mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
zeekay
cb77fab979
luxfi/threshold v1.12.7 added FROST(Ed25519, SHA-512), so Solana and TON finally have a signable curve. The sessions named "EdDSA" were calling KeygenTaproot — BIP-340 over secp256k1 — whose key is also 32 bytes, sails through the len(EDDSAPubKey)==32 gate, and base58-encodes into a real-looking Solana address the ring can never sign for. ⚠ A LIVE WRONG-ADDRESS BUG went with it: handlers_wallets served addresses["ton"] = *wallet.SolAddress. A TON address is not a base58 pubkey — it is workchain plus a hash of the wallet contract's StateInit, base64url with a CRC16 — so the API was handing out an address that decodes to nothing. Deleted rather than guessed; TON returns when its encoding is real. The keygen tests used to call frost.KeygenEd25519 directly, which validated the LIBRARY and not the daemon: reintroducing KeygenTaproot left every package green. They now go through the production session, and so does a test that constructs the real signing session and proves the caller's bytes reach the protocol unhashed. Both original bugs reintroduced together fail 11 tests. secp256k1 keygen changes from fail-open to fail-closed, and that is the one behavioural change to the existing EVM/BTC path. An empty pubkey previously meant any of nil config, marshal failure, kvstore.Put failure or keyinfo-save failure — and was returned as SUCCESS, announcing addresses while fewer than t+1 nodes hold a share. Applying fail-closed to Solana while leaving the higher-value leg fail-open is incoherent. Also: the KMS share classifier still keyed off the retired "frost:" prefix; the CGGMP21 session published its own local failure onto the same first-wins subject as the ring's verdict, so one node's failure could beat the ring's success; and one 120s deadline shared across two sequential ceremonies starved the cheap leg. NOT YET SPENDABLE. ConsensusKeyInfoStore.Save is the only RegisterKey caller and hardcodes "secp256k1", and TriggerSign reads the curve from that field, so no product entry point can reach Ed25519 signing. The address is correct; signing it needs a wire-contract change shared with lux/wallet.
291 lines
14 KiB
AMPL
291 lines
14 KiB
AMPL
module github.com/luxfi/mpc
|
|
|
|
go 1.26.4
|
|
|
|
require (
|
|
cloud.google.com/go/kms v1.27.0
|
|
cloud.google.com/go/secretmanager v1.18.0
|
|
filippo.io/age v1.3.1
|
|
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1
|
|
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0
|
|
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.4.0
|
|
github.com/avast/retry-go v3.0.0+incompatible
|
|
github.com/aws/aws-sdk-go-v2/config v1.32.13
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.19.13
|
|
github.com/aws/aws-sdk-go-v2/service/kms v1.50.4
|
|
github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.41.5
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.41.10
|
|
github.com/cloudflare/circl v1.6.3
|
|
github.com/cronokirby/saferith v0.33.0
|
|
github.com/decred/dcrd/dcrec/edwards/v2 v2.0.4
|
|
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1
|
|
github.com/fxamacker/cbor/v2 v2.9.2
|
|
github.com/go-chi/chi/v5 v5.2.5
|
|
github.com/go-chi/cors v1.2.2
|
|
github.com/golang-jwt/jwt/v5 v5.3.1
|
|
github.com/google/uuid v1.6.1-0.20241114170450-2d3c2a9cc518
|
|
github.com/gtank/ristretto255 v0.2.0
|
|
github.com/hanzoai/base v1.5.8
|
|
github.com/hanzoai/dbx v1.17.2
|
|
github.com/hanzoai/orm v0.6.16
|
|
github.com/hanzoai/sqlite v0.4.0
|
|
github.com/hanzos3/go-sdk v1.0.2
|
|
github.com/hashicorp/consul/api v1.33.7
|
|
github.com/luxfi/cc v0.3.0
|
|
github.com/luxfi/crypto v1.20.2
|
|
github.com/luxfi/database v1.21.1
|
|
github.com/luxfi/fhe v1.11.1
|
|
github.com/luxfi/hsm v1.1.3
|
|
github.com/luxfi/lattice/v7 v7.1.4
|
|
github.com/luxfi/log v1.4.3
|
|
github.com/luxfi/metric v1.8.1
|
|
github.com/luxfi/threshold v1.12.7
|
|
github.com/luxfi/zap v1.2.6
|
|
github.com/mitchellh/mapstructure v1.5.0
|
|
github.com/mr-tron/base58 v1.3.0
|
|
github.com/nats-io/nats.go v1.50.0
|
|
github.com/pquerna/otp v1.5.0
|
|
github.com/rs/zerolog v1.35.0
|
|
github.com/samber/lo v1.53.0
|
|
github.com/spf13/viper v1.21.0
|
|
github.com/stretchr/testify v1.11.1
|
|
github.com/urfave/cli/v3 v3.8.0
|
|
golang.org/x/crypto v0.54.0
|
|
golang.org/x/term v0.45.0
|
|
google.golang.org/api v0.275.0
|
|
)
|
|
|
|
require (
|
|
cloud.google.com/go v0.123.0 // indirect
|
|
cloud.google.com/go/auth v0.20.0 // indirect
|
|
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
|
|
cloud.google.com/go/compute/metadata v0.9.0 // indirect
|
|
cloud.google.com/go/iam v1.7.0 // indirect
|
|
cloud.google.com/go/longrunning v0.9.0 // indirect
|
|
filippo.io/edwards25519 v1.2.0 // indirect
|
|
filippo.io/hpke v0.4.0 // indirect
|
|
github.com/ALTree/bigfloat v0.2.0 // indirect
|
|
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 // indirect
|
|
github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect
|
|
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect
|
|
github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect
|
|
github.com/agl/ed25519 v0.0.0-20200225211852-fd4d107ace12 // indirect
|
|
github.com/andybalholm/brotli v1.2.1 // indirect
|
|
github.com/ansel1/merry v1.8.1 // indirect
|
|
github.com/ansel1/merry/v2 v2.2.2 // indirect
|
|
github.com/armon/go-metrics v0.4.1 // indirect
|
|
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
|
|
github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/signin v1.0.9 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.30.14 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.18 // indirect
|
|
github.com/aws/smithy-go v1.24.2 // indirect
|
|
github.com/bits-and-blooms/bitset v1.24.4 // indirect
|
|
github.com/boombuler/barcode v1.1.0 // indirect
|
|
github.com/cenkalti/backoff v2.2.1+incompatible // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/consensys/gnark-crypto v0.20.1 // indirect
|
|
github.com/crate-crypto/go-eth-kzg v1.5.0 // indirect
|
|
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
|
|
github.com/decred/dcrd/crypto/rand v1.0.1 // indirect
|
|
github.com/dgraph-io/ristretto/v2 v2.4.0 // indirect
|
|
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
|
|
github.com/disintegration/imaging v1.6.2 // indirect
|
|
github.com/domodwyer/mailyak/v3 v3.6.2 // indirect
|
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
|
github.com/ethereum/c-kzg-4844/v2 v2.1.7 // indirect
|
|
github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a // indirect
|
|
github.com/fatih/color v1.19.0 // indirect
|
|
github.com/felixge/httpsnoop v1.0.4 // indirect
|
|
github.com/fsnotify/fsnotify v1.9.0 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.13 // indirect
|
|
github.com/ganigeorgiev/fexpr v0.5.0 // indirect
|
|
github.com/gemalto/flume v1.0.0 // indirect
|
|
github.com/gemalto/kmip-go v0.1.0 // indirect
|
|
github.com/go-ini/ini v1.67.0 // indirect
|
|
github.com/go-jose/go-jose/v4 v4.1.4 // indirect
|
|
github.com/go-logr/logr v1.4.3 // indirect
|
|
github.com/go-logr/stdr v1.2.2 // indirect
|
|
github.com/go-ozzo/ozzo-validation/v4 v4.3.0 // indirect
|
|
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
|
|
github.com/goccy/go-json v0.10.6 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/golang/mock v1.6.0 // indirect
|
|
github.com/golang/snappy v1.0.0 // indirect
|
|
github.com/google/flatbuffers v25.12.19+incompatible // indirect
|
|
github.com/google/go-cmp v0.7.0 // indirect
|
|
github.com/google/go-sev-guest v0.14.1 // indirect
|
|
github.com/google/go-tdx-guest v0.3.1 // indirect
|
|
github.com/google/logger v1.1.1 // indirect
|
|
github.com/google/s2a-go v0.1.9 // indirect
|
|
github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
|
|
github.com/googleapis/gax-go/v2 v2.21.0 // indirect
|
|
github.com/gorilla/rpc v1.2.1 // indirect
|
|
github.com/grandcat/zeroconf v1.0.0 // indirect
|
|
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 // indirect
|
|
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
|
|
github.com/gtank/merlin v0.1.1 // indirect
|
|
github.com/hanzoai/builder v0.3.13 // indirect
|
|
github.com/hanzoai/csqlite v0.1.0 // indirect
|
|
github.com/hanzoai/kv-go/v9 v9.18.0 // indirect
|
|
github.com/hanzoai/pubsub-go v1.0.0 // indirect
|
|
github.com/hanzoai/sqlcipher v0.1.1 // indirect
|
|
github.com/hanzoai/tasks v1.52.0 // indirect
|
|
github.com/hanzoai/vfs v0.4.3 // indirect
|
|
github.com/hanzoai/xorm v1.4.4 // indirect
|
|
github.com/hanzokv/go/v9 v9.22.0 // indirect
|
|
github.com/hashicorp/errwrap v1.1.0 // indirect
|
|
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
|
github.com/hashicorp/go-hclog v1.6.3 // indirect
|
|
github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
|
|
github.com/hashicorp/go-metrics v0.5.4 // indirect
|
|
github.com/hashicorp/go-multierror v1.1.1 // indirect
|
|
github.com/hashicorp/go-rootcerts v1.0.2 // indirect
|
|
github.com/hashicorp/go-version v1.7.0 // indirect
|
|
github.com/hashicorp/golang-lru v1.0.2 // indirect
|
|
github.com/hashicorp/serf v0.10.2 // indirect
|
|
github.com/holiman/uint256 v1.3.2 // indirect
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
github.com/jackc/pgpassfile v1.0.0 // indirect
|
|
github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
|
|
github.com/jackc/pgx/v5 v5.9.1 // indirect
|
|
github.com/jackc/puddle/v2 v2.2.2 // indirect
|
|
github.com/klauspost/compress v1.18.6 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
|
|
github.com/klauspost/crc32 v1.3.0 // indirect
|
|
github.com/kylelemons/godebug v1.1.0 // indirect
|
|
github.com/luxfi/accel v1.2.4 // indirect
|
|
github.com/luxfi/age v1.6.0 // indirect
|
|
github.com/luxfi/atomic v1.0.0 // indirect
|
|
github.com/luxfi/cache v1.3.1 // indirect
|
|
github.com/luxfi/codec v1.2.1 // indirect
|
|
github.com/luxfi/compress v0.1.1 // indirect
|
|
github.com/luxfi/concurrent v0.1.1 // indirect
|
|
github.com/luxfi/consensus v1.36.3 // indirect
|
|
github.com/luxfi/constants v1.6.2 // indirect
|
|
github.com/luxfi/container v0.2.1 // indirect
|
|
github.com/luxfi/corona v0.10.4 // indirect
|
|
github.com/luxfi/crypto/ipa v1.2.4 // indirect
|
|
github.com/luxfi/dkg v0.3.5 // indirect
|
|
github.com/luxfi/geth v1.20.1 // indirect
|
|
github.com/luxfi/ids v1.3.2 // indirect
|
|
github.com/luxfi/lens v0.2.1 // indirect
|
|
github.com/luxfi/magnetar v1.2.3 // indirect
|
|
github.com/luxfi/math v1.5.1 // indirect
|
|
github.com/luxfi/math/big v0.1.0 // indirect
|
|
github.com/luxfi/mdns v0.1.1 // indirect
|
|
github.com/luxfi/mlwe v0.3.0 // indirect
|
|
github.com/luxfi/mock v0.1.1 // indirect
|
|
github.com/luxfi/pq v1.1.0 // indirect
|
|
github.com/luxfi/precompile v0.19.3 // indirect
|
|
github.com/luxfi/pulsar v1.9.2 // indirect
|
|
github.com/luxfi/sampler v1.1.0 // indirect
|
|
github.com/luxfi/utils v1.3.1 // indirect
|
|
github.com/luxfi/zapdb v1.10.1 // indirect
|
|
github.com/mattn/go-colorable v0.1.15 // indirect
|
|
github.com/mattn/go-isatty v0.0.22 // indirect
|
|
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
|
|
github.com/miekg/dns v1.1.72 // indirect
|
|
github.com/miekg/pkcs11 v1.1.1 // indirect
|
|
github.com/mimoo/StrobeGo v0.0.0-20220103164710-9a04d6ca976b // indirect
|
|
github.com/minio/crc64nvme v1.1.1 // indirect
|
|
github.com/minio/md5-simd v1.1.2 // indirect
|
|
github.com/minio/minio-go/v7 v7.0.100 // indirect
|
|
github.com/mitchellh/go-homedir v1.1.0 // indirect
|
|
github.com/montanaflynn/stats v0.9.0 // indirect
|
|
github.com/nats-io/nkeys v0.4.15 // indirect
|
|
github.com/nats-io/nuid v1.0.1 // indirect
|
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
|
github.com/nexus-rpc/sdk-go v0.6.0 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.3.0 // indirect
|
|
github.com/philhofer/fwd v1.2.0 // indirect
|
|
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
|
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
|
github.com/robfig/cron v1.2.0 // indirect
|
|
github.com/robfig/cron/v3 v3.0.1 // indirect
|
|
github.com/rs/xid v1.6.0 // indirect
|
|
github.com/sagikazarmark/locafero v0.12.0 // indirect
|
|
github.com/spf13/afero v1.15.0 // indirect
|
|
github.com/spf13/cast v1.10.0 // indirect
|
|
github.com/spf13/cobra v1.10.2 // indirect
|
|
github.com/spf13/pflag v1.0.10 // indirect
|
|
github.com/stretchr/objx v0.5.3 // indirect
|
|
github.com/subosito/gotenv v1.6.0 // indirect
|
|
github.com/supranational/blst v0.3.16 // indirect
|
|
github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
|
|
github.com/tinylib/msgp v1.6.4 // indirect
|
|
github.com/valyala/bytebufferpool v1.0.0 // indirect
|
|
github.com/valyala/fasthttp v1.72.0 // indirect
|
|
github.com/veraison/go-cose v1.3.0 // indirect
|
|
github.com/x448/float16 v0.8.4 // indirect
|
|
github.com/zap-proto/go v1.3.0 // indirect
|
|
github.com/zap-proto/http v0.3.0 // indirect
|
|
github.com/zeebo/blake3 v0.2.4 // indirect
|
|
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect
|
|
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
|
|
go.opentelemetry.io/otel v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/metric v1.44.0 // indirect
|
|
go.opentelemetry.io/otel/trace v1.44.0 // indirect
|
|
go.temporal.io/api v1.62.6 // indirect
|
|
go.temporal.io/sdk v1.41.1 // indirect
|
|
go.uber.org/atomic v1.11.0 // indirect
|
|
go.uber.org/mock v0.6.0 // indirect
|
|
go.uber.org/multierr v1.11.0 // indirect
|
|
go.uber.org/zap v1.27.1 // indirect
|
|
go.yaml.in/yaml/v3 v3.0.4 // indirect
|
|
golang.org/x/exp v0.0.0-20260529124908-c761662dc8c9 // indirect
|
|
golang.org/x/image v0.38.0 // indirect
|
|
golang.org/x/mod v0.37.0 // indirect
|
|
golang.org/x/net v0.56.0 // indirect
|
|
golang.org/x/oauth2 v0.36.0 // indirect
|
|
golang.org/x/sync v0.22.0 // indirect
|
|
golang.org/x/sys v0.47.0 // indirect
|
|
golang.org/x/text v0.40.0 // indirect
|
|
golang.org/x/time v0.15.0 // indirect
|
|
golang.org/x/tools v0.47.0 // indirect
|
|
gonum.org/v1/gonum v0.17.0 // indirect
|
|
google.golang.org/genproto v0.0.0-20260406210006-6f92a3bedf2d // indirect
|
|
google.golang.org/genproto/googleapis/api v0.0.0-20260615183401-62b3387ff324 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d // indirect
|
|
google.golang.org/grpc v1.81.1 // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
modernc.org/libc v1.72.3 // indirect
|
|
modernc.org/mathutil v1.7.1 // indirect
|
|
modernc.org/memory v1.11.0 // indirect
|
|
modernc.org/sqlite v1.51.0 // indirect
|
|
)
|
|
|
|
// Required by decred/dcrd/dcrec/edwards/v2 (all versions). Cannot remove until upstream fixes.
|
|
|
|
// agl/ed25519 upstream archived; redirect to luxfi fork with go.mod.
|
|
// v0.1.1 (not v0.1.0): v0.1.0's git bytes were force-republished, so its zip
|
|
// hash diverges from the immutable sum.golang.org pin and no copy verifies;
|
|
// v0.1.1 is the clean patch the proxy + checksum db agree on.
|
|
replace github.com/agl/ed25519 => github.com/luxfi/edwards25519 v0.1.1
|
|
|
|
replace github.com/luxfi/log v1.3.0 => github.com/luxfi/log v1.4.1
|
|
|
|
// luxfi/genesis v1.5.21 / v1.5.22 are missing from proxy.golang.org; no
|
|
// luxfi/mpc code path imports them, but transitive resolution can pick them
|
|
// up. Excluded until genesis retags.
|
|
exclude (
|
|
github.com/luxfi/genesis v1.5.21
|
|
github.com/luxfi/genesis v1.5.22
|
|
)
|