mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
zeekay
3bb399cbdd
Adds the topology contract that lets a fund run mpcd as its own private
cluster — no Lux primary network registration, no shared M-Chain audit
ledger — using the same code path and the same operator surface.
Mode flag at cmd/mpcd/main.go:
--network=primary|private # registration target
--audit-store=mchain|local-worm|... # audit log destination
--registrar-url, --registrar-auth # primary-mode announcement
--audit-worm-path, --audit-mchain-url # backend selectors
pkg/audit:
- Append-only Merkle hash chain. Tampering with any historical event
invalidates every subsequent hash. Canonical bytes use fixed-order
concatenation (json.Marshal map ordering is non-deterministic).
- WORMDispatcher: NDJSON append, replay-on-start, fsync per Append.
- MChainDispatcher: batched POST of (batchHash, fromSeq, toSeq) to a
configurable anchor RPC.
- compositeDispatcher: fan-out to multiple legs with per-leg sealing.
- S3 Glacier Vault / Azure Immutable / GCS Object Lock dispatchers
fail closed — wired into the flag surface but gated behind the
cloud-audit build tag, no silent fallback.
pkg/identity/bootstrap.go: identity creation + (primary-mode only)
registrar announcement. Same on-disk format as the previous
loadOrGenerateIdentity (which is now removed); private mode is silent.
deployments/k8s-private: fund-only Kustomize overlay. Standalone
namespace, NetworkPolicy that blocks egress to anything outside the
fund's VPC, hardware-WORM PVC for the audit log, KMS-driven secret
template.
deployments/k8s-primary: env-var patch overlay on the existing lux-mpc
base. composite(local-worm,mchain) by default.
deployments/terraform/{aws,gcp,azure}: VPC + audit storage modules.
terraform validate passes; EKS/GKE/AKS + HSM modules are stubbed and
not yet plan-tested.
deployments/onprem/README.md: WORM storage + PKCS#11 HSM checklist.
Tests (14 total, all passing):
pkg/audit: 6/6 (chain, WORM replay, MChain batching, composite,
cloud stubs fail loud, double-seal rejected)
pkg/identity: 4/4 (private no-call, primary call, primary empty
URL no-op, primary registrar 503 surfaces)
internal/privatemode: 4/4 (no registrar traffic, restart, tamper-detect,
cloud stubs fail loud)
Companion runbook in lux/papers/lux-private-mpc-deployment/
(LaTeX, 5 pages, tectonic-clean).
107 lines
3.0 KiB
Go
107 lines
3.0 KiB
Go
package approval
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
)
|
|
|
|
func TestSafe_RoundTrip(t *testing.T) {
|
|
provider, err := NewSafeMultisig(map[string]string{
|
|
"chain_id": "1",
|
|
"safe_address": "0x1234567890abcdef1234567890abcdef12345678",
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("NewSafeMultisig: %v", err)
|
|
}
|
|
sp := provider.(*SafeMultisigProvider)
|
|
if err := sp.Enroll("treasury-3of5", 1, "0x1234567890abcdef1234567890abcdef12345678"); err != nil {
|
|
t.Fatalf("Enroll: %v", err)
|
|
}
|
|
|
|
intent := newTestIntent("send 100 ETH to grant recipient")
|
|
sessionID, err := sp.IssueChallenge(context.Background(), "treasury-3of5", intent)
|
|
if err != nil {
|
|
t.Fatalf("IssueChallenge: %v", err)
|
|
}
|
|
|
|
// Simulate the on-chain execution producing safeTxHash + execTxHash.
|
|
var safeTxHash, execTxHash [32]byte
|
|
for i := range safeTxHash {
|
|
safeTxHash[i] = byte(i)
|
|
execTxHash[i] = byte(0xff - i)
|
|
}
|
|
sig, err := sp.SubmitExecution(context.Background(), sessionID, safeTxHash, execTxHash)
|
|
if err != nil {
|
|
t.Fatalf("SubmitExecution: %v", err)
|
|
}
|
|
|
|
if sig.Algorithm != AlgorithmSafeContract {
|
|
t.Fatalf("Algorithm = %q, want %q", sig.Algorithm, AlgorithmSafeContract)
|
|
}
|
|
if len(sig.Signature) != 92 {
|
|
t.Fatalf("Signature length = %d, want 92", len(sig.Signature))
|
|
}
|
|
|
|
ok, err := sp.VerifyApproval(context.Background(), intent, sig)
|
|
if err != nil {
|
|
t.Fatalf("VerifyApproval: %v", err)
|
|
}
|
|
if !ok {
|
|
t.Fatal("VerifyApproval = false, want true")
|
|
}
|
|
|
|
// Tampered intent → verification fails (digest mismatch).
|
|
other := newTestIntent("different")
|
|
ok, _ = sp.VerifyApproval(context.Background(), other, sig)
|
|
if ok {
|
|
t.Fatal("VerifyApproval(tampered) = true, want false")
|
|
}
|
|
|
|
// Bundle with wrong chain → fail.
|
|
tamperedSig := sig
|
|
tamperedSig.Signature = make([]byte, 92)
|
|
copy(tamperedSig.Signature, sig.Signature)
|
|
tamperedSig.Signature[7] = 0xff // chainID byte
|
|
ok, _ = sp.VerifyApproval(context.Background(), intent, tamperedSig)
|
|
if ok {
|
|
t.Fatal("VerifyApproval(wrong chain) = true, want false")
|
|
}
|
|
}
|
|
|
|
func TestSafe_BadConfig(t *testing.T) {
|
|
if _, err := NewSafeMultisig(nil); err == nil {
|
|
t.Fatal("NewSafeMultisig(nil): want error")
|
|
}
|
|
if _, err := NewSafeMultisig(map[string]string{"chain_id": "1"}); err == nil {
|
|
t.Fatal("NewSafeMultisig without safe_address: want error")
|
|
}
|
|
if _, err := NewSafeMultisig(map[string]string{"safe_address": "0x12"}); err == nil {
|
|
t.Fatal("NewSafeMultisig with short address: want error")
|
|
}
|
|
}
|
|
|
|
func TestSafe_BundleEncoding(t *testing.T) {
|
|
addr := [20]byte{1, 2, 3, 4, 5}
|
|
var safeTxHash, execTxHash [32]byte
|
|
safeTxHash[0] = 0xab
|
|
execTxHash[31] = 0xcd
|
|
bundle := encodeSafeBundle(42, addr, safeTxHash, execTxHash)
|
|
|
|
chainID, gotAddr, gotSafe, gotExec, err := decodeSafeBundle(bundle)
|
|
if err != nil {
|
|
t.Fatalf("decodeSafeBundle: %v", err)
|
|
}
|
|
if chainID != 42 {
|
|
t.Fatalf("chainID = %d, want 42", chainID)
|
|
}
|
|
if gotAddr != addr {
|
|
t.Fatal("addr mismatch")
|
|
}
|
|
if gotSafe != safeTxHash {
|
|
t.Fatal("safeTxHash mismatch")
|
|
}
|
|
if gotExec != execTxHash {
|
|
t.Fatal("execTxHash mismatch")
|
|
}
|
|
}
|