mirror of
https://github.com/luxfi/chains.git
synced 2026-09-24 00:26:00 +00:00
zeekay
0777aeed15
HIGH (inert attestation gate): FillAttestationPubKey was read by settleCarried but NEVER written — parseConfig copied only 10 enumerated fields and parseGenesis carried only DexZapEndpoint+TrustedChains. So in prod the pubkey was nil, verifyFillAttestation returned nil, trustCarried was always true, and the fabricated-fills guard could never engage: a malicious/MITM proposer could settle fabricated fills and drain a cross-taker's seam reserve via the proceeds leg. Fix: add FillAttestationPubKey (hex) to the Genesis struct + parseGenesis, assigned into vm.Config. It is GENESIS-pinned only — deliberately absent from parseConfig — because it is consensus-affecting (gates trustCarried -> escrow-consume + export legs -> computeStateRoot); a per-node value would fork the StateRoot. A wrong-width key is a FATAL genesis error (fail-closed). FillAttestationSeed stays json:"-" (KMS-only, never in a genesis/config blob). MEDIUM (consensus comment): config.go now states the stronger invariant — the pubkey is STRICTER than DexZapEndpoint (which is node-local transport, not recomputed in the deterministic settle path) and MUST be a single genesis-pinned constant. MEDIUM (taker-authenticated MEV floor): the proceeds export object now carries the matched input (AtomicOutput.Spent; shared-memory object 61->69 bytes, both repos in lockstep) so the C-side ImportSettlement can enforce the taker's OWN recorded slippage limit (proceeds >= spent*worstRate) independently of the keeper's relay-supplied priceLimit. A keeper that zeroes the relay limit to sandwich the taker still produces a proceeds object C will refuse; understating spent loosens the floor but inflates refund, which the per-taker principal cap + seam-reserve conservation independently bound. Tests (redteam, CGO_ENABLED=0 pure Go): redteam_genesis_attestation_test drives a REAL genesis blob through Initialize->parseGenesis (NOT a direct Config write) and proves the pubkey reaches Config, a fabricated/unattested block becomes a full refund by virtue of genesis alone, a wrong-width genesis key fails Initialize closed, and the runtime config blob cannot set the consensus-affecting pubkey. native_seam canary pins the joint 69-byte object wire (incl. spent) across both repos. Full dexvm redteam + unit suites green.
Lux Chains
Independent VM plugin binaries for the Lux Network.
Each directory builds to a standalone binary that the Lux node loads as a plugin via --plugin-dir.
Build
make # build all VMs
make evm # build one VM
make test # test all
Install
lpm install evm
lpm install dexvm
Or copy binaries to ~/.lux/plugins/<vmid>.
VMs
| VM | Chain | Purpose |
|---|---|---|
| evm | C-Chain | EVM smart contracts |
| dexvm | D-Chain | Decentralized exchange |
| aivm | A-Chain | AI/ML inference |
| bridgevm | B-Chain | Cross-chain bridge |
| graphvm | G-Chain | GraphQL data layer |
| identityvm | I-Chain | Decentralized identity |
| keyvm | K-Chain | Key management |
| oraclevm | O-Chain | Oracle/off-chain data |
| quantumvm | Q-Chain | Post-quantum consensus signing (Pulsar) |
| relayvm | R-Chain | Cross-chain relay |
| servicenodevm | S-Chain | Service node registry |
| teleportvm | T-Chain | Unified teleport (bridge + relay + oracle) |
| thresholdvm (MPC) | M-Chain | MPC ceremonies (CGGMP21, FROST, Pulsar-general) — bridge custody for external wallets |
| thresholdvm (FHE) | F-Chain | FHE compute + TFHE bootstrap-key generation (encrypted EVM) |
| zkvm | Z-Chain | Groth16 over BLS12-381 (rolls N × ML-DSA-65 sigs into 192-byte proof) |