mirror of
https://github.com/luxfi/precompile.git
synced 2026-07-27 03:33:45 +00:00
zeekay
e73ece92f7
CRITICAL #1 -- ai mint forge (0x0300 verifyAndMint{Work,Data}): verification ran VerifyMLDSA against an attacker-supplied calldata pubkey, so a self-signed work proof minted unbounded reward. Gate the mint on a real TEE quote embedded in the work proof: the cert chain must terminate at the embedded vendor root (ai.verifyAttestation, checked at the report's own timestamp) and the attested deviceID must equal BLAKE3(pubkey). The signing key is vouched for on chain, never asserted in calldata. Fused gas now meters the cert-chain verify (GasVerifyTEE). Roots threaded explicitly, no global state. CRITICAL #2 -- attestation fake-verify + consensus split (0x0301): VerifyNVTrust returned Verified:true for zero-byte evidence, used time.Now(), and mutated a process-global verifier map. Route every selector to the real verifier (ai.VerifyTEE), delete the fake path, derive attestation expiry from the block timestamp, and drop the process-global registry (TEE quotes are self-validating -- stateless). The fake luxfi/ai/pkg/attestation dependency is removed. Tests: self-signed/forged mints rejected (ErrMissingAttestation, ErrTEESignatureInvalid, ErrDeviceKeyMismatch); zero/garbage/self-rooted attestation rejected by the real verifier; CreateAttestation deterministic on (input, blockTS). 66 pass, 0 fail. go.mod/go.sum untouched.