fix(activation-service): remove unauthenticated /create-entity route (crash + wallet-drain)#1103
Merged
sameh-farouk merged 2 commits intoJun 2, 2026
Conversation
The POST /create-entity endpoint was an unauthenticated relayer that signed and submitted a fee-paying `createEntity` extrinsic from the service wallet on every request. It had two problems: - It was already broken on the current runtime: the client's entity lookups query renamed/removed storage (entitiesByNameID/entitiesByPubkeyID), so every call threw `is not a function`. The route has no .catch and the lookups run outside the controller's try/catch, so an unhandled rejection crashed the whole service — i.e. any single call is a DoS. - Even once the client is fixed, every call makes the service sign and submit an extrinsic whose fee is paid by the funding wallet (charged even on failure), so spamming it drains the wallet — an unauthenticated financial DoS. It serves no current flow: the UI calls only /activate, there is no in-repo caller, it is not in the service spec, and entities are a legacy concept. Remove the route (and its now-unused import) rather than fix it, to eliminate the crash and wallet-drain attack surface. The createEntity controller fn and create-entity schema are now orphaned and can be removed in a follow-up. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Follow-up to removing the /create-entity route: delete the now-unreferenced code it was the only user of. - controllers/substrate.js: remove the createEntity function, drop it from exports, and remove the now-unused `first` (lodash) and `SUBSTRATE_ERRORS` imports. `httpError` and `client` are kept (still used by activate). - lib/schemas/create-entity.js: deleted (no longer validated against). - lib/errors.js: deleted (SUBSTRATE_ERRORS was only used by createEntity). Verified: controller exports only `activate`, routes load, `standard` lint clean, no dangling references. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes the
POST /activation/create-entityroute and its now-unused import.Why
The endpoint is an unauthenticated relayer that signs and submits a fee-paying
createEntityextrinsic from the service's funded wallet on every request. Two issues:getEntityIDByName/getEntityIDByPubkeyquery renamed/removed storage (entitiesByNameID/entitiesByPubkeyID) and throwis not a function. The route has no.catch(next)and the lookups run outside the controller's try/catch, so the unhandled rejection crashes the whole service. Reproduced live: a single request → process exit. So with the currently-deployed client this endpoint is 100% broken and crash-on-call.paysFee: "Yes"). Unauthenticated, no rate limit → spamming it drains the activation wallet.Why remove, not fix
/activate, there is no in-repo caller, it's not inspec.md, and entities are a legacy concept. Untouched since 2023 (feat: move activation service here #652).Change
router.post('/create-entity', …)block and droppedcreateEntityfrom the controller import. Added a comment explaining the removal./activateintact,standardlint clean.Notes
createEntitycontroller fn (+ its now-unusedfirst/SUBSTRATE_ERRORSimports),lib/schemas/create-entity.js, andlib/errors.js(onlycreateEntityused it). Verified: controller exports onlyactivate, routes load,standardlint clean./activateis also a wallet-spending endpoint; worth confirming KYC-signature enforcement is actually wired (the spec requires it; the controller I read just checks balance + transfers).🤖 Generated with Claude Code