mirror of https://github.com/luxfi/teleport.git synced 2026-10-30 15:15:49 +00:00

Files

T

zeekay ddc5547d99 BridgeV2: EXTCODEHASH allow-list for strict-PQ verifier slots + HARDHAT_PRODUCTION_BUILD override

Red round 5: Section C (MEDIUM residual) + B6 (LOW).

Section C — verifier-honesty residual. The previous policy-id allow-list
refused verifiers whose `policyId()` was not in the PQ allow-list, but
a spoofed verifier whose `policyId()` returned POLICY_STARK_FRI_SHA3_PQ
while `verify()` returned `true` for any input would still pass the
gate. Compromising ADMIN_ROLE could mint without a real PQ check.

Fix: defence-in-depth EXTCODEHASH allow-list on
`setActiveProfile` (strict-PQ branch) and `setP3QVerifier`. Two-role
split:

  - DEFAULT_ADMIN_ROLE (multi-sig + timelock): extends the allow-list
    via `setAllowedVerifierCodeHash(codeHash, allowed)`.
  - ADMIN_ROLE (operations key): can install/swap verifiers, but every
    strict-PQ install must refer to a pre-allowed bytecode hash.

A compromised operations key can now only swap among already-vetted
verifier code — never install a "true-returning" attacker contract.
Gas cost: ~5k (one SSTORE) for allow-list updates; ~100 gas
(EXTCODEHASH + SLOAD) for the install-time check. Classical-compat
profile is intentionally NOT gated — orthogonal to the strict-PQ
slot policy.

B6 — `HARDHAT_PRODUCTION_BUILD=1` positive override. The previous
gate accepted any truthy `npm_lifecycle_event === "test"`, including
the parent-monorepo case of `pnpm -w test` propagating the env into a
hardhat child. A production CI step in the same shell could leak
MockVerifier (POLICY_STARK_FRI_SHA3_PQ, accepts any input) into the
deployment artifact set.

Fix: when `HARDHAT_PRODUCTION_BUILD=1` is set, exclude test-contracts
regardless of any other env. CI/CD MUST set it; documented in
contracts/README.md (Production builds section).

Tests:
  - (i) setActiveProfile refuses STARK-policy verifier with non-allowlisted code
  - (j) setActiveProfile accepts STARK-policy verifier with allowlisted code
  - (k) setP3QVerifier refuses STARK-policy verifier with non-allowlisted code
  - (l) DEFAULT_ADMIN_ROLE can extend the allow-list
  - (m) non-DEFAULT_ADMIN account cannot extend the allow-list
  - (n) classical-compat profile install is NOT gated by the allow-list

17 BridgeV2 contract tests pass (was 11, +6 for the EXTCODEHASH
allow-list). Fixture pre-allows mockStark + p3qStub code hashes so the
existing 11 strict-PQ tests stay green. Pre-existing PrivateTeleport
BulletproofVerifier artifact issue unchanged (out of scope).

2026-05-13 16:46:51 -07:00

784 B

Raw Permalink Blame History

Contracts for Lux teleport bridge protocol

Try running some of the following tasks:

npx hardhat help
npx hardhat test
REPORT_GAS=true npx hardhat test
npx hardhat node
npx hardhat ignition deploy ./ignition/modules/**.ts

Production builds

Deployment CI/CD MUST set HARDHAT_PRODUCTION_BUILD=1 when compiling the artifact set that ships to mainnet / testnet. This positive override forces exclusion of every test-contracts/*.sol (MockVerifier, NonPQP3QStub, StrictPQProfileGateHarness, ...) regardless of any HARDHAT_INCLUDE_TEST_CONTRACTS=1 or npm_lifecycle_event=test that may leak in from a parent monorepo workspace (e.g. pnpm -w test).

HARDHAT_PRODUCTION_BUILD=1 npx hardhat compile

See hardhat.config.ts (Red round 5 finding B6).

784 B Raw Permalink Blame History

Contracts for Lux teleport bridge protocol

Production builds

784 B

Raw Permalink Blame History