T05 · Unauthorized Access and Privilege Escalation
Error
- Location
bridge/app.py:110- Finding
Unauthenticated Task and Escrow-State Control
- Content
View full analysis
TaskResponse: """Worker accepts a task — status moves to 'accepted'.""" task = get_task(task_id) if task is None: raise HTTPException(status_code=404, detail=f"Task not found: {task_id}") if task.status != "posted": raise HTTPException(status_code=409, detail=f"Task cannot be accepted in state '{task.status}'") update_task_status(task_id, "accepted", worker_id=worker_id) return _task_to_response(get_task(task_id)) @app.post("/v1/tasks/{task_id}/verify", response_model=VerifyResponse) async def verify(task_id: str, request: VerifyRequest) -> VerifyResponse: """Submit proof and verify against criteria.""" task = get_task(task_id) if task is None: raise HTTPException(status_code=404, detail=f"Task not found: {task_id}") if task.status not in ("posted", "accepted"): raise HTTPException( status_code=409, detail=f"Task cannot be verified in state '{task.status}' — must be 'posted' or 'accepted'", ) update_task_status(task_id, "proof_submitted", worker_id=request.worker_id) all_passed, results = verify_all(task.verification_criteria, request.proofs) if all_passed: update_task_status(task_id, "completed", escrow_status="released") escrow_action = "release" record_worker_outcome(request.worker_id, "completed", earned=task.budget_usdc - task.fee_usdc) ``` ```python @app.post("/v1/tasks/{task_id}/dispute", response_model=DisputeResponse) async def file_dispute(task_id: str, request: DisputeRequest) -> DisputeResponse: """Dispute a task — freezes escrow.""" ...[truncated 2200 chars]- Remediation
View remediation