[Bug] sophia_governor_review_service.py: Admin auth uses == instead of hmac.compare_digest — timing attack

[haoyousun60-create]

Security Audit Finding

Severity: Medium
File: node/sophia_governor_review_service.py:142-145
Issue: The admin authentication check uses == for key comparison instead of hmac.compare_digest.

Code:

required_admin = os.getenv("RC_ADMIN_KEY", "").strip()
if required_admin:
    provided_admin = (req.headers.get("X-Admin-Key") or req.headers.get("X-API-Key") or "").strip()
    if provided_admin == required_admin:  # Timing-unsafe!

Impact:

• Timing attack on RC_ADMIN_KEY
• Attacker can access Sophia governor review endpoints
• Can approve/reject governance reviews

Fix:

if provided_admin and hmac.compare_digest(provided_admin, required_admin):

Note: This is the 6th file with the same pattern. A project-wide audit for == comparisons on secrets is recommended.

Wallet: RTC4642c5ee8467f61ed91b5775b0eeba984dd776ba

[haoyousun60-create]

Self-Audit Confirmation

I verified the timing-unsafe admin authentication in sophia_governor_review_service.py. The admin auth uses Python == operator for key comparison, which is vulnerable to timing attacks.

Problem: Python's == for strings does short-circuit comparison — it returns False as soon as it finds a mismatched character. An attacker can measure response times to progressively guess the admin key character by character.

Fix: Use hmac.compare_digest() for constant-time comparison.

Wallet: RTC4642c5ee8467f61ed91b5775b0eeba984dd776ba