mirror of
https://github.com/luxfi/evm.git
synced 2026-09-24 00:27:44 +00:00
zeekay
b80a7d0ffd
HIGH-3 host side. The always-on 0x9999 settlement precompile resolves its halt +
pot-seeding authority from contract.AtomicState.GovernanceController(); this is the
production wiring that supplies it — a per-network governance CONTRACT, never a
hardcoded mnemonic-derivable EOA.
- dex_value_wiring.go (installDEXValuePath): bind rt.GovernanceController =
dexGovernanceFor(networkID) onto the chain runtime at boot (the ONE production
site), alongside the asset resolver + native D client, and log it. dexGovernanceFor
is the genesis-set per-network governance-contract seam: it returns ids.ShortEmpty
for every network TODAY (no Governor/Timelock is deployed at a known address on any
Lux network yet), so every network runs FAIL-CLOSED (no halt authority — provably no
single key can DoS the DEX) until its real governance CONTRACT address is wired in,
per net. The directive is explicit: each entry MUST be a governance contract, NEVER a
dev-mnemonic EOA, and NEVER the retired 0x9011…94714. The boot log makes an unset
authority loud ("<unset: halt/seed FAIL-CLOSED — deploy + wire a governance contract>").
- core/precompile_overrider.go + precompile/registry/bridge.go: accessibleStateAdapter
and accessibleStateBridge implement GovernanceController() (ids.ShortID→common.Address,
exact 20-byte conversion); the internal twin interface gains the method. Returns the
zero address (fail-closed) when the runtime/atomic capability is absent.
- precompile/contract/atomic.go (evm-internal twin): AtomicState gains GovernanceController().
Builds clean (CGO off) across plugin/evm, core, precompile/registry; the dexsettle_guard
parity test passes. Normal trading is unaffected (halt switches are emergency controls,
off by default); only the ability to halt is gated — which previously only a mnemonic-EOA
holder had (a vuln), so no legitimate capability is lost and a censorship/DoS vector is removed.
51 lines
2.4 KiB
Go
51 lines
2.4 KiB
Go
// Copyright (C) 2025-2026, Lux Industries, Inc. All rights reserved.
|
|
// See the file LICENSE for licensing terms.
|
|
|
|
package contract
|
|
|
|
import (
|
|
"github.com/luxfi/geth/common"
|
|
"github.com/luxfi/ids"
|
|
"github.com/luxfi/vm/chains/atomic"
|
|
)
|
|
|
|
// AtomicState is the OPTIONAL host capability the EVM's AccessibleState
|
|
// implements so a stateful precompile can move value across primary-network
|
|
// chains via atomic shared memory (the platformvm / dexvm import-export
|
|
// primitive). It is the internal twin of
|
|
// github.com/luxfi/precompile/contract.AtomicState; the registry bridge forwards
|
|
// between the two structurally-identical surfaces.
|
|
//
|
|
// It is deliberately separate from AccessibleState (which has many mock
|
|
// implementers) so only the concrete EVM adapter carries the capability and
|
|
// every other precompile is unaffected. A precompile type-asserts it and reverts
|
|
// when absent.
|
|
type AtomicState interface {
|
|
// AtomicMemory returns this chain's atomic shared-memory handle (nil when the
|
|
// host wired none — single-chain dev / non-atomic harness).
|
|
AtomicMemory() atomic.SharedMemory
|
|
// NetworkID is the numeric network identifier.
|
|
NetworkID() uint32
|
|
// ChainID is this (C-Chain / EVM) chain's id.
|
|
ChainID() ids.ID
|
|
// CChainID is the C-Chain peer id (== ChainID on the C-Chain itself).
|
|
CChainID() ids.ID
|
|
// GovernanceController is the per-network DEX governance authority address — the
|
|
// SOLE caller permitted to toggle the 0x9999 settlement kill switches or seed its
|
|
// pots. A governance CONTRACT resolved by the host from its deployment topology,
|
|
// never a dev-mnemonic EOA. The zero address means no authority is configured, which
|
|
// the precompile treats as fail-closed (halt/seed revert). Internal twin of the
|
|
// external contract.AtomicState method the registry bridge forwards.
|
|
GovernanceController() common.Address
|
|
// DChainID is the D-Chain (dexvm) blockchain id the C<->D atomic seam routes to,
|
|
// resolved by the host from the chain topology (the consensus context's
|
|
// blockchain-alias lookup of "D"). ids.Empty on a network with no dexvm deployed.
|
|
// This is the runtime-resolved D peer for the always-on DEX settlement precompile
|
|
// (0x9999) — zero per-net config; deterministic per network on every validator.
|
|
DChainID() ids.ID
|
|
// TxID is the executing transaction's id.
|
|
TxID() ids.ID
|
|
// CallIndex is this precompile invocation's per-tx ordinal.
|
|
CallIndex() uint32
|
|
}
|