teleport/CHANGELOG.md

CHANGELOG — luxfi/teleport

All notable changes to the Teleport bridge endpoint surface are recorded here, with explicit cross-references to security findings closed in each release.

The format follows Keep a Changelog conventions; the project uses semver but the patch-level discipline is conservative — patch bumps indicate non-breaking changes only; minor bumps indicate additive features; major bumps would indicate wire-format breakage (none to date).

[Unreleased] — Tier A submission package

Added

• SUBMISSION.md — cover sheet for the Tier A bridge endpoint package.
• SPEC.md — bridge state machine, custody MPC ceremonies, oracle attestation, relay protocol.
• PROOF-CLAIMS.md — honest scope of what is proved (P1-P6) and what is NOT (N1-N6).
• TRUSTED-COMPUTING-BASE.md — TCB inventory across the three layers (hardware/OS, primitives, quorum operators).
• PATENTS.md — royalty-free patent grant for the bridge surface.
• DEPLOYMENT-RUNBOOK.md — operator-facing runbook (build, deploy, ceremony bootstrap, profile transition, key rotation, pause / emergency stop, monitoring).
• LEGACY-CLASSICAL.md — LUX_PROFILE=classical-compat opt-in documentation.
• CHANGELOG.md — this file.
• contracts/test/bridge_e2e_test.ts — full bridge round-trip under PQ-default profile (LUX_PROFILE=quasar-strict-pq).
• mpc/__tests__/custody_mpc_e2e_test.ts — MPC ceremony round-trip across all six threshold schemes with profile gating.
• api/src/pq/oracle_attestation_e2e_test.ts — EIP-712 ↔ ML-DSA-65 envelope parity tests.
• mpc/__tests__/signature_fuzz_test.ts — fuzz harness for envelope serializer, double-lattice splitter, hex / u32be / u64be helpers.
• mpc/__tests__/profile_negative_test.ts — classical-default attempts blocked under strict-PQ.

Removed

• contracts/test/Privacy.test.ts — references deprecated privacy contracts (BulletproofVerifier, PrivateBridge, ZNote, ZChainAMM) deleted in commit 49522d3. The tests had been producing HH700: Artifact not found errors on every CI run; this removal applies the one-and-only-one-way discipline: when a contract is deleted, its tests are deleted.
• contracts/test/PrivateTeleport.test.ts — same reason as above.

Notes

• No on-chain or off-chain code changes in this pass. The Tier A surface is documentation + tests only. The cryptographic surface was finalized in the prior commits listed below (Red rounds 1-5, Red HIGH #4).

[v1.1.0] — 2026-02-13

Added

• BridgeV2.sol (Warp 2.0 envelope-based bridge) alongside the v1 Bridge.sol (commit 0f8408b).
• Warp2VerifierStub.sol for development / testing.
• StrictPQProfileGate.sol re-exporting the canonical @luxfi/pq-profile-ids/src/PQProfileIDs.sol constants (commit dd59d5b).
• OnlyStrictPQ modifier from @luxfi/pq-profile-ids consumed by BridgeV2 (commit dd59d5b).
• Six-scheme threshold-signer bus in mpc/src/signers/:
  • ecdsa.ts — GG18 spawn-based ECDSA (legacy, byte-identical).
  • cggmp21.ts — JSON-RPC client to mpcd.
  • frost.ts — @noble/[email protected] in-process FROST or daemon routing.
  • pulsar.ts — JSON-RPC client to mpcd.
  • corona.ts — JSON-RPC client to mpcd.
  • doubleLattice.ts — composition of Pulsar ⊕ Corona. Single ThresholdSigner interface (ThresholdSigner.ts); single registry (index.ts); single env-var resolver (resolveSchemeFromEnv). Adding a scheme = one file + one case in registry (commit 6678f8d).
• api/src/pq/pqSigner.ts — ML-DSA-65 envelope signing path with pinned cSHAKE customization strings matching @luxfi/wallet (commit 62b6781).
• LUX_PROFILE env-var contract: one of quasar-strict-pq, classical-compat, hybrid. Fail-closed when unset. Replaces the two-flag dance of STRICT_PQ + MPC_SCHEME (commit dd59d5b).
• EXTCODEHASH allow-list on strict-PQ verifier slots (allowedVerifierCodeHashes, gated to DEFAULT_ADMIN_ROLE). Closes Section C residual (Red round 5) — a spoofed verifier with allow-listed policyId but verify returning true for any input is now refused at install time (commit 3098d07).
• HARDHAT_PRODUCTION_BUILD=1 env override that excludes test-only contracts (MockVerifier, NonPQP3QStub, P3QVerifierStubExport, StrictPQProfileGateHarness) from the production compilation (commit b2bcf1c).
• contracts/test/BridgeV2.test.ts cases (a)-(n): refusal symmetry, EXTCODEHASH allow-list, role split.
• contracts/test/StrictPQProfileGate.test.ts: 7 cases covering the canonical gate behaviour.
• mpc/__tests__/signers.test.ts: 31 cases covering the registry + per-scheme suites + LUX_PROFILE derivation.

Changed

• mpc/ MPC service now retargets all signers at mpcd JSON-RPC (canonical env var MPCD_URL; legacy THRESHOLD_DAEMON_URL is a back-compat alias) (commit 641858c).
• @luxfi/p3q-evm is now consumed upstream from its standalone repo; the previous in-repo P3Q verifier stub has been removed (commits 2f96688, 6b395dc).

Closed audit findings

Finding	Closing commit
Red round 4: deprecated privacy contracts	49522d3
Red round 5 / Section C: spoofed verifier bypass	3098d07
Red HIGH #4: silent classical fallback when env unset	dd59d5b
Red HIGH #5: address(0) silent no-op in strict-PQ slot	dd59d5b
Red HIGH #6: setP3QVerifier accepted non-PQ policies	62b6781

[v1.0.0] — 2024 (pre-Quasar)

Added

• EIP-712 typed-data signatures on Bridge.sol (commit 8acf621).
• ClaimId-based replay protection (commit 8acf621).
• Token whitelisting (commit 8acf621).
• Role separation (ADMIN_ROLE, ORACLE_ROLE, PAUSER_ROLE) (commit 8acf621).
• ReentrancyGuard, Pausable, SafeERC20 (commit 8acf621).
• Adversarial test suite (commit fa742a9).
• Privacy layer with FHE, range proofs, and Z-Chain AMM (commit dc96faf). Deprecated and removed in v1.1.0 (commit 49522d3).
• LICENSE file (commit 9d0c101).

Closed audit findings

Finding	Closing commit
Red round 1: EIP-712 typed signing	8acf621
Red round 2: token whitelist	8acf621
Red round 3: adversarial test gaps	fa742a9

Versioning policy

• Patch (v1.1.x): non-breaking changes — documentation, tests, bug fixes that don't change the wire format.
• Minor (v1.x.0): additive features — new MPC schemes, new verifier slots, new env vars (with fail-closed semantics if required). Existing wire formats stay byte-identical.
• Major (vx.0.0): wire-format breakage. No major bumps have occurred to date; the v1 → v2 transition is encoded as a separate contract (BridgeV2.sol) deployed alongside v1, not as a major bump.

The "no backwards compatibility, only forwards perfection" discipline from ~/work/lux/CLAUDE.md is honored at the contract level by deploying v2 alongside v1 rather than upgrading v1 in place. v1 remains operational under classical-compat profile until Phase 5 (decommission).