:** Entry Point
|
|
- **Confidence:** 85%
|
|
|
|
Multiple return paths leave UV handles partially initialized without cleanup.
|
|
|
|
---
|
|
|
|
### MED-003: Config Reload Race Condition
|
|
- **File:** `src/base/kernel/Base.cpp:254-279,296-313`
|
|
- **Domain:** Config
|
|
- **Confidence:** 80%
|
|
|
|
Config swapped without synchronization. Concurrent readers may access freed config.
|
|
|
|
---
|
|
|
|
### MED-004: Integer Overflow in Miner::setJob()
|
|
- **File:** `src/proxy/Miner.cpp:154`
|
|
- **Domain:** Proxy Core
|
|
- **Confidence:** 80%
|
|
|
|
Division by zero if `m_customDiff` is 0.
|
|
|
|
---
|
|
|
|
### MED-005: Buffer Overflow Risk in Workers Name Display
|
|
- **File:** `src/proxy/workers/Workers.cpp:96`
|
|
- **Domain:** TLS & Workers
|
|
- **Confidence:** 80%
|
|
|
|
Complex memcpy arithmetic for name truncation. Off-by-one potential.
|
|
|
|
---
|
|
|
|
### MED-006: Unbounded Memory in TickingCounter
|
|
- **File:** `src/proxy/TickingCounter.h:60,64`
|
|
- **Domain:** TLS & Workers
|
|
- **Confidence:** 85%
|
|
|
|
`m_data` vector grows unbounded with each tick().
|
|
|
|
---
|
|
|
|
### MED-007: Static Buffer in TLS Read - Thread Safety
|
|
- **File:** `src/base/net/stratum/Tls.cpp:130-135`
|
|
- **Domain:** Network
|
|
- **Confidence:** 85%
|
|
|
|
Static buffer shared across all TLS instances. Data corruption possible.
|
|
|
|
---
|
|
|
|
### MED-008: Overly Permissive CORS Configuration
|
|
- **File:** `src/base/net/http/HttpApiResponse.cpp:53-55`
|
|
- **Domain:** HTTP API
|
|
- **Confidence:** 85%
|
|
|
|
`Access-Control-Allow-Origin: *` allows any website to access API.
|
|
|
|
---
|
|
|
|
### MED-009: TLS 1.0/1.1 Support - Deprecated Protocols
|
|
- **File:** `src/base/net/tls/TlsContext.cpp:152,271-279`
|
|
- **Domain:** HTTP API
|
|
- **Confidence:** 85%
|
|
|
|
Deprecated TLS versions not disabled by default. Downgrade attacks possible.
|
|
|
|
---
|
|
|
|
### MED-010: Cipher Suite Error Ignored
|
|
- **File:** `src/base/net/tls/TlsContext.cpp:165-174`
|
|
- **Domain:** HTTP API
|
|
- **Confidence:** 82%
|
|
|
|
Same as CRIT-009, duplicate finding confirming severity.
|
|
|
|
---
|
|
|
|
### MED-011: Integer Overflow in Keccak
|
|
- **File:** `src/base/crypto/keccak.cpp:176,190-191`
|
|
- **Domain:** Base I/O
|
|
- **Confidence:** 82%
|
|
|
|
`rsiz` calculation can underflow with large `mdlen`.
|
|
|
|
---
|
|
|
|
### MED-012: Missing Null Check in Console
|
|
- **File:** `src/base/io/Console.cpp:33-40,74`
|
|
- **Domain:** Base I/O
|
|
- **Confidence:** 85%
|
|
|
|
`m_listener` not null-checked in callbacks.
|
|
|
|
---
|
|
|
|
### MED-013: TOCTOU in Watcher
|
|
- **File:** `src/base/io/Watcher.cpp:74-82`
|
|
- **Domain:** Base I/O
|
|
- **Confidence:** 80%
|
|
|
|
File can be replaced between callback and restart. Acceptable for config files.
|
|
|
|
---
|
|
|
|
## Recommended Priority Order
|
|
|
|
### Immediate (Security Critical)
|
|
1. CRIT-014: Timing attack in API authentication
|
|
2. CRIT-013: Missing TLS certificate verification
|
|
3. CRIT-001: Double-delete in Controller
|
|
4. CRIT-005: MemPool thread safety
|
|
5. CRIT-015: Signal handler race condition
|
|
|
|
### This Week (Data Integrity)
|
|
6. CRIT-004: Events system race condition
|
|
7. CRIT-006: Static event buffer corruption
|
|
8. CRIT-010: Unbounded m_results memory
|
|
9. HIGH-007: StatsData unbounded memory
|
|
10. HIGH-020: HTTP body size limit
|
|
|
|
### Next Sprint (Stability)
|
|
11. CRIT-002: UV loop cleanup
|
|
12. CRIT-011: gc() out-of-bounds access
|
|
13. CRIT-012: SSL_write return checking
|
|
14. HIGH-021: Connection limits
|
|
15. HIGH-022: Request timeouts
|
|
|
|
### Backlog (Quality)
|
|
- All Medium priority items
|
|
- Documentation updates
|
|
- Performance optimizations
|
|
|
|
---
|
|
|
|
## Review Completion Status
|
|
|
|
- [x] Entry Point & App Lifecycle - 6 issues found
|
|
- [x] Core Controller & Config - 6 issues found
|
|
- [x] Proxy Core (Server, Miner, Events) - 10 issues found
|
|
- [x] Proxy TLS & Workers - 7 issues found
|
|
- [x] Splitter System - 5 issues found
|
|
- [x] Network & Stratum Client - 9 issues found
|
|
- [x] HTTP/HTTPS & REST API - 7 issues found
|
|
- [x] Base I/O & Kernel - 7 issues found
|
|
|
|
**Total Issues Identified: 57**
|
|
|
|
---
|
|
|
|
## Files Requiring Immediate Attention
|
|
|
|
1. `src/core/Controller.cpp` - Double-delete, null checks
|
|
2. `src/base/api/Httpd.cpp` - Timing attack
|
|
3. `src/base/net/tls/TlsContext.cpp` - Cipher error, TLS config
|
|
4. `src/base/net/tools/MemPool.h` - Thread safety
|
|
5. `src/proxy/Events.cpp` - Race condition
|
|
6. `src/proxy/events/Event.h` - Static buffer
|
|
7. `src/base/io/Signals.cpp` - Async-signal-safety
|
|
8. `src/base/net/stratum/Tls.cpp` - SSL_write, cert verify
|
|
9. `src/proxy/splitters/nicehash/NonceSplitter.cpp` - Bounds check
|
|
10. `src/base/net/http/HttpContext.cpp` - Body size limit
|