fix(security): close bridge auth bypass, verify real SEP-10 signers, reserve RBAC keys

[N-thnI]

Summary

Three critical findings from an org-wide source review. All verified by test.

1. The shipped bridge ran the WebSocket feed with authentication disabled

engine-bridge/src/main.ts constructed new ZkStateSyncer(propagator, { port }) — no auth, no serverSigningKey. Both are optional, so:

• verifyClient is spread in conditionally (...(options.auth && { verifyClient })) and was omitted entirely — the server accepted any connection on port 8080 and RelayerAuth never ran.
• The broadcast guard if (this.options.serverSigningKey && !state.authenticatedAs) continue short-circuited on the missing key, so every connected socket received all ZK state commitments.

The whole RelayerAuth/SEP-10 layer was unreachable in the only production entrypoint. Worth noting this also means #202 (timing-safe comparison inside RelayerAuth) describes code that never executed.

Fix: main.ts wires auth from the environment, and ZkStateSyncer now fails closed — it throws unless auth, serverSigningKey, or an explicit allowUnauthenticated: true is supplied, warning loudly in that last case.

2. SEP-10 verification ignored the account's real signer configuration

wallet-connector.ts called verifyChallengeTxThreshold with a fabricated signer set — [{ key: clientAccountID, weight: 1 }] and threshold: 1 — where clientAccountID was read out of the submitted XDR itself. The account was never fetched.

So a master key revoked to weight 0 (the standard move after a key compromise) still authenticated, and any single signer satisfied a multi-sig account regardless of its real med_threshold. These are the treasury and governance accounts — precisely the ones expected to be multi-sig.

Fix: verifyResponse is now async and takes an AccountLoader, using the account's actual signers and med_threshold. It fails closed when the account can't be loaded rather than falling back to the master-key assumption. horizonAccountLoader() provides the real implementation; the interface keeps it mockable.

3. update_param could permanently brick RBAC

RESERVED_KEYS omitted the storage slots owned by core::access. Writing C_ADMIN replaces an Address with a u64; every later require_role then fails host conversion, and access::initialize refuses to re-run because C_INIT is still set — no recovery path. Added C_INIT, C_ADMIN, C_OPERS, C_AUDIT, and the proxy GAP slot.

Tests

engine-bridge: 93 passed. engine-core: 95 passed. New regression tests cover the startup guard, revoked-weight rejection, below-threshold multi-sig rejection, loader failure, and each reserved RBAC key.

Two existing tests asserted the old insecure defaults and were updated to opt in explicitly — worth a look during review, since that's a behaviour change contributors may hit.

New environment variables

RELAYER_API_KEYS, RELAYER_JWT_SECRET, SERVER_SIGNING_KEY, HORIZON_URL, NETWORK_PASSPHRASE, AUTH_DOMAIN, and ALLOW_UNAUTHENTICATED_SYNCER. A deployment supplying none of these will now fail to start rather than running open — that's intentional, but it does mean the bridge needs configuring before the next deploy.

[N-i-xx]

Reviewed: bridge auth wiring, SEP-10 signer verification, and RBAC key reservation. All checks green.