Repository navigation
Fix sequencer QA findings: foreclosure, exits, replay and integrity - #56
Open
stephenctw wants to merge 8 commits into
Open
stephenctw wants to merge 8 commits into
stephenctw wants to merge 8 commits into
Conversation
QA finding SEQ-4: a batch with fee_price >= 17102 could permanently halt the canonical guest. Validate every frame fee before any frame drain or user-op execution. Reject the whole batch without consuming its nonce while preserving the independent overdue-direct backstop. Pin the fee boundary, invalid tail frames, nonce reuse, and the documented off-chain structural omission. Compatibility: canonical behavior changes require a rebuilt guest image. Validation: scheduler unit tests; the subsequent signed-expiry commit adds a combined real-machine fee/expiry regression.
QA finding SEQ-2: a release-hosted checksum did not independently pin the kernel, and stale snapshot hash sidecars could hide modified state. Pin the kernel SHA-512 in toolchain-pins.env and verify cached and newly downloaded bytes against it. Include the pin in release manifests. Verify the complete stored machine hash tree before watchdog bootstrap/replay. Validation: genuine/poisoned kernel download controls, toolchain pin checks, 51 watchdog unit tests, and a real-machine stale-sidecar corruption test.
The sequencer portion of QA finding NODE-15 exposed credential-bearing RPC URLs through startup and transport diagnostics. Omit the startup URL, report only the origin in plaintext opt-in warnings, and strip reqwest's attached URL before retry wrappers format failures. Preserve typed transport errors and their causes. Document the remaining server-response and dependency trace logging boundary. Validation: credential-bearing URL diagnostics regression and sequencer tests; strict Clippy passes.
…EQ-3) QA finding SEQ-3: anyone holding a recovered-away operation could submit it again when its nonce became current. Add required EIP-712/SSZ valid_until_block and reject expired operations at the shared execution boundary without consuming nonce or fee. Expose the frame clock in GET /fee, persist the full u64 deadline, update clients and fixtures, and account for the additional DA bytes in fee estimates. The deadline is inclusive and uses frame safe_block, not wall time or L1 inclusion time. Recovery does not immediately revoke a signature: replay before its deadline remains valid. Price/slippage limits remain app-owned. Compatibility: signing domain version 2, changed batch format and baseline schema; fresh setup and rebuilt canonical images are required. Validation: shared execution/storage tests, 11 real-machine tests including fee rejection and expiry boundaries, and revoked-signature recovery E2E.
…(SEAM-3) QA finding SEAM-3: foreclosure stranded credited balances and finalized deposits still pending in the scheduler, outside contract refund coverage. Publish sorted full-uint256 wallet entitlements in a canonical accounts drive, including authenticated supported-token pending deposits. Add a matching withdrawal builder, verified snapshot proof exporter, deployment geometry, and guardian-enabled on-chain test infrastructure. Validation: real canonical replay and on-chain Application withdrawal of credited and queued balances, including amounts above 128 bits; reject invalid proofs, finalized-deposit refunds and duplicate withdrawals. Compatibility: new canonical images and matching deployment configuration are required. This is the bounded reference-wallet integration. Production engines need their own custody conformance; the test finalization fixture does not validate Dave's dispute/epoch finalization pipeline.
QA finding SEQ-1: foreclosure left the sequencer issuing confirmations and reporting healthy before entering repeated recovery/no-op flush loops. Require fresh pinned-chain/open-application status before startup repair, and repeat the check on submitter polls, including idle polls. Treat the pinned application's foreclosure revert as terminal. Unavailable startup status retries without repair even when the persisted input view is fresh. Validation: status classification, repeated startup refusal without sends, real guardian foreclosure stopping admission/health, and warm restart refusal while the status RPC is unavailable. Detection follows RPC completion and poll cadence; it is not atomic with the L1 transition. A Latest reorg may conservatively stop the process.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This fixes the sequencer QA findings around canonical fee rejection, foreclosure, emergency withdrawals, signature replay, artifact integrity, and RPC credential logging. Each finding has a separate commit; a final lint fix corrects the watchdog test's shadowed variable.
Findings and changes
valid_until_block, enforce it at the shared execution boundary, persist it without truncation, and expose the frame clock through/fee.Compatibility and limits
safe_block. Recovery does not immediately revoke signatures; replay within the signed deadline remains valid. Price/slippage constraints remain application-owned.Validation
cargo checkpassed locally.