mirror of
https://github.com/luxfi/chains.git
synced 2026-09-24 00:26:00 +00:00
zeekay
0777aeed15
HIGH (inert attestation gate): FillAttestationPubKey was read by settleCarried but NEVER written — parseConfig copied only 10 enumerated fields and parseGenesis carried only DexZapEndpoint+TrustedChains. So in prod the pubkey was nil, verifyFillAttestation returned nil, trustCarried was always true, and the fabricated-fills guard could never engage: a malicious/MITM proposer could settle fabricated fills and drain a cross-taker's seam reserve via the proceeds leg. Fix: add FillAttestationPubKey (hex) to the Genesis struct + parseGenesis, assigned into vm.Config. It is GENESIS-pinned only — deliberately absent from parseConfig — because it is consensus-affecting (gates trustCarried -> escrow-consume + export legs -> computeStateRoot); a per-node value would fork the StateRoot. A wrong-width key is a FATAL genesis error (fail-closed). FillAttestationSeed stays json:"-" (KMS-only, never in a genesis/config blob). MEDIUM (consensus comment): config.go now states the stronger invariant — the pubkey is STRICTER than DexZapEndpoint (which is node-local transport, not recomputed in the deterministic settle path) and MUST be a single genesis-pinned constant. MEDIUM (taker-authenticated MEV floor): the proceeds export object now carries the matched input (AtomicOutput.Spent; shared-memory object 61->69 bytes, both repos in lockstep) so the C-side ImportSettlement can enforce the taker's OWN recorded slippage limit (proceeds >= spent*worstRate) independently of the keeper's relay-supplied priceLimit. A keeper that zeroes the relay limit to sandwich the taker still produces a proceeds object C will refuse; understating spent loosens the floor but inflates refund, which the per-taker principal cap + seam-reserve conservation independently bound. Tests (redteam, CGO_ENABLED=0 pure Go): redteam_genesis_attestation_test drives a REAL genesis blob through Initialize->parseGenesis (NOT a direct Config write) and proves the pubkey reaches Config, a fabricated/unattested block becomes a full refund by virtue of genesis alone, a wrong-width genesis key fails Initialize closed, and the runtime config blob cannot set the consensus-affecting pubkey. native_seam canary pins the joint 69-byte object wire (incl. spent) across both repos. Full dexvm redteam + unit suites green.