Keeper HMAC not bound to method/path and has no nonce (replay within the 5-minute window)

[0x-SquidSol]

Summary

The keeper request HMAC (app/lib/keeper-hmac.ts) signs only
HMAC-SHA256("<timestamp>.<rawBody>", secret). It does not bind the HTTP method
or path, carries no per-request nonce (a captured signature is replayable within
the 5-minute window), and the same KEEPER_REGISTER_SECRET is used to sign
outbound and verify inbound.

Affected code

// signed string — no method, no path, no nonce:
createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");
const MAX_SIGNATURE_AGE_MS = 5 * 60_000; // replay window; no nonce store

Hops that share this helper + secret:

From (sign)	To (verify)	Scope
markets/route.ts	oracle-keeper/register	internal (this repo)
oracle-keeper/register	external keeper service	cross-service
keeper service	markets/[slab] PATCH	cross-service

Impact

• Replay — a captured (timestamp, body, signature) is accepted repeatedly for
  up to 5 minutes (no nonce / one-time use).
• No method/path binding — a signature for one endpoint's body verifies at any
  endpoint that accepts the same body. /api/oracle-keeper/register and the
  markets/[slab] PATCH both consume a {slabAddress, mainnetCA}-shaped body, so
  a signature observed on one hop is a valid credential on the other within the
  window.
• One secret both directions — a signature observed inbound is reusable
  outbound and vice-versa.

Exploitability is bounded: KEEPER_INTERNAL_URL is validated https/loopback, so
signatures travel encrypted and capture is required. This is a signature-hygiene
weakness to harden for v2, not a wide-open hole.

Proof of concept

Uses the real signKeeperRequest / verifyKeeperSignature:

import { signKeeperRequest, verifyKeeperSignature } from "@/lib/keeper-hmac";
const s = "secret";
const body = JSON.stringify({ slabAddress: "SLAB", mainnetCA: "CA" });
const { timestamp, signature } = signKeeperRequest(s, body);

verifyKeeperSignature(s, timestamp, body, signature); // true
verifyKeeperSignature(s, timestamp, body, signature); // true again — replay, no nonce
// same (timestamp, body, signature) is valid at ANY endpoint receiving this body

// controls (these hold):
const tampered = JSON.stringify({ slabAddress: "SLAB", mainnetCA: "ATTACKER" });
verifyKeeperSignature(s, timestamp, tampered, signature);       // false — body IS bound
verifyKeeperSignature(s, String(Date.now() - 6*60_000), body, "…"); // false — window works

Run:

cd app && npx vitest run __tests__/api/keeper-hmac-binding.test.ts

Suggested fix (coordinated with the keeper service)

Bind method + path + a per-request nonce into the signed string, e.g.

HMAC("<method>\n<path>\n<timestamp>\n<nonce>\n<rawBody>", secret)

and reject already-seen nonces via a short-TTL store on the verify side.
Optionally use distinct secrets per direction (inbound-verify vs outbound-sign).

Because lib/keeper-hmac.ts is shared by hops that cross to the external,
maintainer-run keeper service (percolator-oracle-keeper), the format change must
land in lockstep across the app and that service. No fix PR is attached so the
rollout can be coordinated — e.g. accept both the old and new formats during a
transition window, then drop the old one (the same dual-accept approach used for
other auth-format migrations).

[dcccrypto]

Half addressed — the replay window is bounded, but the method/path binding you name in the title is still absent. Keeping open.

app/lib/keeper-hmac.ts now exists (LAUNCH-16) and fixes the credential exposure:

Replaces plaintext KEEPER_REGISTER_SECRET forwarding (a raw shared-secret header) with HMAC-SHA256("<timestamp>.<rawBody>", secret) — the credential itself never appears on the wire, only a signature derived from it.

Replay: bounded, not eliminated.

:13  const MAX_SIGNATURE_AGE_MS = 5 * 60_000;
:36  if (!Number.isFinite(ts) || Math.abs(Date.now() - ts) > MAX_SIGNATURE_AGE_MS) return false;

So a captured signature is replayable for up to 5 minutes. There is no nonce and no replay cache, so within that window the same (timestamp, body, signature) triple verifies repeatedly. The timestamp check is two-sided (Math.abs), which correctly also rejects a future-dated signature.

Method/path: still not bound. The signed string is exactly `${timestamp}.${rawBody}` (:20, :38). Neither the HTTP method nor the route is included, so a signature captured for one endpoint verifies on any other endpoint that shares KEEPER_REGISTER_SECRET and accepts the same body shape — which is precisely the cross-route replay this issue is about. The file itself notes the secret is used by "every call site that authenticates to the keeper service", so more than one route shares it.

The fix is mechanical but not unilateral: changing the signed string to `${method}.${path}.${timestamp}.${rawBody}` is a wire-format change that both the signer and every verifier must adopt in the same deploy, or every request fails. That coordination is the decision — the cryptography is not in question.

Timing-safe comparison (:39-40) is already correct.

[dcccrypto]

Method and path are now bound — merged in PR #2534. Closing, with the nonce half stated as still open by design.

The signed string is now [timestamp, METHOD, path, rawBody].join("\n"). Your framing was exact:

It does not bind the HTTP method or path, carries no per-request nonce, and the same KEEPER_REGISTER_SECRET is used to sign outbound and verify inbound.

The first of those is fixed. A test pins the consequence directly: a signature minted for /api/markets/<slab> no longer verifies at /api/oracle-keeper/register.

Newline-separated rather than dot-separated, deliberately — a dot can appear in a path, so "POST./a.b" would be ambiguous under the old delimiter. A newline cannot appear in a method or a URL path.

One endpoint is transitional, and I want that visible rather than buried

PATCH /api/markets/[slab] verifies signatures from a caller not in this repo — the keeper service has no createHmac at all. Making it strict could break a live hop I cannot inspect, so it accepts the legacy form and logs every acceptance, naming the endpoint it was not bound to.

That is explicitly not a fix for that hop: an unbound signature there is still valid anywhere the secret is shared. The log is there so the transition gets finished. The internal hop, where both ends are in this repo, is strict immediately.

The nonce is still open, deliberately

Your replay point stands and is not addressed: a captured signature is replayable against the same endpoint within MAX_SIGNATURE_AGE_MS. A nonce needs a store shared across serverless instances — the same constraint that shaped the keeper-register proof in #2505, where reintroducing a nonce would have traded a replay window for a correctness bug.

Worth tracking separately if you want it; it is a design problem, not a line change.

Your table of shared-secret hops led somewhere

Following it turned up a defect neither this issue nor #2233 states, now filed as #2533: the launch app sends HMAC headers to the keeper's /register, but that endpoint requires x-shared-secret, which the app never sends. Hot-registration 401s and fails silently behind "Keeper unreachable — market will auto-discover on next cycle".

LAUNCH-16 migrated the sender and never the receiver — which is also why #2233 is still accurate rather than stale.

Negative control: removing the binding fails 2 of the 9 tests in that file. Launch suite: 3138 passed / 16 skipped / 0 failed.