heretek-openclaw-core/REMEDIATION_LOG.md

Security Remediation Log

Date: 2026-04-04
Auditor: Zero-Trust Audit
Engineer: Node.js Runtime Engineer

Executive Summary

Four critical runtime crashes and security vulnerabilities were identified and remediated in the heretek-openclaw-core repository. All fixes have been applied with inline documentation and AUDIT-FIX comments.

---

A1: EventMesh Null Reference (CRITICAL)

File: modules/a2a-protocol/event-mesh.js:46

Issue: The connect() method called this.subscriber.duplicate() before this.subscriber was initialized, causing a null reference crash at startup.

Root Cause: The code attempted to duplicate a subscriber client that was never created. The original logic:

this.subscriber = this.subscriber.duplicate(); // this.subscriber is undefined!

Fix Applied:

1. Create main Redis client with redis.createClient(...)
2. Connect the main client: await this.client.connect()
3. THEN create subscriber by duplicating: this.subscriber = this.client.duplicate()
4. Connect subscriber: await this.subscriber.connect()
5. Added try/catch with proper cleanup on failure

Syntax Verification: ✅ Passed (node -c event-mesh.js)

---

A2: Gateway Authentication Bypass (CRITICAL)

File: gateway/openclaw-gateway.js

Issue: WebSocket connections were accepted without token validation, allowing unauthorized access to the A2A gateway.

Root Cause:

• GATEWAY_AUTH_ENABLED defaulted to false
• No token validation in _handleConnection()

Fix Applied:

1. Changed auth default: enabled in production (NODE_ENV === 'production')
2. Added token validation in _handleConnection():
   • Parse token from query string: const url = new URL(req.url, ...); const token = url.searchParams.get('token');
   • If this.config.auth.enabled, validate token matches this.config.auth.token
   • On failure: ws.close(4001, 'Unauthorized') and return early

Syntax Verification: ✅ Passed (node -c openclaw-gateway.js)

---

A3: JSON.parse Unhandled Exception (HIGH)

File: gateway/openclaw-gateway.js:389

Issue: Malformed JSON messages caused uncaught exceptions, crashing the gateway process.

Root Cause: JSON.parse() was inside a try/catch but didn't log the malformed message or return early, allowing partial processing.

Fix Applied:

1. Wrapped JSON.parse in dedicated try/catch block
2. On parse failure:
   • Log malformed message (truncated to 200 chars)
   • Send JSON error response via ws.send()
   • Return early to prevent further processing

Syntax Verification: ✅ Passed (node -c openclaw-gateway.js)

---

A4: BFT Consensus Blocking Loops (HIGH)

File: modules/consensus/bft-consensus.js:276-323

Issue: waitForConsensus(), waitForPrePrepare(), and waitForNewView() used busy-wait polling loops that blocked the Node.js event loop.

Root Cause: All three methods used:

while (Date.now() - startTime < timeout) {
  if (condition) return result;
  await new Promise(resolve => setTimeout(resolve, 100)); // Blocks event loop!
}

Fix Applied:

1. Made BFTConsensus extend EventEmitter
2. Added event emissions at state transitions:
   • handlePrepare(): emits 'pre-prepare' when entering commit state
   • handleCommit(): emits 'consensus' when consensus reached
   • handleNewView(): emits 'new-view' when view accepted
3. Replaced all waitFor* methods with Promise-based event-driven pattern:

async waitForConsensus(request, timeout = 30000) {
  return new Promise((resolve, reject) => {
    const handler = (result) => {
      clearTimeout(timer);
      this.off('consensus', handler);
      resolve({ success: true, request, ...result });
    };
    this.on('consensus', handler);
    const timer = setTimeout(async () => {
      this.off('consensus', handler);
      await this.initViewChange();
      resolve({ success: false, reason: 'timeout' });
    }, timeout);
  });
}

Syntax Verification: ✅ Passed (node -c bft-consensus.js)

---

Files Modified

File	Tasks Fixed
modules/a2a-protocol/event-mesh.js	A1
gateway/openclaw-gateway.js	A2, A3
modules/consensus/bft-consensus.js	A4

Commit Taxonomy Reference

All fixes follow the PRIME_DIRECTIVE taxonomy:

• fix(core): event-mesh null reference on connect
• fix(core): gateway authentication enforcement
• fix(core): json parse error handling in gateway
• fix(core): bft consensus non-blocking waits

Next Steps

1. Run full test suite to verify no regressions
2. Deploy to staging environment for integration testing
3. Monitor logs for any authentication failures or consensus timeouts
4. Consider adding unit tests for new error paths