Bug: OTC bridge allows order cancellation by anyone who knows wallet address

[508704820]

Bug: OTC bridge cancel/match endpoints lack cryptographic authentication

Severity: HIGH

Description

The OTC bridge API endpoints for order matching and cancellation verify identity by wallet address only, without any cryptographic proof of ownership:

# cancel_order: Only checks if wallet matches
if order["maker_wallet"] != wallet:
    return jsonify({"error": "Only the order creator can cancel"}), 403

Impact

1. Unauthorized cancellation: Wallet addresses are public (visible in order book). Anyone who knows a maker's wallet address can cancel their orders.
2. Unauthorized matching: Anyone can match orders as a taker by providing any wallet address.
3. Order manipulation: Attackers can cancel competitors' orders to manipulate the order book.
4. Wallet validation is minimal: Only requires len(wallet) > 3 — accepts almost any string.

Suggested Fix

1. Ed25519 signature verification — require a signed message proving wallet ownership
2. Session-based auth — require login before trading
3. Stricter wallet validation — verify RTC or 0x format, not just length > 3
4. Order authentication — orders should be bound to a public key, not just a wallet string

Wallet: RTC9d7caca3039130d3b26d41f7343d8f4ef4592360

[saim256]

Submitted a focused fix in PR #4960:

#4960

What changed:

• match and cancel now require action-scoped wallet_auth signed by the Ed25519 key for the native RTC wallet.
• The bridge derives the RTC wallet from the submitted public key and rejects mismatched wallet/public-key pairs before mutating order state.
• Signatures bind {action, order_id, wallet, timestamp} and use a five-minute replay window.
• Added regressions for unsigned cancel, wrong-key cancel, signed cancel, and signed match.

Validation:

• python -m pytest tests\test_otc_bridge_wallet_auth.py -q -> 4 passed
• python -m py_compile otc-bridge\otc_bridge.py tests\test_otc_bridge_wallet_auth.py -> passed
• python -m ruff check otc-bridge\otc_bridge.py tests\test_otc_bridge_wallet_auth.py --select E9,F821,F811,F841 --output-format=concise -> passed
• git diff --check origin/main...HEAD -> passed
• python tools\bcos_spdx_check.py --base-ref origin/main -> OK

No production bridge, live wallet, or live order book was tested.

Bounty wallet if eligible: RTC253255d034065a839cd421811ec589ae5b694ffc

[kekehanshujun]

Submitted fix PR: https://github.com/Scottcjn/Rustchain/pull/5563\n\nThis requires signed wallet actions for match/cancel and binds match signatures to the submitted eth_address to avoid settlement-address substitution.\n\nRTC wallet: RTC02811ff5e2bb4bb4b95eee44c5429cd9525496e7