mirror of
https://github.com/lux-apps/papers.git
synced 2026-11-03 05:07:46 +00:00
zooqueen
ebe2ebcb3c
Ringtail (Boschini et al., ePrint 2024/1113) is third-party prior art; Lux's Corona (Ring-LWE = Module-LWE rank-1) builds on it; Pulsar is Module-LWE rank-k. Retired the conflated boschini2024corona/corona2024/coronago/... bib keys to the single canonical ringtail/corona/pulsar/magnetar keys, rewrote \cite + \bibitem by context, and fixed 'Pulsar (Ring-LWE)' mislabels (Corona where corona.metal/ single-ring/Ringtail-derived; Pulsar where Module-LWE rank-k/ML-DSA). Cryptographer-led.
57 lines
2.5 KiB
TeX
57 lines
2.5 KiB
TeX
\section{Concrete Security Analysis (2025 Revision)}
|
|
|
|
|
|
\subsection{Forgery Probability}
|
|
|
|
We compute concrete security margins for the deployed MPC configurations. For a $(t, n)$-threshold scheme, the forgery probability depends on the underlying hardness assumption:
|
|
|
|
\begin{table}[h]
|
|
\centering
|
|
\begin{tabular}{@{}llll@{}}
|
|
\toprule
|
|
\textbf{Scheme} & \textbf{Configuration} & \textbf{Hardness} & \textbf{$\Pr[\text{Forge}]$} \\
|
|
\midrule
|
|
CGG21 & 11-of-15 (ETH) & ECDLP + Paillier & $< 2^{-127}$ \\
|
|
MuSig2 & 11-of-15 (BTC) & OMDL in ROM & $< 2^{-128}$ \\
|
|
FROST & 7-of-10 (XRPL) & OMDL in ROM & $< 2^{-128}$ \\
|
|
Corona & 15-of-21 (PQ) & LWE ($n=630$, $q=2^{32}$) & $< 2^{-128}$ \\
|
|
Dual-sig & CGG21 + Corona & ECDLP $\times$ LWE & $< 2^{-255}$ \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
|
|
\label{tab:concrete-security}
|
|
\end{table}
|
|
|
|
\subsection{Liveness at Scale}
|
|
|
|
For $n = 100$ validators, $t = 67$ threshold, individual uptime $p = 0.999$:
|
|
\begin{equation}
|
|
\Pr[\text{unavailable}] = \Pr[\text{Binomial}(100, 0.999) < 67] < 2^{-139.6}
|
|
\end{equation}
|
|
|
|
This is computed via the exact binomial CDF. The expected available nodes $\mu = 99.9$ exceeds the threshold by $32.9$ nodes, providing substantial headroom. See Appendix of the companion Lux Bridge paper \cite{lux-bridge-2025} for the full derivation.
|
|
|
|
\subsection{Contract-Level Security Fixes}
|
|
|
|
Four critical vulnerabilities were identified in the bridge smart contracts that interact with M-Chain:
|
|
|
|
\begin{enumerate}
|
|
\item \textbf{C-01}: \texttt{bridgeMint()} in LRC20B lacked daily limits. Fixed: configurable \texttt{dailyMintLimit} with automatic period reset.
|
|
\item \textbf{C-02}: \texttt{MINTER\_ROLE} was conflated with \texttt{DEFAULT\_ADMIN\_ROLE}. Fixed: separate role with explicit grant/revoke.
|
|
\item \textbf{C-03}: MPC-signed messages used \texttt{block.timestamp} as nonce. Fixed: monotonic counter nonce per bridge contract.
|
|
\item \textbf{C-04}: Withdraw nonce used predictable hash. Fixed: sequential per-user counter nonce.
|
|
\end{enumerate}
|
|
|
|
All fixes verified by Halmos symbolic proofs (68 \texttt{check\_} functions across the ecosystem).
|
|
|
|
\subsection{Formal Verification}
|
|
|
|
The M-Chain threshold cryptography is backed by Lean~4 proofs at \texttt{github.com/luxfi/formal}:
|
|
\begin{itemize}
|
|
\item \texttt{Crypto/FROST.lean}: FROST correctness and threshold unforgeability
|
|
\item \texttt{Crypto/BLS.lean}: BLS aggregation soundness from bilinearity
|
|
\item \texttt{Crypto/Corona.lean}: LWE security with concrete parameters ($n=630$, $q=2^{32}$, $\sigma=13744$)
|
|
\item \texttt{Consensus/BFT.lean}: $2f+1$ quorum safety for SwapSigTx validation
|
|
\end{itemize}
|
|
|