fix(sophia): reject negative enroll weights that amplify epoch payouts (#14583)

[Vyacheslav-Tomashevskiy]

Closes #14583 (Critical: Reward Amplification via Negative Weight in SOPHIA).

Bug

/epoch/enroll parses the temporal/rtc weight factors with _finite_float, which accepts any finite value, including negatives. The product total_weight = temporal * rtc * hw is stored verbatim by enroll_epoch, with no non-negativity check. A caller holding a valid ticket can therefore enroll a negative weight for any miner_pubkey.

At settlement, finalize_epoch computes sum_w = sum(weights) and pays each miner total_reward * (w / sum_w). A negative weight shrinks sum_w, inflating every other (attacker-controlled) miner's pro-rata share — reward theft / denial-of-weight.

This was the only enrollment path in the node that did not exclude non-positive weights. node/rip0202_enrollment.py ("negative weights canonicalise to 0 units (excluded)") and node/rustchain_block_producer.py (if enroll_weight <= 0) already guard against it.

Fix (defense in depth)

• Endpoint /epoch/enroll: reject negative temporal/rtc and any total_weight <= 0 with invalid_weights, before consuming the ticket (so a rejected request never burns a ticket).
• enroll_epoch(): backstop — non-finite / non-positive weights are never persisted, protecting any internal caller.
• finalize_epoch(): exclude non-positive / non-finite weights from sum_w and payouts, so a poisoned legacy row (enrolled before this guard) cannot distort settlement.

Tests

Added to node/tests/test_sophia_elya_service.py:

• endpoint rejects temporal: -5.0 with invalid_weights and preserves the ticket;
• enroll_epoch drops negative and zero weights, keeps the positive one;
• finalize_epoch excludes a poisoned -9.0 row so sum_w == 1.0 and the whole reward goes to the honest miner.

pytest node/tests/test_sophia_elya_service.py → 12 passed; adjacent epoch/settlement suites (reward-overflow, finalize-ledger, settlement-atomic, money-units, anti-double-mining-enroll, weight-fixedpoint, integrated-balance) → 39 passed.

/claim #14583

[github-actions]

Welcome to RustChain! Thanks for your first pull request.

Before we review, please make sure:

• Non-doc PRs have a BCOS-L1 or BCOS-L2 label
• Doc-only PRs are exempt from BCOS tier labels when they only touch docs/**, *.md, or common image/PDF files
• New code files include an SPDX license header
• You've tested your changes against the live node

Bounty tiers: Micro (1-10 RTC) | Standard (20-50) | Major (75-100) | Critical (100-150)

A maintainer will review your PR soon. Thanks for contributing!

[github-actions]

RTC Reward

This merged PR earned 5 RTC — sent to Vyacheslav-Tomashevskiy.

RustChain Bounty Program