Security ports

[p0mvn]

• fix(sync): validate discovery hash responses #151
• fix(inbound): retry duplicate block advertisers #152

[v12-auditor]

Note

Complete: Audit complete. V12 found two issues worth reviewing.

Open the full results here.

Finding	Severity	Details
F-98794	🟡 Medium	Unbounded duplicate block retry loop Remote peers reach the inbound downloader through AdvertiseBlock, and duplicate advertisements for an already queued hash now append alternate fallback sources. When the active attempt fails with any error that is not classified as consensus-invalid, poll_next removes the handle, releases the active source slot, respawns the same hash from the next fallback, and suppresses the current error. Local pre-verifier failures such as already present, missing coinbase height, and height too far ahead or behind are plain boxed string errors, so is_consensus_invalid_block_error treats them as retryable even though another peer cannot make the same block hash pass those deterministic checks. While the retry is active, a previously consumed advertiser is no longer the active source and is no longer in the fallback deque, so it can advertise the same hash again and be re-added. The eight-entry fallback cap and the global/per-source admission checks bound only simultaneous state, not lifetime attempts for one hash.
F-98795	🟡 Medium	Verifier errors skip peer penalties Inbound wires gossiped block verification through a SemanticBlockVerifier stack whose consensus failures are represented as RouterError. The download task propagates verifier commit failures as boxed errors together with the advertiser address. When Inbound::poll_ready drains failed gossiped downloads, it only downcasts the boxed error to VerifyBlockError before sending a misbehavior report. A boxed RouterError::Block does not downcast to VerifyBlockError, so the code takes the continue branch before calling misbehavior_sender.try_send. The changed downloader code itself recognizes RouterError::Block as consensus-invalid for fallback suppression, which confirms that these final failures are expected on this path but are not scored by the consumer.

Analyzed two files, diff 7afa5bb...e3922ad.