[Security] No Constant-Time Signature Comparison in Any Connector

[mefai-dev]

Bug Name

No Constant-Time Signature Comparison in Any Connector

Attack Scenario

None of the Java, Go, or Rust connectors use constant-time comparison when handling signature values. While primarily a server-side concern, clients that verify webhook signatures would be vulnerable to timing attacks.

Impact

Low for client SDKs. Would become relevant if webhook verification features are added.

Components

Affects all three connectors: binance-connector-java, binance-connector-go, binance-connector-rust. No timingSafeEqual or equivalent found.

Reproduction

1. Search entire codebase for constant-time comparison functions.
2. None found in any of the three connector SDKs.

Fix

Add constant-time comparison utilities for any future signature verification features.

Details

Finding ID: LOW-01
Severity: Low

---

Researcher: Independent Security Researcher -- Mefai Security Team