mirror of
https://github.com/luxfi/node.git
synced 2026-07-27 03:39:39 +00:00
platformvm/txs/zap_native: schema v3 with TxKind discriminator (LP-023 Phase 1)
Phase A response to Red's batch-2 review:
F2 (MEDIUM, cross-type confusion) — schema-bump v2→v3. Every fixed
section now carries a TxKind uint8 at offset 0; every other field
shifts by +1 byte. Wrap*Tx reads TxKind first and returns
ErrWrongTxKind on mismatch. Constructors write the kind
unconditionally. Closes the gap where an AdvanceTimeTx buffer wrapped
as a BaseTx returned garbage-but-deterministic field reads.
TxKind enum (dense, 0 reserved):
1=AdvanceTime 2=RewardValidator 3=SetL1ValidatorWeight
4=IncreaseL1ValidatorBalance 5=DisableL1Validator 6=Base
7=RegisterL1Validator 8=SlashValidator
9=TransferChainOwnership 10=RemoveChainValidator
v3 sizes (each +1 vs v2 from the TxKind byte):
AdvanceTimeTx = 9
RewardValidatorTx = 33
SetL1ValidatorWeightTx = 49
IncreaseL1ValidatorBalanceTx = 41
DisableL1ValidatorTx = 33
BaseTx = 45
RegisterL1ValidatorTx = 217
SlashValidatorTx = 57
TransferChainOwnershipTx = 69 (no natural-alignment padding; reads are alignment-tolerant)
RemoveChainValidatorTx = 53
F1 (MEDIUM, memo malleability) — closed at the luxfi/zap wire layer
in v0.6.1 (negative relOffset rejected in Object.Bytes). Bumped node's
go.mod replace: zap v0.2.0 → v0.6.1. TestRed_V2 now confirms the
defense via the nil-Memo branch.
F4 (INFO, doc bugs) — RegisterL1ValidatorTx comment now correctly
declares size 217; TransferChainOwnershipTx now correctly declares
size 69. Both sizes flow from offset arithmetic — no magic numbers.
AT1 (accepted tradeoff, memo aliasing) — BaseTx.Memo() docstring
escalated: READ-ONLY contract + the canonical defensive-copy idiom
(append([]byte(nil), m...)). Same pattern documented for every
variable-length accessor going forward.
Brand cleanup: SlashValidatorTx.Subnet() → Network() and
RemoveChainValidatorTx.Subnet() → Network(). Zero `Subnet*` symbols
in batch-2 code path. Tests updated.
V14 security test now exhaustively covers cross-confusion: 10
pairings of {valid-tx-buf, wrong-Wrap} + reserved TxKind=0 — all
reject with ErrWrongTxKind. The other 19 Red vectors continue to
pass under v3.
go test -race ./vms/platformvm/txs/zap_native/...
ok github.com/luxfi/node/vms/platformvm/txs/zap_native 1.446s
Coordinated with luxfi/zap@v0.6.1 (F1 fix).
This commit is contained in:
Hanzo AI
@@ -27,7 +27,7 @@ require (
|
||||
github.com/jackpal/gateway v1.1.1
|
||||
github.com/jackpal/go-nat-pmp v1.0.2
|
||||
github.com/luxfi/consensus v1.25.13
|
||||
github.com/luxfi/crypto v1.19.15
|
||||
github.com/luxfi/crypto v1.19.17
|
||||
github.com/luxfi/database v1.18.3
|
||||
github.com/luxfi/ids v1.2.13
|
||||
github.com/luxfi/keychain v1.0.2
|
||||
@@ -58,13 +58,13 @@ require (
|
||||
go.opentelemetry.io/otel/trace v1.43.0 // indirect
|
||||
go.uber.org/goleak v1.3.0
|
||||
go.uber.org/mock v0.6.0
|
||||
golang.org/x/crypto v0.50.0
|
||||
golang.org/x/crypto v0.52.0
|
||||
golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 // indirect
|
||||
golang.org/x/mod v0.34.0
|
||||
golang.org/x/net v0.52.0
|
||||
golang.org/x/mod v0.36.0
|
||||
golang.org/x/net v0.55.0
|
||||
golang.org/x/sync v0.20.0
|
||||
golang.org/x/time v0.15.0
|
||||
golang.org/x/tools v0.43.0
|
||||
golang.org/x/tools v0.45.0
|
||||
gonum.org/v1/gonum v0.17.0
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
|
||||
google.golang.org/grpc v1.80.0 // indirect
|
||||
@@ -113,8 +113,8 @@ require (
|
||||
go.opentelemetry.io/otel/metric v1.43.0 // indirect
|
||||
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
|
||||
go.uber.org/multierr v1.11.0 // indirect
|
||||
golang.org/x/sys v0.43.0 // indirect
|
||||
golang.org/x/text v0.36.0 // indirect
|
||||
golang.org/x/sys v0.45.0 // indirect
|
||||
golang.org/x/text v0.37.0 // indirect
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
|
||||
)
|
||||
|
||||
@@ -123,7 +123,7 @@ require (
|
||||
github.com/consensys/gnark-crypto v0.20.1
|
||||
github.com/golang-jwt/jwt/v4 v4.5.2
|
||||
github.com/golang/mock v1.7.0-rc.1
|
||||
github.com/luxfi/accel v1.1.8
|
||||
github.com/luxfi/accel v1.1.9
|
||||
github.com/luxfi/api v1.0.11
|
||||
github.com/luxfi/atomic v1.0.0
|
||||
github.com/luxfi/chains v1.2.3
|
||||
@@ -177,7 +177,7 @@ require (
|
||||
github.com/luxfi/kms v1.11.2 // indirect
|
||||
github.com/luxfi/lens v0.1.4 // indirect
|
||||
github.com/luxfi/magnetar v1.2.0 // indirect
|
||||
github.com/luxfi/mdns v0.1.0 // indirect
|
||||
github.com/luxfi/mdns v0.1.1 // indirect
|
||||
github.com/luxfi/oracle v0.1.1-0.20260429020431-76258cfcddf9 // indirect
|
||||
github.com/luxfi/pq v1.0.3 // indirect
|
||||
github.com/luxfi/protocol v0.0.4 // indirect
|
||||
@@ -186,7 +186,7 @@ require (
|
||||
github.com/luxfi/staking v1.1.0 // indirect
|
||||
github.com/luxfi/threshold v1.9.7 // indirect
|
||||
github.com/luxfi/trace v0.1.4 // indirect
|
||||
github.com/luxfi/zap v0.2.0 // indirect
|
||||
github.com/luxfi/zap v0.6.1 // indirect
|
||||
github.com/luxfi/zapdb v1.10.0 // indirect
|
||||
github.com/miekg/dns v1.1.72 // indirect
|
||||
github.com/mimoo/StrobeGo v0.0.0-20220103164710-9a04d6ca976b // indirect
|
||||
|
||||
@@ -252,6 +252,8 @@ github.com/leanovate/gopter v0.2.11 h1:vRjThO1EKPb/1NsDXuDrzldR28RLkBflWYcU9CvzW
|
||||
github.com/leanovate/gopter v0.2.11/go.mod h1:aK3tzZP/C+p1m3SPRE4SYZFGP7jjkuSI4f7Xvpt0S9c=
|
||||
github.com/luxfi/accel v1.1.8 h1:dFD1MSrVV7T4wrLcQbj+7vjfNSPxlRId3mJcTxMKoBM=
|
||||
github.com/luxfi/accel v1.1.8/go.mod h1:K00BcnLzEYMPHwCFq8Tf/450ApmTs9xBVvYOnofJCkc=
|
||||
github.com/luxfi/accel v1.1.9 h1:Tsk6gXj2uKE19501bD0ajRYdeCHIlTGb6jYyLc+F8hc=
|
||||
github.com/luxfi/accel v1.1.9/go.mod h1:K00BcnLzEYMPHwCFq8Tf/450ApmTs9xBVvYOnofJCkc=
|
||||
github.com/luxfi/address v1.0.1 h1:Sc4keyuVzBIvHr7uVeYZf2/WY9YDGUgDi/iiWenj49g=
|
||||
github.com/luxfi/address v1.0.1/go.mod h1:5j3Eh66v9zvv1GbNdZwt+23krV8JlSDaRzmWZU8ZRM0=
|
||||
github.com/luxfi/age v1.5.0 h1:G69HbSV4R3vKEH9B0CulnRaMdSdf4RalMgP8xKmxHeI=
|
||||
@@ -282,6 +284,8 @@ github.com/luxfi/corona v0.7.6 h1:CJP6smygD55dL0HHkKkWryL9H24a+wXvs+L+WchK7Nc=
|
||||
github.com/luxfi/corona v0.7.6/go.mod h1:4aD7+ZqnlZ2aVuU/DBQ5aspIagv5ux45LW2sJ4+siY8=
|
||||
github.com/luxfi/crypto v1.19.15 h1:Tf+iPRXv08Rlj9k7iNtYy0e1tJWIgRcY0pTR4rQax6w=
|
||||
github.com/luxfi/crypto v1.19.15/go.mod h1:INjdZtke85k8hX/QAmTMAY8bbZ4gzGZQLqURg3xf6Gk=
|
||||
github.com/luxfi/crypto v1.19.17 h1:l2LLu7UFyICtJVfraLDLRi+lFGiDXKHSL18M9/m1gsQ=
|
||||
github.com/luxfi/crypto v1.19.17/go.mod h1:INjdZtke85k8hX/QAmTMAY8bbZ4gzGZQLqURg3xf6Gk=
|
||||
github.com/luxfi/crypto/ipa v1.2.4 h1:6xfwhI9/HrcDkF3Ti5/NxsNQIWbwYDJmRSNIHRQ/xfU=
|
||||
github.com/luxfi/crypto/ipa v1.2.4/go.mod h1:43J6f6rcfUMrZt4cQectMOZb6Ps+fAEj8ZTPC3Kk+gE=
|
||||
github.com/luxfi/database v1.18.3 h1:gg+xwhKUxXa7fDoOD8IS91E71QqoEtcDCl2nfS61Jgg=
|
||||
@@ -324,6 +328,8 @@ github.com/luxfi/math/safe v0.0.1 h1:GfSBINV9mOFgHzd32JbgfHSLhlNn0BwnP43rteYEosc
|
||||
github.com/luxfi/math/safe v0.0.1/go.mod h1:EejrmOJHh03YAD8+Zww8cPcMR1K3Q2I7w1dX4sMloeo=
|
||||
github.com/luxfi/mdns v0.1.0 h1:VB3mQcETc9j5SY1S6lAgFtuGr/rjWuDgPYnxS+OKWMQ=
|
||||
github.com/luxfi/mdns v0.1.0/go.mod h1:/3dheKVjUk2yiS/ocH1IDzeLXOIe+kpVsErIGDOZdiQ=
|
||||
github.com/luxfi/mdns v0.1.1 h1:g2eRr9AXcziPkkcd24M+Qu9ApEpoKKjfI79QSNqv0rQ=
|
||||
github.com/luxfi/mdns v0.1.1/go.mod h1:dbp5f3h3aE7CGzwbaWzBM9cwdcekhmSrWhQevgYhhNA=
|
||||
github.com/luxfi/metric v1.5.7 h1:LoSPEUpak2SLcynF+LT2cXjl9ECp4nY+Lia9zudmDv4=
|
||||
github.com/luxfi/metric v1.5.7/go.mod h1:CMguEhyuLi4YUWyXimJ+UHply99BDFrL0pxedB7rBqM=
|
||||
github.com/luxfi/mock v0.1.1 h1:0HEtIjg1J6CWz+IUyP6rsGqNWTcmxjFnSQIhaDuARwY=
|
||||
@@ -386,6 +392,8 @@ github.com/luxfi/warp v1.18.6 h1:+ly7mHz77ig4yUyLax32aAjk7tiQQ6eygzOSDNfYRbQ=
|
||||
github.com/luxfi/warp v1.18.6/go.mod h1:OBN23yiGl+E4qupkPHuetBIEqsI8q5leE8WJH8soFjY=
|
||||
github.com/luxfi/zap v0.2.0 h1:RzvOkp3EoN5UCkpnqfObHLM1sEHy7YcxXKuermhE/VA=
|
||||
github.com/luxfi/zap v0.2.0/go.mod h1:2hydPSa/XMCMtfW6/DC9M5Bt03N5h75QwCV5Vypsqr4=
|
||||
github.com/luxfi/zap v0.6.1 h1:CzFAHLj/2ZjJkv2cCZaSIq44U8nrHSziocVuXPYmeLQ=
|
||||
github.com/luxfi/zap v0.6.1/go.mod h1:1k+nwT+JW802YzuPAuf7CxMSGr/qxvbGgGwi5k6X9Ok=
|
||||
github.com/luxfi/zapdb v1.10.0 h1:1lLHEmkyC0BucnA/zjQYsMkUVxuEo2vQkEaQGjYfuuc=
|
||||
github.com/luxfi/zapdb v1.10.0/go.mod h1:Qukh3hDRD0MnxA6z+a28JTnXhN85AiLLgp6TYr4QAMc=
|
||||
github.com/luxfi/zwing v0.5.2 h1:2+nDKHVIdT8GvaKO79GuO3x/3DgJvX0gI32h4P+P6RU=
|
||||
@@ -601,6 +609,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
|
||||
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
|
||||
golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
|
||||
golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
|
||||
golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
|
||||
golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
|
||||
golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 h1:jiDhWWeC7jfWqR9c/uplMOqJ0sbNlNWv0UkzE0vX1MA=
|
||||
golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90/go.mod h1:xE1HEv6b+1SCZ5/uscMRjUBKtIxworgEcEi+/n9NQDQ=
|
||||
golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
|
||||
@@ -609,6 +619,8 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
|
||||
golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
|
||||
golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
|
||||
golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
|
||||
golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
|
||||
golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
|
||||
golang.org/x/net v0.0.0-20180719180050-a680a1efc54d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
|
||||
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||
@@ -625,6 +637,8 @@ golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su
|
||||
golang.org/x/net v0.0.0-20220607020251-c690dde0001d/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
|
||||
golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
|
||||
golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
|
||||
golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
|
||||
golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
|
||||
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
@@ -657,6 +671,8 @@ golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
|
||||
golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
|
||||
golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
@@ -666,6 +682,8 @@ golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
|
||||
golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
|
||||
golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
|
||||
golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
|
||||
golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
|
||||
golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
|
||||
golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
@@ -677,6 +695,8 @@ golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4f
|
||||
golang.org/x/tools v0.1.8/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU=
|
||||
golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
|
||||
golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
|
||||
golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
|
||||
golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
|
||||
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
|
||||
|
||||
@@ -20,14 +20,14 @@ import (
|
||||
"github.com/luxfi/zap"
|
||||
)
|
||||
|
||||
// AdvanceTimeTx ZAP schema: one uint64 field, fixed layout.
|
||||
// AdvanceTimeTx ZAP schema v3: TxKind discriminator + uint64 timestamp.
|
||||
//
|
||||
// Wire = ZAP_HEADER (16 bytes) + Object{ Time: uint64@0 } (8 bytes data).
|
||||
// Wire = ZAP_HEADER (16 bytes) + Object{ TxKind: u8@0, Time: u64@1 } (9 bytes).
|
||||
const (
|
||||
SchemaVersionAdvanceTimeTx uint16 = 2
|
||||
SchemaVersionAdvanceTimeTx uint16 = 3
|
||||
|
||||
OffsetAdvanceTimeTx_Time = 0 // uint64
|
||||
SizeAdvanceTimeTx = 8
|
||||
OffsetAdvanceTimeTx_Time = 1 // uint64 (after TxKind@0)
|
||||
SizeAdvanceTimeTx = 9
|
||||
)
|
||||
|
||||
// AdvanceTimeTx is a zero-copy typed accessor over a ZAP buffer.
|
||||
@@ -56,24 +56,30 @@ func (t AdvanceTimeTx) IsZero() bool {
|
||||
//
|
||||
// Zero copy: the returned accessor references the input buffer directly.
|
||||
// The caller MUST keep the buffer alive while the accessor is in use.
|
||||
// Returns ErrInvalidMagic/ErrInvalidVersion from the ZAP layer on a
|
||||
// malformed buffer.
|
||||
// Returns ErrWrongTxKind if the discriminator byte does not match
|
||||
// TxKindAdvanceTime; returns ErrInvalidMagic/ErrInvalidVersion from the
|
||||
// ZAP layer on a malformed buffer.
|
||||
func WrapAdvanceTimeTx(b []byte) (AdvanceTimeTx, error) {
|
||||
msg, err := zap.Parse(b)
|
||||
if err != nil {
|
||||
return AdvanceTimeTx{}, err
|
||||
}
|
||||
return AdvanceTimeTx{msg: msg, obj: msg.Root()}, nil
|
||||
obj := msg.Root()
|
||||
if TxKind(obj.Uint8(OffsetTxKind)) != TxKindAdvanceTime {
|
||||
return AdvanceTimeTx{}, ErrWrongTxKind
|
||||
}
|
||||
return AdvanceTimeTx{msg: msg, obj: obj}, nil
|
||||
}
|
||||
|
||||
// NewAdvanceTimeTx builds an AdvanceTimeTx into a fresh ZAP buffer.
|
||||
//
|
||||
// No reflection. No serialize tag walk. The builder writes Time at offset 0
|
||||
// in the object payload, finalizes the ZAP message, and returns a typed
|
||||
// accessor over the resulting buffer.
|
||||
// No reflection. No serialize tag walk. The builder writes TxKind at offset 0
|
||||
// and Time at offset 1 in the object payload, finalizes the ZAP message, and
|
||||
// returns a typed accessor over the resulting buffer.
|
||||
func NewAdvanceTimeTx(time uint64) AdvanceTimeTx {
|
||||
b := zap.NewBuilder(zap.HeaderSize + 16 + SizeAdvanceTimeTx)
|
||||
ob := b.StartObject(SizeAdvanceTimeTx)
|
||||
ob.SetUint8(OffsetTxKind, uint8(TxKindAdvanceTime))
|
||||
ob.SetUint64(OffsetAdvanceTimeTx_Time, time)
|
||||
ob.FinishAsRoot()
|
||||
buf := b.Finish()
|
||||
|
||||
@@ -174,15 +174,15 @@ func TestRegisterL1ValidatorTxRoundTrip(t *testing.T) {
|
||||
|
||||
func TestSlashValidatorTxRoundTrip(t *testing.T) {
|
||||
wantNode := ids.NodeID{0x01, 0x02, 0x03, 0x04, 0x05}
|
||||
wantSubnet := ids.ID{0xa1, 0xa2, 0xa3, 0xa4}
|
||||
wantNet := ids.ID{0xa1, 0xa2, 0xa3, 0xa4}
|
||||
const wantPct uint32 = 250_000 // 25% in PercentDenominator units
|
||||
|
||||
tx := NewSlashValidatorTx(wantNode, wantSubnet, wantPct)
|
||||
tx := NewSlashValidatorTx(wantNode, wantNet, wantPct)
|
||||
if tx.NodeID() != wantNode {
|
||||
t.Fatalf("NodeID = %v, want %v", tx.NodeID(), wantNode)
|
||||
}
|
||||
if tx.Subnet() != wantSubnet {
|
||||
t.Fatal("Subnet mismatch")
|
||||
if tx.Network() != wantNet {
|
||||
t.Fatal("Network mismatch")
|
||||
}
|
||||
if tx.SlashPercentage() != wantPct {
|
||||
t.Fatalf("SlashPercentage = %d, want %d", tx.SlashPercentage(), wantPct)
|
||||
@@ -192,7 +192,7 @@ func TestSlashValidatorTxRoundTrip(t *testing.T) {
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if tx2.NodeID() != wantNode || tx2.Subnet() != wantSubnet || tx2.SlashPercentage() != wantPct {
|
||||
if tx2.NodeID() != wantNode || tx2.Network() != wantNet || tx2.SlashPercentage() != wantPct {
|
||||
t.Fatal("wrap-round-trip mismatch")
|
||||
}
|
||||
}
|
||||
@@ -229,21 +229,21 @@ func TestTransferChainOwnershipTxRoundTrip(t *testing.T) {
|
||||
|
||||
func TestRemoveChainValidatorTxRoundTrip(t *testing.T) {
|
||||
wantNode := ids.NodeID{0x10, 0x20, 0x30, 0x40, 0x50}
|
||||
wantSubnet := ids.ID{0xfa, 0xce, 0xb0, 0x0c}
|
||||
wantNet := ids.ID{0xfa, 0xce, 0xb0, 0x0c}
|
||||
|
||||
tx := NewRemoveChainValidatorTx(wantNode, wantSubnet)
|
||||
tx := NewRemoveChainValidatorTx(wantNode, wantNet)
|
||||
if tx.NodeID() != wantNode {
|
||||
t.Fatal("NodeID mismatch")
|
||||
}
|
||||
if tx.Subnet() != wantSubnet {
|
||||
t.Fatal("Subnet mismatch")
|
||||
if tx.Network() != wantNet {
|
||||
t.Fatal("Network mismatch")
|
||||
}
|
||||
|
||||
tx2, err := WrapRemoveChainValidatorTx(tx.Bytes())
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if tx2.NodeID() != wantNode || tx2.Subnet() != wantSubnet {
|
||||
if tx2.NodeID() != wantNode || tx2.Network() != wantNet {
|
||||
t.Fatal("wrap-round-trip mismatch")
|
||||
}
|
||||
}
|
||||
@@ -289,14 +289,14 @@ func TestAllAccessorsZeroAlloc(t *testing.T) {
|
||||
{"RegisterL1ValidatorTx.Expiry", func() { _ = regTx.Expiry() }},
|
||||
{"RegisterL1ValidatorTx.ValidationID", func() { _ = regTx.ValidationID() }},
|
||||
{"SlashValidatorTx.NodeID", func() { _ = slTx.NodeID() }},
|
||||
{"SlashValidatorTx.Subnet", func() { _ = slTx.Subnet() }},
|
||||
{"SlashValidatorTx.Network", func() { _ = slTx.Network() }},
|
||||
{"SlashValidatorTx.SlashPercentage", func() { _ = slTx.SlashPercentage() }},
|
||||
{"TransferChainOwnershipTx.Chain", func() { _ = tcoTx.Chain() }},
|
||||
{"TransferChainOwnershipTx.OwnerThreshold", func() { _ = tcoTx.OwnerThreshold() }},
|
||||
{"TransferChainOwnershipTx.OwnerLocktime", func() { _ = tcoTx.OwnerLocktime() }},
|
||||
{"TransferChainOwnershipTx.OwnerAddress", func() { _ = tcoTx.OwnerAddress() }},
|
||||
{"RemoveChainValidatorTx.NodeID", func() { _ = rcvTx.NodeID() }},
|
||||
{"RemoveChainValidatorTx.Subnet", func() { _ = rcvTx.Subnet() }},
|
||||
{"RemoveChainValidatorTx.Network", func() { _ = rcvTx.Network() }},
|
||||
}
|
||||
for _, c := range cases {
|
||||
c := c
|
||||
|
||||
@@ -8,26 +8,28 @@ import (
|
||||
"github.com/luxfi/zap"
|
||||
)
|
||||
|
||||
// BaseTx v1 schema — NetworkID + BlockchainID + Memo. The Outs/Ins fields of
|
||||
// the legacy lux.BaseTx are variable-length nested-object lists and need a
|
||||
// proper ZAP list schema; they ship in batch 3. This v1 form is the metadata
|
||||
// envelope every higher-level platformvm tx embeds.
|
||||
// BaseTx v3 schema — TxKind + NetworkID + BlockchainID + Memo. The Outs/Ins
|
||||
// fields of the legacy lux.BaseTx are variable-length nested-object lists
|
||||
// and need a proper ZAP list schema; they ship in batch 3 as BaseTxFull.
|
||||
// This minimal form is the metadata envelope every higher-level platformvm
|
||||
// tx embeds.
|
||||
//
|
||||
// Fixed-section layout (size 44 bytes):
|
||||
// Fixed-section layout (size 45 bytes):
|
||||
//
|
||||
// NetworkID uint32 @ 0
|
||||
// BlockchainID 32B @ 4
|
||||
// Memo bytes @ 36 (offset+length pair, 8 bytes)
|
||||
// TxKind uint8 @ 0
|
||||
// NetworkID uint32 @ 1
|
||||
// BlockchainID 32B @ 5
|
||||
// Memo bytes @ 37 (offset+length pair, 8 bytes)
|
||||
const (
|
||||
SchemaVersionBaseTx uint16 = 2
|
||||
SchemaVersionBaseTx uint16 = 3
|
||||
|
||||
OffsetBaseTx_NetworkID = 0 // uint32
|
||||
OffsetBaseTx_BlockchainID = 4 // ids.ID (32 bytes)
|
||||
OffsetBaseTx_Memo = 36 // bytes (offset+length, 8 bytes)
|
||||
SizeBaseTx = 44
|
||||
OffsetBaseTx_NetworkID = 1 // uint32
|
||||
OffsetBaseTx_BlockchainID = 5 // ids.ID (32 bytes)
|
||||
OffsetBaseTx_Memo = 37 // bytes (offset+length, 8 bytes)
|
||||
SizeBaseTx = 45
|
||||
)
|
||||
|
||||
// BaseTx is a zero-copy typed accessor over a ZAP buffer carrying a v1 BaseTx.
|
||||
// BaseTx is a zero-copy typed accessor over a ZAP buffer carrying a v3 BaseTx.
|
||||
type BaseTx struct {
|
||||
msg *zap.Message
|
||||
obj zap.Object
|
||||
@@ -47,8 +49,16 @@ func (t BaseTx) BlockchainID() ids.ID {
|
||||
return out
|
||||
}
|
||||
|
||||
// Memo returns the memo bytes. Zero-copy: the returned slice aliases the
|
||||
// underlying ZAP buffer. Callers MUST NOT mutate it.
|
||||
// Memo returns the memo bytes.
|
||||
//
|
||||
// READ-ONLY: the returned slice aliases the underlying ZAP buffer. Mutation
|
||||
// corrupts the parsed tx and any TxID = hash(buffer) computed downstream. To
|
||||
// own the bytes, copy first: append([]byte(nil), m...).
|
||||
//
|
||||
// Zero-copy / zero-allocation contract: a defensive copy would allocate on
|
||||
// every call, defeating the native-ZAP design. The read-only discipline is
|
||||
// type-system-erased; enforce via review and the lint rule deferred to a
|
||||
// follow-up.
|
||||
func (t BaseTx) Memo() []byte {
|
||||
return t.obj.Bytes(OffsetBaseTx_Memo)
|
||||
}
|
||||
@@ -57,18 +67,27 @@ func (t BaseTx) Bytes() []byte { return t.msg.Bytes() }
|
||||
func (t BaseTx) IsZero() bool { return t.msg == nil }
|
||||
|
||||
// WrapBaseTx parses a ZAP buffer into a typed BaseTx accessor.
|
||||
//
|
||||
// Returns ErrWrongTxKind if the discriminator byte does not match
|
||||
// TxKindBase; returns ErrInvalidMagic/ErrInvalidVersion from the ZAP layer
|
||||
// on a malformed buffer.
|
||||
func WrapBaseTx(b []byte) (BaseTx, error) {
|
||||
msg, err := zap.Parse(b)
|
||||
if err != nil {
|
||||
return BaseTx{}, err
|
||||
}
|
||||
return BaseTx{msg: msg, obj: msg.Root()}, nil
|
||||
obj := msg.Root()
|
||||
if TxKind(obj.Uint8(OffsetTxKind)) != TxKindBase {
|
||||
return BaseTx{}, ErrWrongTxKind
|
||||
}
|
||||
return BaseTx{msg: msg, obj: obj}, nil
|
||||
}
|
||||
|
||||
// NewBaseTx builds a v1 BaseTx into a fresh ZAP buffer. Memo may be nil.
|
||||
// NewBaseTx builds a v3 BaseTx into a fresh ZAP buffer. Memo may be nil.
|
||||
func NewBaseTx(networkID uint32, blockchainID ids.ID, memo []byte) BaseTx {
|
||||
b := zap.NewBuilder(zap.HeaderSize + 16 + SizeBaseTx + len(memo))
|
||||
ob := b.StartObject(SizeBaseTx)
|
||||
ob.SetUint8(OffsetTxKind, uint8(TxKindBase))
|
||||
ob.SetUint32(OffsetBaseTx_NetworkID, networkID)
|
||||
for i := 0; i < 32; i++ {
|
||||
ob.SetUint8(OffsetBaseTx_BlockchainID+i, blockchainID[i])
|
||||
|
||||
@@ -8,16 +8,21 @@ import (
|
||||
"github.com/luxfi/zap"
|
||||
)
|
||||
|
||||
// DisableL1ValidatorTx — ValidationID (ids.ID).
|
||||
// DisableL1ValidatorTx v3 schema — TxKind + ValidationID.
|
||||
//
|
||||
// Disables an L1 validator. The validator's stake is unbonded and removed
|
||||
// from the active set. Once disabled the validator can be re-registered
|
||||
// via a fresh RegisterL1ValidatorTx.
|
||||
//
|
||||
// Fixed-section layout (size 33 bytes):
|
||||
//
|
||||
// TxKind uint8 @ 0
|
||||
// ValidationID 32B @ 1
|
||||
const (
|
||||
SchemaVersionDisableL1ValidatorTx uint16 = 2
|
||||
SchemaVersionDisableL1ValidatorTx uint16 = 3
|
||||
|
||||
OffsetDisableL1ValidatorTx_ValidationID = 0 // 32 bytes
|
||||
SizeDisableL1ValidatorTx = 32
|
||||
OffsetDisableL1ValidatorTx_ValidationID = 1 // 32 bytes
|
||||
SizeDisableL1ValidatorTx = 33
|
||||
)
|
||||
|
||||
type DisableL1ValidatorTx struct {
|
||||
@@ -41,12 +46,17 @@ func WrapDisableL1ValidatorTx(b []byte) (DisableL1ValidatorTx, error) {
|
||||
if err != nil {
|
||||
return DisableL1ValidatorTx{}, err
|
||||
}
|
||||
return DisableL1ValidatorTx{msg: msg, obj: msg.Root()}, nil
|
||||
obj := msg.Root()
|
||||
if TxKind(obj.Uint8(OffsetTxKind)) != TxKindDisableL1Validator {
|
||||
return DisableL1ValidatorTx{}, ErrWrongTxKind
|
||||
}
|
||||
return DisableL1ValidatorTx{msg: msg, obj: obj}, nil
|
||||
}
|
||||
|
||||
func NewDisableL1ValidatorTx(validationID ids.ID) DisableL1ValidatorTx {
|
||||
b := zap.NewBuilder(zap.HeaderSize + 16 + SizeDisableL1ValidatorTx)
|
||||
ob := b.StartObject(SizeDisableL1ValidatorTx)
|
||||
ob.SetUint8(OffsetTxKind, uint8(TxKindDisableL1Validator))
|
||||
for i := 0; i < 32; i++ {
|
||||
ob.SetUint8(OffsetDisableL1ValidatorTx_ValidationID+i, validationID[i])
|
||||
}
|
||||
|
||||
@@ -8,16 +8,22 @@ import (
|
||||
"github.com/luxfi/zap"
|
||||
)
|
||||
|
||||
// IncreaseL1ValidatorBalanceTx — ValidationID (ids.ID) + Balance uint64.
|
||||
// IncreaseL1ValidatorBalanceTx v3 schema — TxKind + ValidationID + Balance.
|
||||
//
|
||||
// Tops up the continuous-fee balance for an L1 validator without changing
|
||||
// its stake weight or nonce.
|
||||
//
|
||||
// Fixed-section layout (size 41 bytes):
|
||||
//
|
||||
// TxKind uint8 @ 0
|
||||
// ValidationID 32B @ 1
|
||||
// Balance uint64 @ 33
|
||||
const (
|
||||
SchemaVersionIncreaseL1ValidatorBalanceTx uint16 = 2
|
||||
SchemaVersionIncreaseL1ValidatorBalanceTx uint16 = 3
|
||||
|
||||
OffsetIncreaseL1ValidatorBalanceTx_ValidationID = 0 // 32 bytes
|
||||
OffsetIncreaseL1ValidatorBalanceTx_Balance = 32 // uint64
|
||||
SizeIncreaseL1ValidatorBalanceTx = 40
|
||||
OffsetIncreaseL1ValidatorBalanceTx_ValidationID = 1 // 32 bytes
|
||||
OffsetIncreaseL1ValidatorBalanceTx_Balance = 33 // uint64
|
||||
SizeIncreaseL1ValidatorBalanceTx = 41
|
||||
)
|
||||
|
||||
type IncreaseL1ValidatorBalanceTx struct {
|
||||
@@ -45,12 +51,17 @@ func WrapIncreaseL1ValidatorBalanceTx(b []byte) (IncreaseL1ValidatorBalanceTx, e
|
||||
if err != nil {
|
||||
return IncreaseL1ValidatorBalanceTx{}, err
|
||||
}
|
||||
return IncreaseL1ValidatorBalanceTx{msg: msg, obj: msg.Root()}, nil
|
||||
obj := msg.Root()
|
||||
if TxKind(obj.Uint8(OffsetTxKind)) != TxKindIncreaseL1ValidatorBalance {
|
||||
return IncreaseL1ValidatorBalanceTx{}, ErrWrongTxKind
|
||||
}
|
||||
return IncreaseL1ValidatorBalanceTx{msg: msg, obj: obj}, nil
|
||||
}
|
||||
|
||||
func NewIncreaseL1ValidatorBalanceTx(validationID ids.ID, balance uint64) IncreaseL1ValidatorBalanceTx {
|
||||
b := zap.NewBuilder(zap.HeaderSize + 16 + SizeIncreaseL1ValidatorBalanceTx)
|
||||
ob := b.StartObject(SizeIncreaseL1ValidatorBalanceTx)
|
||||
ob.SetUint8(OffsetTxKind, uint8(TxKindIncreaseL1ValidatorBalance))
|
||||
for i := 0; i < 32; i++ {
|
||||
ob.SetUint8(OffsetIncreaseL1ValidatorBalanceTx_ValidationID+i, validationID[i])
|
||||
}
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
// Copyright (C) 2026, Lux Industries Inc. All rights reserved.
|
||||
// See the file LICENSE for licensing terms.
|
||||
|
||||
package zap_native
|
||||
|
||||
import "errors"
|
||||
|
||||
// TxKind is the 1-byte tx-type discriminator stored at offset 0 of every
|
||||
// zap_native tx's fixed section. Wrap*Tx functions verify the kind matches
|
||||
// the expected value before returning a typed accessor; constructors write
|
||||
// the kind unconditionally. This closes the cross-tx-type confusion surface
|
||||
// where an AdvanceTimeTx buffer could be Wrap'd as a BaseTx and return
|
||||
// garbage-but-deterministic field reads.
|
||||
//
|
||||
// Schema v3 lays out every fixed section with TxKind at offset 0; all other
|
||||
// fields shift by +1 byte vs v2. TxKind values are dense, never reused, and
|
||||
// 0 is reserved (rejected by Wrap*).
|
||||
type TxKind uint8
|
||||
|
||||
const (
|
||||
TxKindReserved TxKind = 0
|
||||
TxKindAdvanceTime TxKind = 1
|
||||
TxKindRewardValidator TxKind = 2
|
||||
TxKindSetL1ValidatorWeight TxKind = 3
|
||||
TxKindIncreaseL1ValidatorBalance TxKind = 4
|
||||
TxKindDisableL1Validator TxKind = 5
|
||||
TxKindBase TxKind = 6
|
||||
TxKindRegisterL1Validator TxKind = 7
|
||||
TxKindSlashValidator TxKind = 8
|
||||
TxKindTransferChainOwnership TxKind = 9
|
||||
TxKindRemoveChainValidator TxKind = 10
|
||||
)
|
||||
|
||||
// OffsetTxKind is the fixed wire position of the discriminator. Every
|
||||
// zap_native fixed section reserves byte 0 for TxKind.
|
||||
const OffsetTxKind = 0
|
||||
|
||||
// ErrWrongTxKind is returned by Wrap*Tx when the buffer's TxKind discriminator
|
||||
// does not match the expected tx type. Caller passed the wrong buffer to the
|
||||
// wrong wrapper — a cross-type confusion attempt or a dispatch bug.
|
||||
var ErrWrongTxKind = errors.New("zap_native: tx kind discriminator does not match expected tx type")
|
||||
@@ -9,25 +9,26 @@ import (
|
||||
"github.com/luxfi/zap"
|
||||
)
|
||||
|
||||
// RegisterL1ValidatorTx v1 schema — ValidationID + Signer (BLS pubkey + PoP) +
|
||||
// Expiry + RemainingBalanceOwnerID. The legacy struct's Message is a Warp
|
||||
// payload (variable-length addressed-call envelope) and RemainingBalanceOwner
|
||||
// is an OutputOwners with a variable AddressIDs list — both ship as proper
|
||||
// list/object schemas in batch 3. This v1 fixes the foundational identity
|
||||
// fields validators look up on every block.
|
||||
// RegisterL1ValidatorTx v3 schema — TxKind + ValidationID + Signer (BLS pubkey
|
||||
// + PoP) + Expiry + RemainingBalanceOwnerID. The legacy struct's Message is a
|
||||
// Warp payload (variable-length addressed-call envelope) and
|
||||
// RemainingBalanceOwner is an OutputOwners with a variable AddressIDs list —
|
||||
// both ship as proper list/object schemas in batch 3. This v3 fixes the
|
||||
// foundational identity fields validators look up on every block.
|
||||
//
|
||||
// Fixed-section layout (size 192 bytes):
|
||||
// Fixed-section layout (size 217 bytes):
|
||||
//
|
||||
// ValidationID 32B @ 0
|
||||
// BLSPublicKey 48B @ 32 (bls.PublicKeyLen)
|
||||
// ProofOfPossession 96B @ 80 (bls.SignatureLen)
|
||||
// Expiry uint64 @ 176
|
||||
// RemainingBalanceOwnerID ids.ID @ 184 (placeholder 32B, full Owner in batch 3)
|
||||
// TxKind uint8 @ 0
|
||||
// ValidationID 32B @ 1
|
||||
// BLSPublicKey 48B @ 33 (bls.PublicKeyLen)
|
||||
// ProofOfPossession 96B @ 81 (bls.SignatureLen)
|
||||
// Expiry uint64 @ 177
|
||||
// RemainingBalanceOwnerID ids.ID @ 185 (placeholder 32B, full Owner in batch 3)
|
||||
const (
|
||||
SchemaVersionRegisterL1ValidatorTx uint16 = 2
|
||||
SchemaVersionRegisterL1ValidatorTx uint16 = 3
|
||||
|
||||
OffsetRegisterL1ValidatorTx_ValidationID = 0
|
||||
OffsetRegisterL1ValidatorTx_BLSPublicKey = 32
|
||||
OffsetRegisterL1ValidatorTx_ValidationID = 1
|
||||
OffsetRegisterL1ValidatorTx_BLSPublicKey = OffsetRegisterL1ValidatorTx_ValidationID + 32
|
||||
OffsetRegisterL1ValidatorTx_ProofOfPossession = OffsetRegisterL1ValidatorTx_BLSPublicKey + bls.PublicKeyLen
|
||||
OffsetRegisterL1ValidatorTx_Expiry = OffsetRegisterL1ValidatorTx_ProofOfPossession + bls.SignatureLen
|
||||
OffsetRegisterL1ValidatorTx_RemainingBalanceOwnerID = OffsetRegisterL1ValidatorTx_Expiry + 8
|
||||
@@ -72,7 +73,7 @@ func (t RegisterL1ValidatorTx) Expiry() uint64 {
|
||||
return t.obj.Uint64(OffsetRegisterL1ValidatorTx_Expiry)
|
||||
}
|
||||
|
||||
// RemainingBalanceOwnerID is a v1 placeholder for the OutputOwners pointer.
|
||||
// RemainingBalanceOwnerID is a v3 placeholder for the OutputOwners pointer.
|
||||
// Batch 3 replaces this with a full OutputOwners nested-object schema
|
||||
// (threshold + AddressIDs list).
|
||||
func (t RegisterL1ValidatorTx) RemainingBalanceOwnerID() ids.ID {
|
||||
@@ -91,7 +92,11 @@ func WrapRegisterL1ValidatorTx(b []byte) (RegisterL1ValidatorTx, error) {
|
||||
if err != nil {
|
||||
return RegisterL1ValidatorTx{}, err
|
||||
}
|
||||
return RegisterL1ValidatorTx{msg: msg, obj: msg.Root()}, nil
|
||||
obj := msg.Root()
|
||||
if TxKind(obj.Uint8(OffsetTxKind)) != TxKindRegisterL1Validator {
|
||||
return RegisterL1ValidatorTx{}, ErrWrongTxKind
|
||||
}
|
||||
return RegisterL1ValidatorTx{msg: msg, obj: obj}, nil
|
||||
}
|
||||
|
||||
func NewRegisterL1ValidatorTx(
|
||||
@@ -103,6 +108,7 @@ func NewRegisterL1ValidatorTx(
|
||||
) RegisterL1ValidatorTx {
|
||||
b := zap.NewBuilder(zap.HeaderSize + 16 + SizeRegisterL1ValidatorTx)
|
||||
ob := b.StartObject(SizeRegisterL1ValidatorTx)
|
||||
ob.SetUint8(OffsetTxKind, uint8(TxKindRegisterL1Validator))
|
||||
for i := 0; i < 32; i++ {
|
||||
ob.SetUint8(OffsetRegisterL1ValidatorTx_ValidationID+i, validationID[i])
|
||||
}
|
||||
|
||||
@@ -8,22 +8,23 @@ import (
|
||||
"github.com/luxfi/zap"
|
||||
)
|
||||
|
||||
// RemoveChainValidatorTx v1 schema — NodeID (20B) + Subnet (32B).
|
||||
// RemoveChainValidatorTx v3 schema — TxKind + NodeID (20B) + Network (32B).
|
||||
//
|
||||
// Legacy struct also has ChainAuth (verify.Verifiable credential) which lives
|
||||
// outside the unsigned-tx bytes in the signed wrapper — the unsigned encoding
|
||||
// here pins only the identity tuple the executor matches against state.
|
||||
//
|
||||
// Fixed-section layout (size 52 bytes):
|
||||
// Fixed-section layout (size 53 bytes):
|
||||
//
|
||||
// NodeID 20B @ 0 (ids.NodeID)
|
||||
// Subnet 32B @ 20 (ids.ID)
|
||||
// TxKind uint8 @ 0
|
||||
// NodeID 20B @ 1 (ids.NodeID)
|
||||
// Network 32B @ 21 (ids.ID)
|
||||
const (
|
||||
SchemaVersionRemoveChainValidatorTx uint16 = 2
|
||||
SchemaVersionRemoveChainValidatorTx uint16 = 3
|
||||
|
||||
OffsetRemoveChainValidatorTx_NodeID = 0
|
||||
OffsetRemoveChainValidatorTx_Subnet = ids.ShortIDLen
|
||||
SizeRemoveChainValidatorTx = OffsetRemoveChainValidatorTx_Subnet + 32
|
||||
OffsetRemoveChainValidatorTx_NodeID = 1
|
||||
OffsetRemoveChainValidatorTx_Network = OffsetRemoveChainValidatorTx_NodeID + ids.ShortIDLen
|
||||
SizeRemoveChainValidatorTx = OffsetRemoveChainValidatorTx_Network + 32
|
||||
)
|
||||
|
||||
type RemoveChainValidatorTx struct {
|
||||
@@ -39,10 +40,11 @@ func (t RemoveChainValidatorTx) NodeID() ids.NodeID {
|
||||
return out
|
||||
}
|
||||
|
||||
func (t RemoveChainValidatorTx) Subnet() ids.ID {
|
||||
// Network returns the L1 network ID (32B) the validator belongs to.
|
||||
func (t RemoveChainValidatorTx) Network() ids.ID {
|
||||
var out ids.ID
|
||||
for i := 0; i < 32; i++ {
|
||||
out[i] = t.obj.Uint8(OffsetRemoveChainValidatorTx_Subnet + i)
|
||||
out[i] = t.obj.Uint8(OffsetRemoveChainValidatorTx_Network + i)
|
||||
}
|
||||
return out
|
||||
}
|
||||
@@ -55,17 +57,22 @@ func WrapRemoveChainValidatorTx(b []byte) (RemoveChainValidatorTx, error) {
|
||||
if err != nil {
|
||||
return RemoveChainValidatorTx{}, err
|
||||
}
|
||||
return RemoveChainValidatorTx{msg: msg, obj: msg.Root()}, nil
|
||||
obj := msg.Root()
|
||||
if TxKind(obj.Uint8(OffsetTxKind)) != TxKindRemoveChainValidator {
|
||||
return RemoveChainValidatorTx{}, ErrWrongTxKind
|
||||
}
|
||||
return RemoveChainValidatorTx{msg: msg, obj: obj}, nil
|
||||
}
|
||||
|
||||
func NewRemoveChainValidatorTx(nodeID ids.NodeID, subnet ids.ID) RemoveChainValidatorTx {
|
||||
func NewRemoveChainValidatorTx(nodeID ids.NodeID, network ids.ID) RemoveChainValidatorTx {
|
||||
b := zap.NewBuilder(zap.HeaderSize + 16 + SizeRemoveChainValidatorTx)
|
||||
ob := b.StartObject(SizeRemoveChainValidatorTx)
|
||||
ob.SetUint8(OffsetTxKind, uint8(TxKindRemoveChainValidator))
|
||||
for i := 0; i < ids.ShortIDLen; i++ {
|
||||
ob.SetUint8(OffsetRemoveChainValidatorTx_NodeID+i, nodeID[i])
|
||||
}
|
||||
for i := 0; i < 32; i++ {
|
||||
ob.SetUint8(OffsetRemoveChainValidatorTx_Subnet+i, subnet[i])
|
||||
ob.SetUint8(OffsetRemoveChainValidatorTx_Network+i, network[i])
|
||||
}
|
||||
ob.FinishAsRoot()
|
||||
msg, _ := zap.Parse(b.Finish())
|
||||
|
||||
@@ -8,14 +8,14 @@ import (
|
||||
"github.com/luxfi/zap"
|
||||
)
|
||||
|
||||
// RewardValidatorTx — single 32-byte TxID field.
|
||||
// RewardValidatorTx v3 schema — TxKind + 32-byte TxID.
|
||||
// Issued by the chain at the end of every validator's stake period to
|
||||
// distribute the reward.
|
||||
const (
|
||||
SchemaVersionRewardValidatorTx uint16 = 2
|
||||
SchemaVersionRewardValidatorTx uint16 = 3
|
||||
|
||||
OffsetRewardValidatorTx_TxID = 0 // ids.ID (32 bytes)
|
||||
SizeRewardValidatorTx = 32
|
||||
OffsetRewardValidatorTx_TxID = 1 // ids.ID (32 bytes), after TxKind@0
|
||||
SizeRewardValidatorTx = 33
|
||||
)
|
||||
|
||||
type RewardValidatorTx struct {
|
||||
@@ -39,12 +39,17 @@ func WrapRewardValidatorTx(b []byte) (RewardValidatorTx, error) {
|
||||
if err != nil {
|
||||
return RewardValidatorTx{}, err
|
||||
}
|
||||
return RewardValidatorTx{msg: msg, obj: msg.Root()}, nil
|
||||
obj := msg.Root()
|
||||
if TxKind(obj.Uint8(OffsetTxKind)) != TxKindRewardValidator {
|
||||
return RewardValidatorTx{}, ErrWrongTxKind
|
||||
}
|
||||
return RewardValidatorTx{msg: msg, obj: obj}, nil
|
||||
}
|
||||
|
||||
func NewRewardValidatorTx(txID ids.ID) RewardValidatorTx {
|
||||
b := zap.NewBuilder(zap.HeaderSize + 16 + SizeRewardValidatorTx)
|
||||
ob := b.StartObject(SizeRewardValidatorTx)
|
||||
ob.SetUint8(OffsetTxKind, uint8(TxKindRewardValidator))
|
||||
for i := 0; i < 32; i++ {
|
||||
ob.SetUint8(OffsetRewardValidatorTx_TxID+i, txID[i])
|
||||
}
|
||||
|
||||
@@ -0,0 +1,922 @@
|
||||
// Copyright (C) 2026, Lux Industries Inc. All rights reserved.
|
||||
// See the file LICENSE for licensing terms.
|
||||
|
||||
// Adversarial security tests for LP-023 Phase 1 batch 2.
|
||||
//
|
||||
// One test per attack vector probed against the native-ZAP tx accessors. Each
|
||||
// test name follows the convention TestRed_<vector>; failing tests indicate
|
||||
// either (a) a real defense gap that needs Blue rework, or (b) the test
|
||||
// captures the attack and demonstrates the defense (passing).
|
||||
//
|
||||
// Methodology: feed crafted ZAP buffers directly through Wrap*/Parse and
|
||||
// observe what the accessors return. If a malformed buffer is rejected at
|
||||
// Parse, the defense is at the wire layer. If Parse succeeds but accessors
|
||||
// return zero / nil (silent failure mode of the ZAP Object methods), the
|
||||
// defense relies on the executor catching invariants — this layered defense
|
||||
// is documented in each test.
|
||||
//
|
||||
// Cross-references to executor-layer defenses are noted inline. The wire
|
||||
// layer (this package) is conservative: it never panics, never reads OOB,
|
||||
// and never returns sentinel-corrupt values that look like data. A few
|
||||
// known ambiguities (nil vs []byte{} Memo, relOffset malleability) are
|
||||
// captured as INFO-level findings.
|
||||
|
||||
package zap_native
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/binary"
|
||||
"runtime"
|
||||
"sync"
|
||||
"testing"
|
||||
|
||||
"github.com/luxfi/crypto/bls"
|
||||
"github.com/luxfi/ids"
|
||||
"github.com/luxfi/zap"
|
||||
)
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V1 — Crafted-offset OOB read.
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: a buffer where zap.Parse succeeds (16-byte header validates) but is
|
||||
// shorter than HeaderSize + 16 + SizeXxxTx. Reading SlashPercentage at offset
|
||||
// 52 of a 16-byte buffer should not OOB-read.
|
||||
//
|
||||
// Observed defense (zap/zap.go::Object.Uint32):
|
||||
//
|
||||
// if pos+4 > len(o.msg.data) { return 0 }
|
||||
//
|
||||
// All Uint8/16/32/64 accessors apply this bounds check. So a too-small buffer
|
||||
// produces silently-zero field reads — no crash, no OOB. The downstream
|
||||
// executor catches the resulting all-zero field state (e.g. SlashPercentage=0
|
||||
// !∈ {100_000, 500_000} fails the enum check in slash_validator_tx_executor.go).
|
||||
//
|
||||
// Result: PASS — wire-layer defense holds. Documented layered defense.
|
||||
|
||||
func TestRed_V1_CraftedOffsetOOBRead(t *testing.T) {
|
||||
// Build a minimal valid SlashValidatorTx, then truncate the payload so the
|
||||
// buffer is just header + a few bytes — too small for the full 56-byte
|
||||
// fixed section.
|
||||
tx := NewSlashValidatorTx(ids.NodeID{1}, ids.ID{2}, 100_000)
|
||||
full := tx.Bytes()
|
||||
|
||||
// Construct a fraudulent buffer: copy header, claim size = HeaderSize+8,
|
||||
// pad to that length. zap.Parse will accept it (magic ok, version ok,
|
||||
// size <= len). Accessors should return 0 for OOB reads.
|
||||
short := make([]byte, zap.HeaderSize+8)
|
||||
copy(short, full[:zap.HeaderSize])
|
||||
// Overwrite the embedded size field to claim the truncated length.
|
||||
binary.LittleEndian.PutUint32(short[12:16], uint32(len(short)))
|
||||
// Set root offset to point into the truncated data segment.
|
||||
binary.LittleEndian.PutUint32(short[8:12], uint32(zap.HeaderSize))
|
||||
|
||||
tx2, err := WrapSlashValidatorTx(short)
|
||||
if err != nil {
|
||||
// zap.Parse may reject. That's fine — wire-layer defense.
|
||||
t.Logf("V1: zap.Parse rejected truncated buffer: %v (wire-layer defense)", err)
|
||||
return
|
||||
}
|
||||
// If Parse accepted, accessors must not OOB-read; they should return 0.
|
||||
if got := tx2.SlashPercentage(); got != 0 {
|
||||
t.Fatalf("V1: SlashPercentage on truncated buffer = %d, want 0 (silent OOB fallback)", got)
|
||||
}
|
||||
if got := tx2.NodeID(); got != (ids.NodeID{}) {
|
||||
t.Fatalf("V1: NodeID on truncated buffer = %v, want zero (silent OOB fallback)", got)
|
||||
}
|
||||
// Defense-in-depth: executor enum check would reject SlashPercentage=0.
|
||||
// See vms/platformvm/txs/executor/slash_validator_tx_executor.go:46.
|
||||
t.Logf("V1 defense verified: truncated buffer → silently-zero accessor → executor enum check rejects")
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V2 — Memo pointer escape via negative relative offset.
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: zap/zap.go::Object.Bytes parses relOffset as int32. A negative
|
||||
// relOffset is mathematically valid and the bounds check only validates the
|
||||
// FINAL absolute position. An attacker can craft a Memo whose relOffset
|
||||
// points BACK into the fixed section, causing Memo() to alias bytes of
|
||||
// NetworkID / BlockchainID — intra-buffer aliasing.
|
||||
//
|
||||
// Concrete attack: craft a BaseTx where Memo's relOffset = -8 and length = 4.
|
||||
// Memo() returns 4 bytes drawn from the NetworkID field's underlying bytes.
|
||||
//
|
||||
// Impact analysis: the tx is broadcast publicly; nothing in the buffer is
|
||||
// secret. The encoded value of NetworkID is wire-public. So this is NOT a
|
||||
// confidentiality leak. It IS a malleability surface: two distinct buffer
|
||||
// encodings exist for "logical tx with NetworkID=1337 + Memo=A". After
|
||||
// TxID integration (later batch), hash(buf1) != hash(buf2). For this
|
||||
// package (wire-only batch 2), the malleability is dormant.
|
||||
//
|
||||
// Result: PASS captures the attack; documents the deferred-impact finding.
|
||||
|
||||
func TestRed_V2_MemoPointerEscapeNegativeOffset(t *testing.T) {
|
||||
// Build a canonical BaseTx.
|
||||
tx := NewBaseTx(0xDEADBEEF, ids.ID{0xCA, 0xFE}, []byte("normal"))
|
||||
buf := append([]byte(nil), tx.Bytes()...)
|
||||
|
||||
// Find Memo's (relOffset, length) field at root + OffsetBaseTx_Memo (36).
|
||||
root := int(binary.LittleEndian.Uint32(buf[8:12]))
|
||||
memoFieldPos := root + OffsetBaseTx_Memo
|
||||
|
||||
// Craft a negative relOffset that points back into NetworkID (offset 0).
|
||||
// memoFieldPos is the absolute position of Memo's relOffset cell.
|
||||
// NetworkID is at absolute position `root`.
|
||||
// relOffset needed = root - memoFieldPos = -OffsetBaseTx_Memo = -36.
|
||||
negRel := int32(-OffsetBaseTx_Memo)
|
||||
binary.LittleEndian.PutUint32(buf[memoFieldPos:], uint32(negRel))
|
||||
binary.LittleEndian.PutUint32(buf[memoFieldPos+4:], 4) // length = 4
|
||||
|
||||
tx2, err := WrapBaseTx(buf)
|
||||
if err != nil {
|
||||
t.Fatalf("V2: Wrap rejected malleable buffer (would be a wire-layer defense): %v", err)
|
||||
}
|
||||
|
||||
memo := tx2.Memo()
|
||||
if memo == nil {
|
||||
// Wire-layer bounds check rejected the negative offset. Acceptable.
|
||||
t.Logf("V2 defense: negative-relOffset Memo bounds-checked to nil. Defense holds at wire layer.")
|
||||
return
|
||||
}
|
||||
// If memo is non-nil, it aliases bytes from inside the fixed section.
|
||||
// This proves intra-buffer pointer escape works.
|
||||
wantNet := uint32(0xDEADBEEF)
|
||||
netBytes := make([]byte, 4)
|
||||
binary.LittleEndian.PutUint32(netBytes, wantNet)
|
||||
if !bytes.Equal(memo, netBytes) {
|
||||
t.Logf("V2 informational: Memo() returned %x; NetworkID bytes %x. Malleability path live but not exact alias.", memo, netBytes)
|
||||
} else {
|
||||
t.Logf("V2 CONFIRMED: Memo() aliased NetworkID bytes %x. Malleability surface confirmed. Impact: deferred to TxID integration (no executor impact yet — VerifyMemoFieldLength rejects non-empty memos in Durango).", memo)
|
||||
}
|
||||
// Both outcomes are documented; test does not fail (this is wire-layer
|
||||
// behavior; impact lives in the integration layer).
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V3 — SetBytes(nil) vs SetBytes([]byte{}) round-trip semantics.
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: builder.go::SetBytes treats both nil and empty slice identically
|
||||
// — writes (offset=0, length=0). Reader.Bytes() sees relOffset==0 and returns
|
||||
// nil for both. Round-trip is lossy but consistent: nil↔nil and []byte{}↔nil.
|
||||
//
|
||||
// Wire-format implication: the bytes for "nil memo" and "empty memo" are
|
||||
// identical. TxID(nil-memo-tx) == TxID(empty-memo-tx) — which is actually
|
||||
// GOOD for canonicalization (no malleability through nil/empty distinction).
|
||||
//
|
||||
// Result: PASS — documented behavior. INFO-level finding.
|
||||
|
||||
func TestRed_V3_NilVsEmptyMemoRoundTrip(t *testing.T) {
|
||||
a := NewBaseTx(1, ids.ID{1}, nil)
|
||||
b := NewBaseTx(1, ids.ID{1}, []byte{})
|
||||
if !bytes.Equal(a.Bytes(), b.Bytes()) {
|
||||
t.Fatalf("V3: nil-memo and empty-memo produced different bytes: lossy ambiguity")
|
||||
}
|
||||
if a.Memo() != nil || b.Memo() != nil {
|
||||
t.Fatalf("V3: empty-memo round-trip returned non-nil slice")
|
||||
}
|
||||
t.Logf("V3 verified: SetBytes(nil) and SetBytes([]byte{}) produce identical wire form; both Memo()→nil. Lossy but canonical — safe for TxID stability.")
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V4 — Size-mismatch schema drift (offset arithmetic vs declared Size).
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: SizeXxxTx must equal the sum of field sizes. A drift means
|
||||
// accessors read past the declared boundary.
|
||||
//
|
||||
// Verification: compute the implied size from the highest-offset field + that
|
||||
// field's width and compare to the declared SizeXxxTx constant.
|
||||
//
|
||||
// v3 layout (TxKind@0 shifts every other field by +1):
|
||||
// - SizeBaseTx = 45 (Memo@37+8). ✓
|
||||
// - SizeRegisterL1ValidatorTx = 217 (RemainingBalanceOwnerID@185+32). ✓
|
||||
// - SizeSlashValidatorTx = 57 (SlashPercentage@53+4). ✓
|
||||
// - SizeTransferChainOwnershipTx = 69 (OwnerAddress@49+20, no padding). ✓
|
||||
// - SizeRemoveChainValidatorTx = 53 (Network@21+32). ✓
|
||||
|
||||
func TestRed_V4_SchemaSizeMatchesOffsetArithmetic(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
lastFieldOffset int
|
||||
lastFieldWidth int
|
||||
declaredSize int
|
||||
}{
|
||||
{"BaseTx", OffsetBaseTx_Memo, 8, SizeBaseTx},
|
||||
{
|
||||
"RegisterL1ValidatorTx",
|
||||
OffsetRegisterL1ValidatorTx_RemainingBalanceOwnerID, 32,
|
||||
SizeRegisterL1ValidatorTx,
|
||||
},
|
||||
{"SlashValidatorTx", OffsetSlashValidatorTx_SlashPercentage, 4, SizeSlashValidatorTx},
|
||||
{
|
||||
"TransferChainOwnershipTx",
|
||||
OffsetTransferChainOwnershipTx_OwnerAddress, ids.ShortIDLen,
|
||||
SizeTransferChainOwnershipTx,
|
||||
},
|
||||
{"RemoveChainValidatorTx", OffsetRemoveChainValidatorTx_Network, 32, SizeRemoveChainValidatorTx},
|
||||
}
|
||||
for _, c := range cases {
|
||||
c := c
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
implied := c.lastFieldOffset + c.lastFieldWidth
|
||||
if implied != c.declaredSize {
|
||||
t.Fatalf("V4: %s declared size %d but last-field arithmetic = %d",
|
||||
c.name, c.declaredSize, implied)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V5 — BLS-key opaque storage (layered defense contract).
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: an attacker submits a RegisterL1ValidatorTx with garbage bytes in
|
||||
// the BLS PublicKey and ProofOfPossession fields. Wire layer stores opaque
|
||||
// 48-byte and 96-byte chunks; round-trip succeeds. Executor MUST validate
|
||||
// the BLS structure before accepting the validator.
|
||||
//
|
||||
// Wire defense: NONE — by design. BLS point validity is not a wire-format
|
||||
// property; checking it would couple the wire layer to BLS internals.
|
||||
//
|
||||
// Executor defense (verified in standard_tx_executor.go:847):
|
||||
//
|
||||
// pop := signer.ProofOfPossession{PublicKey: ..., ProofOfPossession: ...}
|
||||
// if err := pop.Verify(); err != nil { return err }
|
||||
//
|
||||
// Result: PASS — documented layered contract.
|
||||
|
||||
func TestRed_V5_BLSGarbageRoundTripsButExecutorMustValidate(t *testing.T) {
|
||||
var garbageKey [bls.PublicKeyLen]byte
|
||||
for i := range garbageKey {
|
||||
garbageKey[i] = 0xff
|
||||
}
|
||||
var garbagePoP [bls.SignatureLen]byte
|
||||
for i := range garbagePoP {
|
||||
garbagePoP[i] = 0xff
|
||||
}
|
||||
tx := NewRegisterL1ValidatorTx(ids.ID{1}, garbageKey, garbagePoP, 1, ids.ID{2})
|
||||
|
||||
tx2, err := WrapRegisterL1ValidatorTx(tx.Bytes())
|
||||
if err != nil {
|
||||
t.Fatalf("V5: garbage BLS round-trip rejected at wire layer (unexpected): %v", err)
|
||||
}
|
||||
if tx2.BLSPublicKey() != garbageKey || tx2.ProofOfPossession() != garbagePoP {
|
||||
t.Fatalf("V5: garbage BLS bytes not round-tripped — wire layer modified opaque storage")
|
||||
}
|
||||
t.Logf("V5 verified: wire layer is opaque-bytes-only. Executor layered defense at standard_tx_executor.go:847 (pop.Verify()) MUST reject. Contract documented.")
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V6 — Alignment behavior.
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: strict-alignment architectures (some ARMv7, MIPS, SPARC) SIGBUS on
|
||||
// unaligned uint64 reads. ZAP encodes little-endian using binary.LittleEndian
|
||||
// which performs byte-by-byte assembly — alignment-tolerant by construction.
|
||||
//
|
||||
// Wire-format defense: zap.Builder.StartObject calls b.align(Alignment) where
|
||||
// Alignment=8. Object starts at an 8-aligned absolute offset. Uint64 fields
|
||||
// at offset-multiple-of-8 within the object are then naturally aligned to
|
||||
// 8 in the buffer.
|
||||
//
|
||||
// Verification: read all 32 uint64 candidates from each tx type and verify
|
||||
// no panic on the supported platforms (linux/amd64, linux/arm64, darwin/arm64).
|
||||
|
||||
func TestRed_V6_AlignmentTolerance(t *testing.T) {
|
||||
t.Logf("V6 platform: %s/%s", runtime.GOOS, runtime.GOARCH)
|
||||
|
||||
atx := NewAdvanceTimeTx(0xDEADBEEFCAFEBABE)
|
||||
stx := NewSetL1ValidatorWeightTx(ids.ID{1}, 0xAA55_AA55_AA55_AA55, 0x5AA5_5AA5_5AA5_5AA5)
|
||||
itx := NewIncreaseL1ValidatorBalanceTx(ids.ID{1}, 0x1234_5678_9ABC_DEF0)
|
||||
regTx := NewRegisterL1ValidatorTx(ids.ID{1}, [bls.PublicKeyLen]byte{}, [bls.SignatureLen]byte{},
|
||||
0xFFFF_FFFF_FFFF_FFFF, ids.ID{2})
|
||||
tcoTx := NewTransferChainOwnershipTx(ids.ID{1}, 1, 0xABCD_EF12_3456_789A, ids.ShortID{1})
|
||||
|
||||
// Read all uint64-bearing fields; alignment-intolerant code would crash.
|
||||
_ = atx.Time()
|
||||
_ = stx.Nonce()
|
||||
_ = stx.Weight()
|
||||
_ = itx.Balance()
|
||||
_ = regTx.Expiry()
|
||||
_ = tcoTx.OwnerLocktime()
|
||||
t.Logf("V6 verified: all uint64 fields readable on %s/%s — Builder.align(8) on StartObject keeps offsets natural-aligned",
|
||||
runtime.GOOS, runtime.GOARCH)
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V7 — Buffer mutation via aliased Memo() slice (Blue's LOW flag).
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: Memo() returns o.obj.Bytes(...) which is a slice that aliases the
|
||||
// underlying ZAP buffer. A caller writing to it mutates the canonical bytes.
|
||||
// This breaks "TxID = hash(buffer)" if computed AFTER a mutation.
|
||||
//
|
||||
// Wire defense: documented in base_tx.go:51 — "Callers MUST NOT mutate it".
|
||||
// No defensive copy.
|
||||
//
|
||||
// Practical defense: mutation is detectable. We test that mutation IS possible
|
||||
// (demonstrates the footgun) and document the contract. Callers must respect
|
||||
// the read-only contract.
|
||||
|
||||
func TestRed_V7_MemoMutationAliasesBuffer(t *testing.T) {
|
||||
memo := []byte("canary")
|
||||
tx := NewBaseTx(1, ids.ID{1}, memo)
|
||||
|
||||
m1 := tx.Memo()
|
||||
if len(m1) == 0 {
|
||||
t.Fatal("V7: Memo returned empty slice for non-empty source")
|
||||
}
|
||||
// Mutate the returned slice.
|
||||
originalFirstByte := m1[0]
|
||||
m1[0] = 0xFF
|
||||
|
||||
m2 := tx.Memo()
|
||||
if m2[0] != 0xFF {
|
||||
// If Memo were a defensive copy, m2 would still be 0x63 ('c'). The
|
||||
// fact that m2 reflects m1's mutation proves aliasing.
|
||||
t.Logf("V7 NOTE: Memo() appears to defensively copy. First byte after mutation: %x (expected 0xff if aliasing).", m2[0])
|
||||
return
|
||||
}
|
||||
|
||||
// Aliasing confirmed. The buffer itself is also mutated.
|
||||
bufBytes := tx.Bytes()
|
||||
foundCanary := false
|
||||
for i := 0; i < len(bufBytes)-1; i++ {
|
||||
if bufBytes[i] == 0xFF && i > 0 && bufBytes[i-1] == 0 {
|
||||
// Found the mutated 0xff byte in the buffer.
|
||||
foundCanary = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !foundCanary {
|
||||
t.Logf("V7: Memo mutation reflected in m2 but not visible at buffer scan position (still proves aliasing via m2)")
|
||||
}
|
||||
t.Logf("V7 CONFIRMED footgun: Memo() aliases buffer. originalFirstByte=%x mutated→%x. Contract requires callers to not mutate. Defensive-copy would allocate (defeats zero-alloc). RECOMMEND: comment escalation + linter rule.",
|
||||
originalFirstByte, m1[0])
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V8 — Variable-memo build with multi-MB inputs (memory exhaustion).
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: zap.Builder.grow doubles capacity unbounded. NewBaseTx with a
|
||||
// 16MB memo pre-sizes the buffer correctly (no growth), but a builder
|
||||
// receiving a 16MB SetBytes after initial allocation would double from
|
||||
// 32MB to 64MB on first write, then to 128MB on next overflow. No upper
|
||||
// bound enforced.
|
||||
//
|
||||
// However, the platformvm executor enforces tx size limits via the codec
|
||||
// MaxMessageLen (validated in tx_mempool_verifier and codec.Manager).
|
||||
// Additionally, VerifyMemoFieldLength in current activation REQUIRES
|
||||
// memo to be EMPTY post-Durango — non-empty memos fail execution.
|
||||
//
|
||||
// Wire defense: none — by design (wire is dumb).
|
||||
// Executor defense: ErrMemoTooLarge (memo must be empty in current activation).
|
||||
//
|
||||
// Result: PASS — documents the layered contract and the executor caps.
|
||||
|
||||
func TestRed_V8_LargeMemoBuildDoesNotPanic(t *testing.T) {
|
||||
// 1MB memo (representative — full 16MB would dominate test runtime).
|
||||
memo := make([]byte, 1<<20)
|
||||
for i := range memo {
|
||||
memo[i] = byte(i)
|
||||
}
|
||||
tx := NewBaseTx(1, ids.ID{1}, memo)
|
||||
got := tx.Memo()
|
||||
if len(got) != len(memo) {
|
||||
t.Fatalf("V8: large-memo round-trip got len=%d, want %d", len(got), len(memo))
|
||||
}
|
||||
// Confirm wire layer accepts. Executor will reject via VerifyMemoFieldLength.
|
||||
t.Logf("V8 verified: wire layer accepts %d-byte memo without panic. Executor enforces 0-byte memo via VerifyMemoFieldLength in lux/base_tx.go:72 (current activation).", len(memo))
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V9 — SlashPercentage wire-vs-executor cap.
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: wire admits SlashPercentage = 0xFFFFFFFF; executor must cap.
|
||||
//
|
||||
// Executor defense (verified in slash_validator_tx_executor.go:46):
|
||||
//
|
||||
// if tx.SlashPercentage != expectedPercent {
|
||||
// return errSlashPercentMismatch
|
||||
// }
|
||||
//
|
||||
// Where expectedPercent is the enum constant 100_000 (10%) or 500_000 (50%)
|
||||
// from evidence type. The check is STRICT EQUALITY — any value not exactly
|
||||
// matching one of two whitelisted percentages is rejected.
|
||||
//
|
||||
// Defense-in-depth on overflow: slash_overflow_test.go::TestHIGH2_SlashAmountNoOverflow
|
||||
// proves the arithmetic (weight/denom)*pct + (weight%denom)*pct/denom is
|
||||
// overflow-safe even for weight = MaxUint64.
|
||||
//
|
||||
// Result: PASS — full layered defense.
|
||||
|
||||
func TestRed_V9_SlashPercentageWireAdmits0xFFFFFFFF(t *testing.T) {
|
||||
tx := NewSlashValidatorTx(ids.NodeID{1}, ids.ID{2}, 0xFFFFFFFF)
|
||||
if got := tx.SlashPercentage(); got != 0xFFFFFFFF {
|
||||
t.Fatalf("V9: wire layer rejected 0xFFFFFFFF; expected admission with executor catching it. got=%d", got)
|
||||
}
|
||||
t.Logf("V9 verified: wire admits 0xFFFFFFFF SlashPercentage. Executor (slash_validator_tx_executor.go:46) requires strict equality with whitelisted enum (100_000 | 500_000) — rejects anything else. Overflow safe arithmetic also verified in slash_overflow_test.go.")
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V10 — TransferChainOwnership multi-address Owner.
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: real fx.OutputOwners can carry N addresses + threshold. Blue's v1
|
||||
// schema pins single-address (threshold=1, locktime, one Address). If a real
|
||||
// 2-of-3 Owner is being represented, the wire schema CANNOT encode it.
|
||||
//
|
||||
// Constructor signature: NewTransferChainOwnershipTx(chain, threshold, locktime, address ids.ShortID).
|
||||
// Only a single address can be passed. There is NO silent fallback path —
|
||||
// the caller is forced to pick one address. Multi-address callers MUST go
|
||||
// through LUXD_ENABLE_LEGACY_CODEC (per the file header comment).
|
||||
//
|
||||
// Wire defense: type system. ids.ShortID is a single address, not a slice.
|
||||
// Compile-time guarantee — no silent fallback possible.
|
||||
//
|
||||
// Result: PASS — defense-by-typesystem confirmed.
|
||||
|
||||
func TestRed_V10_TransferChainOwnershipIsCompileTimeSingleAddress(t *testing.T) {
|
||||
// Verify the constructor's address parameter is ids.ShortID (single addr),
|
||||
// not []ids.ShortID. We can only construct with one address.
|
||||
tx := NewTransferChainOwnershipTx(ids.ID{1}, 1, 0, ids.ShortID{0xAA})
|
||||
if tx.OwnerAddress() != (ids.ShortID{0xAA}) {
|
||||
t.Fatalf("V10: single-address Owner round-trip mismatch")
|
||||
}
|
||||
if tx.OwnerThreshold() != 1 {
|
||||
t.Fatalf("V10: threshold round-trip mismatch")
|
||||
}
|
||||
t.Logf("V10 verified: constructor signature enforces single-address Owner at compile time. Multi-address callers must use legacy codec (LUXD_ENABLE_LEGACY_CODEC=1) — no silent fallback path exists.")
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V11 — TxID determinism: Wrap(buf).Bytes() == buf.
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: re-wrapping a buffer should return identical bytes. Otherwise
|
||||
// TxID = hash(Wrap(buf).Bytes()) would diverge from hash(buf).
|
||||
//
|
||||
// Verification: ptr identity (Bytes() returns the same backing array, not a
|
||||
// copy).
|
||||
|
||||
func TestRed_V11_BytesReturnIdenticalAfterRewrap(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
buf []byte
|
||||
}{
|
||||
{"AdvanceTimeTx", NewAdvanceTimeTx(42).Bytes()},
|
||||
{"BaseTx", NewBaseTx(1337, ids.ID{1}, []byte("memo")).Bytes()},
|
||||
{"RewardValidatorTx", NewRewardValidatorTx(ids.ID{1}).Bytes()},
|
||||
{"SlashValidatorTx", NewSlashValidatorTx(ids.NodeID{1}, ids.ID{2}, 100_000).Bytes()},
|
||||
{"RegisterL1ValidatorTx", NewRegisterL1ValidatorTx(ids.ID{1}, [bls.PublicKeyLen]byte{}, [bls.SignatureLen]byte{}, 1, ids.ID{2}).Bytes()},
|
||||
{"TransferChainOwnershipTx", NewTransferChainOwnershipTx(ids.ID{1}, 1, 0, ids.ShortID{1}).Bytes()},
|
||||
{"RemoveChainValidatorTx", NewRemoveChainValidatorTx(ids.NodeID{1}, ids.ID{2}).Bytes()},
|
||||
{"DisableL1ValidatorTx", NewDisableL1ValidatorTx(ids.ID{1}).Bytes()},
|
||||
{"IncreaseL1ValidatorBalanceTx", NewIncreaseL1ValidatorBalanceTx(ids.ID{1}, 1).Bytes()},
|
||||
{"SetL1ValidatorWeightTx", NewSetL1ValidatorWeightTx(ids.ID{1}, 1, 1).Bytes()},
|
||||
}
|
||||
for _, c := range cases {
|
||||
c := c
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
msg, err := zap.Parse(c.buf)
|
||||
if err != nil {
|
||||
t.Fatalf("V11: Parse rejected own builder output: %v", err)
|
||||
}
|
||||
if !bytes.Equal(msg.Bytes(), c.buf) {
|
||||
t.Fatalf("V11: Wrap(buf).Bytes() != buf — TxID stability violated")
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V12 — Concurrent reads of the same buffer (race freedom).
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: two goroutines call tx.Time() / tx.SlashPercentage() simultaneously.
|
||||
// Zero-copy should imply race-free reads — the underlying Object struct is
|
||||
// read-only, accessors do no mutation.
|
||||
//
|
||||
// Verification: spawn N goroutines reading every field; run under -race.
|
||||
|
||||
func TestRed_V12_ConcurrentAccessorReadsRaceFree(t *testing.T) {
|
||||
stx := NewSlashValidatorTx(ids.NodeID{1, 2, 3}, ids.ID{4, 5, 6}, 100_000)
|
||||
btx := NewBaseTx(1337, ids.ID{7, 8, 9}, []byte("concurrent"))
|
||||
regTx := NewRegisterL1ValidatorTx(ids.ID{1}, [bls.PublicKeyLen]byte{}, [bls.SignatureLen]byte{},
|
||||
1_900_000_000, ids.ID{2})
|
||||
|
||||
const goroutines = 32
|
||||
const iterations = 1000
|
||||
var wg sync.WaitGroup
|
||||
wg.Add(goroutines)
|
||||
for g := 0; g < goroutines; g++ {
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
for i := 0; i < iterations; i++ {
|
||||
_ = stx.NodeID()
|
||||
_ = stx.Network()
|
||||
_ = stx.SlashPercentage()
|
||||
_ = btx.NetworkID()
|
||||
_ = btx.BlockchainID()
|
||||
_ = btx.Memo()
|
||||
_ = regTx.ValidationID()
|
||||
_ = regTx.BLSPublicKey()
|
||||
_ = regTx.ProofOfPossession()
|
||||
_ = regTx.Expiry()
|
||||
}
|
||||
}()
|
||||
}
|
||||
wg.Wait()
|
||||
t.Logf("V12 verified: %d goroutines × %d iterations no race. (Run with -race for guarantee.)", goroutines, iterations)
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V13 — Mempool poison: malformed buffer must not panic.
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: a buffer that passes magic + version + size check but contains
|
||||
// adversarial offset/length combinations. Each accessor must remain panic-free
|
||||
// regardless of buffer content.
|
||||
//
|
||||
// Verification: feed adversarial buffers built from random / patterned bytes
|
||||
// and observe accessors complete normally.
|
||||
|
||||
func TestRed_V13_AdversarialBuffersDoNotPanic(t *testing.T) {
|
||||
// Build a real BaseTx, then corrupt random byte positions in the data
|
||||
// segment and confirm accessors don't panic.
|
||||
base := NewBaseTx(1, ids.ID{1}, []byte("memo")).Bytes()
|
||||
|
||||
corruptions := []struct {
|
||||
name string
|
||||
fn func([]byte) []byte
|
||||
}{
|
||||
{"all-0xff data", func(b []byte) []byte {
|
||||
out := append([]byte(nil), b...)
|
||||
for i := zap.HeaderSize; i < len(out); i++ {
|
||||
out[i] = 0xFF
|
||||
}
|
||||
return out
|
||||
}},
|
||||
{"swap header endianness", func(b []byte) []byte {
|
||||
out := append([]byte(nil), b...)
|
||||
// Swap the root offset and the size field — chaos.
|
||||
for i := 8; i < 16; i++ {
|
||||
out[i] ^= 0x55
|
||||
}
|
||||
return out
|
||||
}},
|
||||
{"zero everything except header", func(b []byte) []byte {
|
||||
out := append([]byte(nil), b...)
|
||||
for i := zap.HeaderSize; i < len(out); i++ {
|
||||
out[i] = 0
|
||||
}
|
||||
return out
|
||||
}},
|
||||
{"giant claimed length", func(b []byte) []byte {
|
||||
out := append([]byte(nil), b...)
|
||||
// Find memo field; set length = 0x7FFFFFFF.
|
||||
root := int(binary.LittleEndian.Uint32(out[8:12]))
|
||||
memoFieldPos := root + OffsetBaseTx_Memo
|
||||
binary.LittleEndian.PutUint32(out[memoFieldPos+4:], 0x7FFFFFFF)
|
||||
return out
|
||||
}},
|
||||
}
|
||||
|
||||
for _, c := range corruptions {
|
||||
c := c
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
defer func() {
|
||||
if r := recover(); r != nil {
|
||||
t.Fatalf("V13: panic on adversarial buffer %q: %v", c.name, r)
|
||||
}
|
||||
}()
|
||||
b := c.fn(base)
|
||||
tx, err := WrapBaseTx(b)
|
||||
if err != nil {
|
||||
// Wire-layer rejection is acceptable.
|
||||
return
|
||||
}
|
||||
_ = tx.NetworkID()
|
||||
_ = tx.BlockchainID()
|
||||
_ = tx.Memo()
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V14 — Cross-tx-type confusion (CLOSED by schema v3 TxKind discriminator).
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: an attacker submits an AdvanceTimeTx buffer to WrapBaseTx. Prior
|
||||
// to schema v3 this returned a typed BaseTx whose accessors yielded garbage
|
||||
// (the AdvanceTimeTx's 8-byte Time value reinterpreted as NetworkID + first
|
||||
// 4 bytes of BlockchainID).
|
||||
//
|
||||
// Wire defense (v3): TxKind discriminator at offset 0 of every tx. Wrap*Tx
|
||||
// reads it and returns ErrWrongTxKind on mismatch. Every pairing of
|
||||
// {valid-tx-buf, wrong-Wrap-function} now rejects at the wire layer.
|
||||
|
||||
func TestRed_V14_CrossTypeConfusion(t *testing.T) {
|
||||
// Build canonical buffers for every tx type, then assert that every
|
||||
// non-matching Wrap*Tx rejects with ErrWrongTxKind.
|
||||
advance := NewAdvanceTimeTx(0xDEAD_BEEF_CAFE_BABE).Bytes()
|
||||
base := NewBaseTx(1, ids.ID{1}, []byte("memo")).Bytes()
|
||||
reward := NewRewardValidatorTx(ids.ID{2}).Bytes()
|
||||
slash := NewSlashValidatorTx(ids.NodeID{3}, ids.ID{4}, 100_000).Bytes()
|
||||
disable := NewDisableL1ValidatorTx(ids.ID{5}).Bytes()
|
||||
register := NewRegisterL1ValidatorTx(ids.ID{6}, [bls.PublicKeyLen]byte{},
|
||||
[bls.SignatureLen]byte{}, 1, ids.ID{7}).Bytes()
|
||||
incBal := NewIncreaseL1ValidatorBalanceTx(ids.ID{9}, 1).Bytes()
|
||||
transfer := NewTransferChainOwnershipTx(ids.ID{10}, 1, 0, ids.ShortID{1}).Bytes()
|
||||
remove := NewRemoveChainValidatorTx(ids.NodeID{11}, ids.ID{12}).Bytes()
|
||||
|
||||
// Cross-confusion attempts. Each WrapXxx(bufY) where Y != X MUST reject.
|
||||
cases := []struct {
|
||||
name string
|
||||
fn func() error
|
||||
}{
|
||||
{"WrapBaseTx(AdvanceTimeTx)", func() error { _, err := WrapBaseTx(advance); return err }},
|
||||
{"WrapBaseTx(RewardValidatorTx)", func() error { _, err := WrapBaseTx(reward); return err }},
|
||||
{"WrapSlashValidatorTx(BaseTx)", func() error { _, err := WrapSlashValidatorTx(base); return err }},
|
||||
{"WrapRegisterL1ValidatorTx(SlashValidatorTx)", func() error { _, err := WrapRegisterL1ValidatorTx(slash); return err }},
|
||||
{"WrapAdvanceTimeTx(RewardValidatorTx)", func() error { _, err := WrapAdvanceTimeTx(reward); return err }},
|
||||
{"WrapDisableL1ValidatorTx(RewardValidatorTx)", func() error { _, err := WrapDisableL1ValidatorTx(reward); return err }},
|
||||
{"WrapSetL1ValidatorWeightTx(IncreaseL1ValidatorBalanceTx)", func() error { _, err := WrapSetL1ValidatorWeightTx(incBal); return err }},
|
||||
{"WrapTransferChainOwnershipTx(RemoveChainValidatorTx)", func() error { _, err := WrapTransferChainOwnershipTx(remove); return err }},
|
||||
{"WrapRemoveChainValidatorTx(TransferChainOwnershipTx)", func() error { _, err := WrapRemoveChainValidatorTx(transfer); return err }},
|
||||
{"WrapRegisterL1ValidatorTx(DisableL1ValidatorTx)", func() error { _, err := WrapRegisterL1ValidatorTx(disable); return err }},
|
||||
{"WrapRewardValidatorTx(AdvanceTimeTx)", func() error { _, err := WrapRewardValidatorTx(register); return err }},
|
||||
}
|
||||
for _, c := range cases {
|
||||
c := c
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
err := c.fn()
|
||||
if err == nil {
|
||||
t.Fatalf("V14: %s succeeded; expected ErrWrongTxKind (v3 discriminator gap)", c.name)
|
||||
}
|
||||
if err != ErrWrongTxKind {
|
||||
t.Fatalf("V14: %s returned %v; expected ErrWrongTxKind", c.name, err)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
// Sanity: a buffer with TxKind=0 (reserved) is also rejected.
|
||||
t.Run("reservedKindRejected", func(t *testing.T) {
|
||||
buf := append([]byte(nil), base...)
|
||||
root := int(binary.LittleEndian.Uint32(buf[8:12]))
|
||||
buf[root+OffsetTxKind] = 0
|
||||
_, err := WrapBaseTx(buf)
|
||||
if err != ErrWrongTxKind {
|
||||
t.Fatalf("V14: reserved TxKind=0 not rejected; got err=%v", err)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V15 — Activation timestamp gaming.
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: a block builder emits a block at timestamp ZAPActivationUnix-1
|
||||
// containing ZAP-encoded txs. Validators receiving the block must decide:
|
||||
// reject the wrong-codec tx, or accept it because the block is pre-activation?
|
||||
//
|
||||
// Defense (codec_select.go::ShouldUseZAPForWrite): under default (legacy
|
||||
// disabled), ZAP is ALWAYS the write codec regardless of timestamp. Under
|
||||
// legacy-enabled, ZAP write is gated on timestamp >= activation. Read path
|
||||
// uses IsZAPBytes — a 4-byte magic check independent of timestamp.
|
||||
//
|
||||
// Risk surface: in legacy-enabled mode, a tx encoded in ZAP at pre-activation
|
||||
// timestamp will be PARSEABLE (IsZAPBytes=true) but the block-builder rule
|
||||
// (ShouldUseZAPForWrite=false at that timestamp) says it shouldn't have been
|
||||
// written. Validators applying ShouldUseZAPForWrite as an ACCEPTANCE rule
|
||||
// would reject; validators applying it as a WRITE-ONLY rule would accept.
|
||||
//
|
||||
// THE RULE MUST BE: validators reject ZAP-encoded txs at pre-activation
|
||||
// timestamps when in legacy-compatible mode. Otherwise a pre-activation
|
||||
// block accepting ZAP txs creates a fork between legacy-only and
|
||||
// legacy-aware nodes.
|
||||
//
|
||||
// This package does not own the consensus rule — only the wire encoding.
|
||||
// The owning layer is block/executor. Document the requirement.
|
||||
|
||||
func TestRed_V15_PreActivationZAPTxRejection(t *testing.T) {
|
||||
// Verify the wire layer's stance.
|
||||
atx := NewAdvanceTimeTx(ZAPActivationUnix - 1) // pre-activation timestamp
|
||||
if !IsZAPBytes(atx.Bytes()) {
|
||||
t.Fatal("V15: AdvanceTimeTx with pre-activation timestamp is still ZAP-encoded (wire layer is timestamp-agnostic)")
|
||||
}
|
||||
|
||||
// Save and restore LegacyEnabled state.
|
||||
defer func(prev bool) { LegacyEnabled = prev }(LegacyEnabled)
|
||||
|
||||
LegacyEnabled = false
|
||||
if !ShouldUseZAPForWrite(ZAPActivationUnix - 1) {
|
||||
t.Fatal("V15: default (legacy disabled) should write ZAP for ALL timestamps")
|
||||
}
|
||||
LegacyEnabled = true
|
||||
if ShouldUseZAPForWrite(ZAPActivationUnix - 1) {
|
||||
t.Fatal("V15: legacy-enabled mode should NOT write ZAP pre-activation")
|
||||
}
|
||||
t.Logf("V15 documented: wire encoder respects ShouldUseZAPForWrite rule. CONSENSUS RULE OWNER: block/executor layer MUST reject ZAP-encoded blocks at pre-activation timestamps when in legacy-enabled mode. This invariant lives at consensus, not wire.")
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V16 (Red-added) — Header malleability: flags field is unconstrained.
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: the 2-byte Flags field in the ZAP header (offset 6) is not validated
|
||||
// by zap.Parse. An attacker can flip FlagCompressed/FlagEncrypted/FlagSigned
|
||||
// bits in a buffer that is otherwise plaintext. The Parse function accepts
|
||||
// the flags as-is; the readers in this package don't consult them.
|
||||
//
|
||||
// Impact: two distinct buffers (same data, different Flags) decode to the
|
||||
// same logical tx. TxID = hash(buf1) != hash(buf2) — transaction malleability
|
||||
// after TxID integration lands.
|
||||
//
|
||||
// Severity: MEDIUM (deferred — depends on TxID integration). Mitigation
|
||||
// recommendation: zap.Parse should reject any FlagCompressed/FlagEncrypted
|
||||
// not paired with a decompression/decryption capability, or zap_native should
|
||||
// require Flags=0 on entry.
|
||||
|
||||
func TestRed_V16_HeaderFlagsAreMalleable(t *testing.T) {
|
||||
tx := NewBaseTx(1, ids.ID{1}, []byte("memo"))
|
||||
buf := append([]byte(nil), tx.Bytes()...)
|
||||
|
||||
// Toggle the FlagSigned bit (LSB+2) in the Flags field at offset 6.
|
||||
binary.LittleEndian.PutUint16(buf[6:8], uint16(zap.FlagSigned))
|
||||
|
||||
// Re-parse. Should succeed; the wire layer doesn't validate flags.
|
||||
tx2, err := WrapBaseTx(buf)
|
||||
if err != nil {
|
||||
t.Logf("V16 wire defense (unexpected but acceptable): Parse rejected flag-mutated buffer: %v", err)
|
||||
return
|
||||
}
|
||||
if tx2.NetworkID() != 1 || tx2.BlockchainID() != (ids.ID{1}) {
|
||||
t.Fatal("V16: flag-mutated buffer should still decode the same logical tx")
|
||||
}
|
||||
if bytes.Equal(buf, tx.Bytes()) {
|
||||
t.Fatal("V16: buffers are identical; we didn't actually mutate")
|
||||
}
|
||||
t.Logf("V16 CONFIRMED: header Flags field is unconstrained. Two distinct buffers decode same logical tx. Malleability surface — dormant until TxID integration. RECOMMENDATION: zap.Parse should reject unknown flag bits OR zap_native readers should require Flags=0.")
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V17 (Red-added) — Trailing-bytes malleability.
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: zap.Parse honors the embedded size field and slices data to
|
||||
// data[:size]. Bytes BEYOND the declared size are discarded silently. An
|
||||
// attacker can append arbitrary bytes to a valid tx; Parse returns the
|
||||
// truncated message; the original buffer (with trailing junk) hashes
|
||||
// differently than the parsed message bytes.
|
||||
//
|
||||
// Wire defense: data[:size] truncation. Parsed buffer is canonical.
|
||||
//
|
||||
// Open question: does any caller compute TxID over the OUTER (with-trailing)
|
||||
// buffer rather than the parsed-inner buffer? In this package, Bytes() returns
|
||||
// the parsed/truncated buffer — so TxID computed via tx.Bytes() is stable.
|
||||
//
|
||||
// Result: PASS — wire defense in place, but caller MUST use tx.Bytes() not
|
||||
// the original input.
|
||||
|
||||
func TestRed_V17_TrailingBytesTruncatedAtParse(t *testing.T) {
|
||||
tx := NewBaseTx(1, ids.ID{1}, []byte("memo"))
|
||||
orig := tx.Bytes()
|
||||
|
||||
// Append 100 trailing junk bytes.
|
||||
junk := append([]byte(nil), orig...)
|
||||
for i := 0; i < 100; i++ {
|
||||
junk = append(junk, byte(i))
|
||||
}
|
||||
|
||||
tx2, err := WrapBaseTx(junk)
|
||||
if err != nil {
|
||||
t.Fatalf("V17: Parse rejected trailing-byte buffer: %v", err)
|
||||
}
|
||||
if len(tx2.Bytes()) != len(orig) {
|
||||
t.Fatalf("V17: tx2.Bytes() len=%d, want %d (Parse must truncate at declared size)", len(tx2.Bytes()), len(orig))
|
||||
}
|
||||
if !bytes.Equal(tx2.Bytes(), orig) {
|
||||
t.Fatalf("V17: tx2.Bytes() differs from canonical buffer")
|
||||
}
|
||||
t.Logf("V17 verified: zap.Parse truncates at declared size; tx.Bytes() returns canonical form. TxID = hash(tx.Bytes()) is stable even when input has trailing junk. CONTRACT: TxID-computing callers MUST hash tx.Bytes(), NOT the original input buffer.")
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V18 (Red-added) — Size field underflow / overflow at Parse boundary.
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: zap.Parse validates `size <= len(data)` but does NOT validate
|
||||
// `size >= HeaderSize`. A buffer with size = 0..15 passes the upper bound
|
||||
// check but is internally inconsistent. Object accessors would Uint32-read
|
||||
// at offset 8..11 within HeaderSize bytes (valid), then operate on data[:size]
|
||||
// where size < HeaderSize means the slice excludes the header bytes the
|
||||
// accessor was supposed to use.
|
||||
//
|
||||
// Verification: try size=0 and size=15.
|
||||
|
||||
func TestRed_V18_SizeFieldUnderflowAtParse(t *testing.T) {
|
||||
hdr := make([]byte, zap.HeaderSize)
|
||||
copy(hdr, zap.Magic)
|
||||
binary.LittleEndian.PutUint16(hdr[4:6], zap.Version)
|
||||
binary.LittleEndian.PutUint32(hdr[8:12], 0) // root offset = 0
|
||||
binary.LittleEndian.PutUint32(hdr[12:16], 0) // claimed size = 0
|
||||
|
||||
// Parse the buffer.
|
||||
defer func() {
|
||||
if r := recover(); r != nil {
|
||||
t.Fatalf("V18 PANIC on size-underflow buffer: %v — wire layer fails open", r)
|
||||
}
|
||||
}()
|
||||
msg, err := zap.Parse(hdr)
|
||||
if err != nil {
|
||||
t.Logf("V18 wire defense: Parse rejected size=0 buffer: %v", err)
|
||||
return
|
||||
}
|
||||
// If accepted, msg.data = hdr[:0] — empty slice. Any further access via
|
||||
// Root() reads root offset from msg.data[8:12] which would PANIC on empty.
|
||||
defer func() {
|
||||
if r := recover(); r != nil {
|
||||
t.Logf("V18 INTERNAL PANIC after Parse accepted size=0: %v. This is a WIRE-LAYER GAP: Parse should require size >= HeaderSize.", r)
|
||||
}
|
||||
}()
|
||||
_ = msg.Root()
|
||||
t.Logf("V18: size=0 Parse accepted, Root() returned without panic — implementation tolerates degenerate case.")
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V19 (Red-added) — Root offset out-of-bounds.
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: Parse validates the message size but not the root offset. The root
|
||||
// offset (header bytes 8:12) can point past end-of-message. msg.Root() then
|
||||
// returns Object{offset: bogus}, and accessors call Uint32(bogus+fieldOffset)
|
||||
// which the bounds-check catches → returns 0.
|
||||
//
|
||||
// Result: bounds-check catches it. Silent zero again. Same layered-defense
|
||||
// argument as V1.
|
||||
|
||||
func TestRed_V19_RootOffsetPastEnd(t *testing.T) {
|
||||
tx := NewSlashValidatorTx(ids.NodeID{1}, ids.ID{2}, 100_000)
|
||||
buf := append([]byte(nil), tx.Bytes()...)
|
||||
|
||||
// Set root offset to a value way past EOF.
|
||||
binary.LittleEndian.PutUint32(buf[8:12], 0x7FFFFFFF)
|
||||
|
||||
tx2, err := WrapSlashValidatorTx(buf)
|
||||
if err != nil {
|
||||
t.Logf("V19 wire defense: Parse rejected out-of-range root offset: %v", err)
|
||||
return
|
||||
}
|
||||
defer func() {
|
||||
if r := recover(); r != nil {
|
||||
t.Fatalf("V19 PANIC on out-of-range root: %v", r)
|
||||
}
|
||||
}()
|
||||
// All fields should return zero (Uint8/16/32/64 bounds check).
|
||||
got := tx2.SlashPercentage()
|
||||
if got != 0 {
|
||||
t.Fatalf("V19: SlashPercentage on bogus-root buffer = %d, want 0 (bounds check)", got)
|
||||
}
|
||||
t.Logf("V19 verified: out-of-range root offset → accessors silently return 0 → executor enum check rejects (defense in depth).")
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------------
|
||||
// V20 (Red-added) — Memo length field overflow into negative int.
|
||||
// -----------------------------------------------------------------------------
|
||||
//
|
||||
// Threat: length is read as uint32; cast to int. On 32-bit platforms (Go
|
||||
// theoretical), int(uint32(0x80000000)) is negative — could underflow
|
||||
// arithmetic. On 64-bit platforms, int(uint32) is positive, no overflow.
|
||||
//
|
||||
// Lux runs 64-bit only — this is a non-issue. Documented for completeness.
|
||||
|
||||
func TestRed_V20_MemoLengthCastSafety(t *testing.T) {
|
||||
if (^uint(0) >> 32) == 0 {
|
||||
t.Skip("V20: skipped on 32-bit platforms (Lux is 64-bit only)")
|
||||
}
|
||||
// On 64-bit, int(uint32(MaxUint32)) = positive.
|
||||
// Build buffer with claimed length = MaxUint32; bounds check rejects.
|
||||
tx := NewBaseTx(1, ids.ID{1}, []byte("memo"))
|
||||
buf := append([]byte(nil), tx.Bytes()...)
|
||||
root := int(binary.LittleEndian.Uint32(buf[8:12]))
|
||||
memoFieldPos := root + OffsetBaseTx_Memo
|
||||
|
||||
binary.LittleEndian.PutUint32(buf[memoFieldPos+4:], 0xFFFFFFFF)
|
||||
|
||||
tx2, err := WrapBaseTx(buf)
|
||||
if err != nil {
|
||||
t.Logf("V20: Parse rejected overflow-length buffer: %v", err)
|
||||
return
|
||||
}
|
||||
memo := tx2.Memo()
|
||||
if memo != nil {
|
||||
t.Fatalf("V20: oversized length not bounds-checked; Memo() returned len=%d", len(memo))
|
||||
}
|
||||
t.Logf("V20 verified: uint32(MaxUint32) length passes through uint32→int positive cast on 64-bit; bounds check in zap.Object.Bytes catches absPos+length > len(data) → returns nil.")
|
||||
}
|
||||
@@ -8,18 +8,25 @@ import (
|
||||
"github.com/luxfi/zap"
|
||||
)
|
||||
|
||||
// SetL1ValidatorWeightTx — ValidationID (ids.ID, 32 bytes) + Nonce uint64 + Weight uint64.
|
||||
// SetL1ValidatorWeightTx v3 schema — TxKind + ValidationID + Nonce + Weight.
|
||||
//
|
||||
// Used to adjust the stake weight of an L1 validator without a full
|
||||
// re-register cycle. The Nonce is a strict monotonic counter scoped to the
|
||||
// ValidationID, preventing replay.
|
||||
//
|
||||
// Fixed-section layout (size 49 bytes):
|
||||
//
|
||||
// TxKind uint8 @ 0
|
||||
// ValidationID 32B @ 1
|
||||
// Nonce uint64 @ 33
|
||||
// Weight uint64 @ 41
|
||||
const (
|
||||
SchemaVersionSetL1ValidatorWeightTx uint16 = 2
|
||||
SchemaVersionSetL1ValidatorWeightTx uint16 = 3
|
||||
|
||||
OffsetSetL1ValidatorWeightTx_ValidationID = 0 // 32 bytes
|
||||
OffsetSetL1ValidatorWeightTx_Nonce = 32 // uint64
|
||||
OffsetSetL1ValidatorWeightTx_Weight = 40 // uint64
|
||||
SizeSetL1ValidatorWeightTx = 48
|
||||
OffsetSetL1ValidatorWeightTx_ValidationID = 1 // 32 bytes
|
||||
OffsetSetL1ValidatorWeightTx_Nonce = 33 // uint64
|
||||
OffsetSetL1ValidatorWeightTx_Weight = 41 // uint64
|
||||
SizeSetL1ValidatorWeightTx = 49
|
||||
)
|
||||
|
||||
type SetL1ValidatorWeightTx struct {
|
||||
@@ -51,12 +58,17 @@ func WrapSetL1ValidatorWeightTx(b []byte) (SetL1ValidatorWeightTx, error) {
|
||||
if err != nil {
|
||||
return SetL1ValidatorWeightTx{}, err
|
||||
}
|
||||
return SetL1ValidatorWeightTx{msg: msg, obj: msg.Root()}, nil
|
||||
obj := msg.Root()
|
||||
if TxKind(obj.Uint8(OffsetTxKind)) != TxKindSetL1ValidatorWeight {
|
||||
return SetL1ValidatorWeightTx{}, ErrWrongTxKind
|
||||
}
|
||||
return SetL1ValidatorWeightTx{msg: msg, obj: obj}, nil
|
||||
}
|
||||
|
||||
func NewSetL1ValidatorWeightTx(validationID ids.ID, nonce, weight uint64) SetL1ValidatorWeightTx {
|
||||
b := zap.NewBuilder(zap.HeaderSize + 16 + SizeSetL1ValidatorWeightTx)
|
||||
ob := b.StartObject(SizeSetL1ValidatorWeightTx)
|
||||
ob.SetUint8(OffsetTxKind, uint8(TxKindSetL1ValidatorWeight))
|
||||
for i := 0; i < 32; i++ {
|
||||
ob.SetUint8(OffsetSetL1ValidatorWeightTx_ValidationID+i, validationID[i])
|
||||
}
|
||||
|
||||
@@ -8,25 +8,27 @@ import (
|
||||
"github.com/luxfi/zap"
|
||||
)
|
||||
|
||||
// SlashValidatorTx v1 schema — NodeID (20B) + Subnet (32B).
|
||||
// SlashValidatorTx v3 schema — TxKind + NodeID (20B) + Network (32B) +
|
||||
// SlashPercentage.
|
||||
//
|
||||
// The legacy struct also carries an Evidence object (height, type, two
|
||||
// message/signature pairs) and SlashPercentage. Evidence is variable-length
|
||||
// nested bytes and ships with the proper list/object schema in batch 3.
|
||||
// SlashPercentage is included here as a uint32 because it's fixed-size and
|
||||
// the executor needs it before evaluating the evidence.
|
||||
// message/signature pairs). Evidence is variable-length nested bytes and
|
||||
// ships with the proper list/object schema in batch 3. SlashPercentage is
|
||||
// included here as a uint32 because it's fixed-size and the executor needs
|
||||
// it before evaluating the evidence.
|
||||
//
|
||||
// Fixed-section layout (size 56 bytes):
|
||||
// Fixed-section layout (size 57 bytes):
|
||||
//
|
||||
// NodeID 20B @ 0 (ids.NodeID, ShortIDLen)
|
||||
// Subnet 32B @ 20 (ids.ID)
|
||||
// SlashPercentage uint32 @ 52
|
||||
// TxKind uint8 @ 0
|
||||
// NodeID 20B @ 1 (ids.NodeID, ShortIDLen)
|
||||
// Network 32B @ 21 (ids.ID)
|
||||
// SlashPercentage uint32 @ 53
|
||||
const (
|
||||
SchemaVersionSlashValidatorTx uint16 = 2
|
||||
SchemaVersionSlashValidatorTx uint16 = 3
|
||||
|
||||
OffsetSlashValidatorTx_NodeID = 0
|
||||
OffsetSlashValidatorTx_Subnet = ids.ShortIDLen
|
||||
OffsetSlashValidatorTx_SlashPercentage = OffsetSlashValidatorTx_Subnet + 32
|
||||
OffsetSlashValidatorTx_NodeID = 1
|
||||
OffsetSlashValidatorTx_Network = OffsetSlashValidatorTx_NodeID + ids.ShortIDLen
|
||||
OffsetSlashValidatorTx_SlashPercentage = OffsetSlashValidatorTx_Network + 32
|
||||
SizeSlashValidatorTx = OffsetSlashValidatorTx_SlashPercentage + 4
|
||||
)
|
||||
|
||||
@@ -43,10 +45,12 @@ func (t SlashValidatorTx) NodeID() ids.NodeID {
|
||||
return out
|
||||
}
|
||||
|
||||
func (t SlashValidatorTx) Subnet() ids.ID {
|
||||
// Network returns the L1 network ID (32B) the slashed validator belongs to.
|
||||
// (Field stays named Network on the wire; ids.ID semantics unchanged.)
|
||||
func (t SlashValidatorTx) Network() ids.ID {
|
||||
var out ids.ID
|
||||
for i := 0; i < 32; i++ {
|
||||
out[i] = t.obj.Uint8(OffsetSlashValidatorTx_Subnet + i)
|
||||
out[i] = t.obj.Uint8(OffsetSlashValidatorTx_Network + i)
|
||||
}
|
||||
return out
|
||||
}
|
||||
@@ -63,17 +67,22 @@ func WrapSlashValidatorTx(b []byte) (SlashValidatorTx, error) {
|
||||
if err != nil {
|
||||
return SlashValidatorTx{}, err
|
||||
}
|
||||
return SlashValidatorTx{msg: msg, obj: msg.Root()}, nil
|
||||
obj := msg.Root()
|
||||
if TxKind(obj.Uint8(OffsetTxKind)) != TxKindSlashValidator {
|
||||
return SlashValidatorTx{}, ErrWrongTxKind
|
||||
}
|
||||
return SlashValidatorTx{msg: msg, obj: obj}, nil
|
||||
}
|
||||
|
||||
func NewSlashValidatorTx(nodeID ids.NodeID, subnet ids.ID, slashPercentage uint32) SlashValidatorTx {
|
||||
func NewSlashValidatorTx(nodeID ids.NodeID, network ids.ID, slashPercentage uint32) SlashValidatorTx {
|
||||
b := zap.NewBuilder(zap.HeaderSize + 16 + SizeSlashValidatorTx)
|
||||
ob := b.StartObject(SizeSlashValidatorTx)
|
||||
ob.SetUint8(OffsetTxKind, uint8(TxKindSlashValidator))
|
||||
for i := 0; i < ids.ShortIDLen; i++ {
|
||||
ob.SetUint8(OffsetSlashValidatorTx_NodeID+i, nodeID[i])
|
||||
}
|
||||
for i := 0; i < 32; i++ {
|
||||
ob.SetUint8(OffsetSlashValidatorTx_Subnet+i, subnet[i])
|
||||
ob.SetUint8(OffsetSlashValidatorTx_Network+i, network[i])
|
||||
}
|
||||
ob.SetUint32(OffsetSlashValidatorTx_SlashPercentage, slashPercentage)
|
||||
ob.FinishAsRoot()
|
||||
|
||||
@@ -8,12 +8,12 @@ import (
|
||||
"github.com/luxfi/zap"
|
||||
)
|
||||
|
||||
// TransferChainOwnershipTx v1 schema — Chain + a single-address Owner stub.
|
||||
// TransferChainOwnershipTx v3 schema — TxKind + Chain + single-address Owner.
|
||||
//
|
||||
// The legacy struct's Owner is an fx.Owner interface — almost always
|
||||
// *secp256k1fx.OutputOwners with {Threshold uint32, Locktime uint64,
|
||||
// AddressIDs []ids.ShortID}. The variable AddressIDs list ships with the
|
||||
// proper schema in batch 3. The v1 form pins the single most common
|
||||
// proper schema in batch 3. The v3 form pins the single most common
|
||||
// configuration: threshold-1 / locktime-0 / single owner address. Callers
|
||||
// that need richer Owner shapes still have the legacy encoder available
|
||||
// behind LUXD_ENABLE_LEGACY_CODEC.
|
||||
@@ -23,19 +23,23 @@ import (
|
||||
// rides outside the unsigned-tx bytes in the signed wrapper, so it stays
|
||||
// in the signed-tx schema (separate from the unsigned encoding here).
|
||||
//
|
||||
// Fixed-section layout (size 56 bytes):
|
||||
// Fixed-section layout (size 69 bytes):
|
||||
//
|
||||
// Chain 32B @ 0 (ids.ID)
|
||||
// OwnerThreshold uint32 @ 32
|
||||
// OwnerLocktime uint64 @ 40
|
||||
// OwnerAddress 20B @ 48 (ids.ShortID; single owner v1 stub)
|
||||
// TxKind uint8 @ 0
|
||||
// Chain 32B @ 1 (ids.ID)
|
||||
// OwnerThreshold uint32 @ 33
|
||||
// OwnerLocktime uint64 @ 37
|
||||
// OwnerAddress 20B @ 45 (ids.ShortID; single owner v3 stub)
|
||||
//
|
||||
// Fields are tightly packed; uint64 reads via binary.LittleEndian.Uint64 are
|
||||
// alignment-tolerant so no natural-alignment padding is required.
|
||||
const (
|
||||
SchemaVersionTransferChainOwnershipTx uint16 = 2
|
||||
SchemaVersionTransferChainOwnershipTx uint16 = 3
|
||||
|
||||
OffsetTransferChainOwnershipTx_Chain = 0
|
||||
OffsetTransferChainOwnershipTx_OwnerThreshold = 32
|
||||
OffsetTransferChainOwnershipTx_OwnerLocktime = 40
|
||||
OffsetTransferChainOwnershipTx_OwnerAddress = 48
|
||||
OffsetTransferChainOwnershipTx_Chain = 1
|
||||
OffsetTransferChainOwnershipTx_OwnerThreshold = 33
|
||||
OffsetTransferChainOwnershipTx_OwnerLocktime = 37
|
||||
OffsetTransferChainOwnershipTx_OwnerAddress = 45
|
||||
SizeTransferChainOwnershipTx = OffsetTransferChainOwnershipTx_OwnerAddress + ids.ShortIDLen
|
||||
)
|
||||
|
||||
@@ -76,7 +80,11 @@ func WrapTransferChainOwnershipTx(b []byte) (TransferChainOwnershipTx, error) {
|
||||
if err != nil {
|
||||
return TransferChainOwnershipTx{}, err
|
||||
}
|
||||
return TransferChainOwnershipTx{msg: msg, obj: msg.Root()}, nil
|
||||
obj := msg.Root()
|
||||
if TxKind(obj.Uint8(OffsetTxKind)) != TxKindTransferChainOwnership {
|
||||
return TransferChainOwnershipTx{}, ErrWrongTxKind
|
||||
}
|
||||
return TransferChainOwnershipTx{msg: msg, obj: obj}, nil
|
||||
}
|
||||
|
||||
func NewTransferChainOwnershipTx(
|
||||
@@ -87,6 +95,7 @@ func NewTransferChainOwnershipTx(
|
||||
) TransferChainOwnershipTx {
|
||||
b := zap.NewBuilder(zap.HeaderSize + 16 + SizeTransferChainOwnershipTx)
|
||||
ob := b.StartObject(SizeTransferChainOwnershipTx)
|
||||
ob.SetUint8(OffsetTxKind, uint8(TxKindTransferChainOwnership))
|
||||
for i := 0; i < 32; i++ {
|
||||
ob.SetUint8(OffsetTransferChainOwnershipTx_Chain+i, chain[i])
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user