Fix: challenge endpoint leaks timing on invalid wallet

[barry01-hash]

The challenge endpoint response time may differ for valid vs invalid wallets. Normalize timing to reduce enumeration risk.

[ValJnr-dev1]

@ValJnr-dev1 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi Maintainer,

I’m a smart contract and full-stack developer and would love to contribute to this issue. I’m an experienced contributor with hands-on expertise in Rust, Soroban, Cairo, and TypeScript.

I’m passionate about building secure, scalable blockchain solutions, with a strong emphasis on writing clean and maintainable code. Based on the scope of this issue, I’m confident I can deliver a complete solution within 24 hours of assignment.

I’d greatly appreciate the opportunity to contribute and help move this forward.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @ValJnr-dev1 to this issue.

[Cedarich]

@Cedarich has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello maintainer can i take up this task

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Cedarich to this issue.

[Windowlight]

@Windowlight has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi, I’d like to work on this issue. I’ve reviewed the requirements and understand what needs to be implemented. I’ll first inspect the existing code, make the necessary changes, add or update tests where appropriate, and submit a clean, well-documented PR. I’m ready to start immediately.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Windowlight to this issue.

[Nuruddeen61]

@Nuruddeen61 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi team,

I want to take this issue.

Experience: I work with backend APIs and security. I have fixed timing leaks and auth flows before.

Plan:

1. Identify the challenge endpoint logic that returns early for invalid wallets
2. Normalize response timing using constant-time comparison and fixed delays
3. Ensure valid and invalid wallets take the same time to respond
4. Add tests to verify timing is consistent

I can start now.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Nuruddeen61 to this issue.

[Darktan242]

@Darktan242 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello Maintainer, I'd love to take ownership of this issue and work on a high quality solution. Once it's complete, I'll submit a pull request for your review. Thank you!

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Darktan242 to this issue.

[Alimzy]

@Alimzy has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi! I'd like to work on this issue.

I'm a software engineer with hands-on experience in testing, debugging, and building reliable features across the stack. I'm confident I can take this on and deliver a solid, well-tested solution that follows the project's existing conventions.

I'll make sure to cover the core functionality as well as relevant edge cases to keep things reliable and regression-resistant.

Let me know if I can get started, and I'll provide updates as I progress.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Alimzy to this issue.

[ExcelDsigN-tech]

@ExcelDsigN-tech has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I'm a full-stack developer with hands-on experience across Next.js, Node.js, NestJS, React, and TypeScript, and I also specialize in smart contract development using Rust and Soroban. I build end-to-end, from polished frontends to robust backends to on-chain logic, with a strong focus on clean, maintainable code that works in production, not just in isolation. I communicate progress consistently and keep things fully transparent throughout. I'm confident I can deliver within 12 hours.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @ExcelDsigN-tech to this issue.

[drips-wave]

Congratulations, @ExcelDsigN-tech! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @ExcelDsigN-tech: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊