Skip to content

Multiproof audit fixes#227

Merged
roger-bai-coinbase merged 9 commits into
mainfrom
multiproof-audit-fixes
Mar 31, 2026
Merged

Multiproof audit fixes#227
roger-bai-coinbase merged 9 commits into
mainfrom
multiproof-audit-fixes

Conversation

@roger-bai-coinbase

Copy link
Copy Markdown
Contributor

Summary

Addresses four audit findings across AggregateVerifier and NitroEnclaveVerifier.

Changes

  • Finding 1 — Short-circuit on invalid parent: resolve() now immediately sets CHALLENGER_WINS and skips proof threshold and bond logic when the parent game is already invalid, preventing unnecessary state evaluation.
  • Finding 2 — Emit encoded journal in AttestationSubmitted: The AttestationSubmitted event now emits abi.encode(journal) (the decoded, validated journal) instead of the raw output bytes. Both attestation events also gain an indexed zkCoProcessor parameter for efficient filtering.
  • Finding 3 — Clarify challenge comment: Updated comment in resolve() to accurately describe the challenger reward flow.
  • Finding 4 — Extract _getDelay() helper: Deduplicates the proof-count-to-delay logic shared by _decreaseExpectedResolution() and _increaseExpectedResolution() into a single _getDelay() internal function.
@cb-heimdall

cb-heimdall commented Mar 25, 2026

Copy link
Copy Markdown
Collaborator

✅ Heimdall Review Status

Requirement Status More Info
Reviews 1/1
Denominator calculation
Show calculation
1 if user is bot 0
1 if user is external 0
2 if repo is sensitive 0
From .codeflow.yml 1
Additional review requirements
Show calculation
Max 0
0
From CODEOWNERS 0
Global minimum 0
Max 1
1
1 if commit is unverified 0
Sum 1
@roger-bai-coinbase roger-bai-coinbase marked this pull request as ready for review March 25, 2026 18:56
@roger-bai-coinbase roger-bai-coinbase merged commit b11c86d into main Mar 31, 2026
8 checks passed
@roger-bai-coinbase roger-bai-coinbase deleted the multiproof-audit-fixes branch March 31, 2026 13:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

3 participants