security(consensus): uncle block bits never checked against ASERT — free uncle rewards

[AlphaB135]

Severity: HIGH (bundle fix with #190)

Location

crates/consensus/src/lib.rs lines 654–665

Description

When no difficulty anchor is set, expected_uncles_bits is None and the uncle's bits field is never validated against the ASERT target. An attacker submits fake uncles with DEVNET_MAX_BITS — PoW check passes trivially. Uncle rewards are paid at full mainnet subsidy rates for near-zero work.

Fix

Make the bits check unconditional — require a difficulty anchor for uncle validation and fail if it is missing:

let expected_bits = expected_uncle_bits
    .ok_or(ConsensusError::InvalidUncle("missing difficulty anchor".into()))?;
if uncle.header.bits != expected_bits {
    return Err(ConsensusError::InvalidUncle("uncle bits mismatch".into()));
}