[W-6] Unauthenticated reachability-state poisoning — payout pause + recovery lock
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
Research direction
Start by checking whether the finding still reproduces on current main: find where MarkUnreachable is called on payment errors in merchant.go (around lines 303-305 and 495-500) and how consecutiveSuccesses is reset in mint_health_tracker.go (lines 162-171). Reproduce the payout pause and recovery lock with a test that sends a failing payment and then one probe failure. Done means either a confirmed repro with a fix that marks unreachable only on network-class errors and triggers the set-changed check, or a note that the issue no longer applies.
Written by the indexing model from the issue text.
Description
Migrated from Amperstrand/tollgate-module-basic-go#75 as part of the fork retirement — OpenTollGate/tollgate-module-basic-go is the single source of truth; the fork issue carries the original discussion and any lab evidence. Retirement plan: #758.]
LOW-MEDIUM: Reachability-state poisoning attack. MarkUnreachable is called on any payment error, causing the payout routine to pause (merchant.go:303-305) and resetting consecutiveSuccesses forever (mint_health_tracker.go:162-171). This locks recovery indefinitely when combined with one genuine probe failure.
One unauthenticated POST suffices (README config typically has exactly 1 accepted mint). The Phase-1 claim of "invalid tokens → all mints unreachable → degraded mode → payment outage ~15 min" was downgraded after PoC — the downgrade callback doesn't fire while the mint is healthy, but the payout pause and recovery lock are still exploitable.
Fix: Only mark unreachable on network-class errors; fire the set-changed check from MarkUnreachable.
Evidence: /home/ubuntu/src/tollgate_audit_report_2026-08-26.md §7, line 151
File references: merchant.go:495-500, mint_health_tracker.go:162-171
Migrated 2026-10-09. Applicability to current upstream main (4614ac2, post-rc1) was not re-verified during migration — confirming whether the finding still reproduces upstream is this issue's first task.
- Dominant language
- Go
- Stars
- 12
- Forks
- 14
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 239
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from OpenTollGate/tollgate-module-basic-go
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
OpenTollGate/tollgate-module-basic-go#833 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
OpenTollGate/tollgate-module-basic-go#813 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
OpenTollGate/tollgate-module-basic-go#804 ·
Maintainers usually reply within 1 day
-
go-battery needs an ndsctl on PATH: TestPurchaseSessionGuardHoldsThroughTheOutcomeUnknownWindow fails on bare hosts (passes with stub)Possibly taken @Amperstrand claimed this 1 day ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
OpenTollGate/tollgate-module-basic-go#726 · 2 comments ·
Maintainers usually reply within 1 day
-
rebrand-literal-gutter: uhttpd section-vocabulary check trips on a COMMENT (uhttpd.luci in 92-tollgate-admin-setup:178)Possibly taken @Amperstrand claimed this 1 day ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
OpenTollGate/tollgate-module-basic-go#723 ·
Maintainers usually reply within 1 day
All issues in OpenTollGate/tollgate-module-basic-go
Similar issues
-
documentation
Difficulty 1/5 Under an hour Newbie friendliness 85/100
gravitational/teleport#69869 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 73/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 63/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100