mirror of
https://github.com/luxfi/pq-profile-ids.git
synced 2026-10-30 15:21:52 +00:00
zeekay
46f121a827
Flip `_refuseUnderStrictPQ` from deny-list to allow-list semantics.
Under `PROFILE_QUASAR_STRICT_PQ`, a verifier is admissible iff its
`policyId()` is in `{POLICY_STARK_FRI_SHA3_PQ, POLICY_MLDSA65_FIPS204}`.
A spoofed verifier returning an unknown bytes32 from `policyId()` (not
classical, not PQ) is now refused — the previous deny-list let any
unrecognised value pass.
Replace the early-return-on-zero-address branch with an explicit
revert (`VerifierUnsetUnderStrictPQ`) under strict-PQ. A zero
verifier under strict-PQ is a silent no-op state and was exactly the
attack vector Red flagged: admin + setActiveProfile(STRICT_PQ, 0)
disabled the gate while keeping the profile bytes32 set. Now refused.
Classical-compat still allows address(0) — that profile's gate is a
no-op by design.
Adds three tests:
- testStrictPQ_RefusesZeroAddress
- testClassicalCompat_AllowsZeroAddress
- testStrictPQ_RefusesSpoofedPolicy
Removes the obsolete testUnconfiguredSlot_IsNoOp (asserted old behaviour).
Forge: 14 passed / 14 total.
Closes Red HIGH cluster #2/#5/#8 at the foundation layer.
Version: 0.1.0 → 0.1.1.