[RP-verify] fix holes from adversarial pass: NaN stake, appeal-claims, juror parties, gov vote kwarg, paymaster ReentrancyGuard

Adversarial multi-lens review of the return-pass changes surfaced real holes;
fixed with proof (0pnMatrx pytest 547 green, forge 28/28 green):

- P1 NaN/Infinity stake bypass (introduced by RP-5's float() cast): file_dispute
  now rejects non-finite stake BEFORE the floor check (every NaN/inf comparison
  against the floor is False, so it would slip past the anti-spam guard).
- P2 stale claims survive appeal: appeal() now clears dispute['claims'] so an
  overturned round's stake_return / juror_reward can't drive a double payout.
- P2 juror party-exclusion: select_jurors takes exclude={parties}; resolve()
  passes both parties so neither can occupy a slot on their own case (vote()
  already blocked their ballot; this stops quorum dilution + the claimant tie-break bias).
- P2 governance vote kwarg: _handle_governance_vote passed support= into a
  service expecting choice= (500 on every live vote) — mapped correctly.
- Paymaster ReentrancyGuard: withdraw/sponsoredCall/sponsoredCallWithValue now
  nonReentrant, matching every sibling contract; the RP-4 .transfer->.call change
  forwards full gas, so the guard closes the surface that opens.

sponsoredCallWithValue's agent-drain primitive is flagged as a pre-existing
design decision (per-agent cap / target allowlist) in POST_DEPLOY_WIRING_UNIT.md
— not silently changed.

Author: Neo

contracts/OpenMatrixPaymaster.sol

@@ -1,13 +1,19 @@
 // SPDX-License-Identifier: MIT
 pragma solidity ^0.8.20;
 
+import "@openzeppelin/contracts/utils/ReentrancyGuard.sol";
+
 /**
  * @title OpenMatrixPaymaster
  * @notice Gas sponsorship contract for the 0pnMatrx platform.
  *         The platform covers all gas fees for users — users never pay gas.
  *         This contract holds ETH and sponsors transactions on behalf of users.
+ * @dev All ETH-moving functions are nonReentrant, matching every sibling
+ *      contract. This matters because withdraw/sponsoredCall* now use `.call`
+ *      (which forwards all gas) instead of `.transfer` (2300-gas stipend):
+ *      the guard closes the reentrancy surface that the gas-forwarding opens.
  */
-contract OpenMatrixPaymaster {
+contract OpenMatrixPaymaster is ReentrancyGuard {
     address public owner;
     address public platform;
 
@@ -54,7 +60,7 @@ contract OpenMatrixPaymaster {
     /// @notice Execute a sponsored call to a target contract
     /// @param target Contract to call
     /// @param data Calldata to send
-    function sponsoredCall(address target, bytes calldata data) external onlyAuthorized returns (bytes memory) {
+    function sponsoredCall(address target, bytes calldata data) external onlyAuthorized nonReentrant returns (bytes memory) {
         totalTransactions++;
         totalSponsored += tx.gasprice * gasleft();
         (bool success, bytes memory result) = target.call(data);
@@ -63,7 +69,7 @@ contract OpenMatrixPaymaster {
     }
 
     /// @notice Execute a sponsored call with ETH value
-    function sponsoredCallWithValue(address target, bytes calldata data, uint256 value) external onlyAuthorized returns (bytes memory) {
+    function sponsoredCallWithValue(address target, bytes calldata data, uint256 value) external onlyAuthorized nonReentrant returns (bytes memory) {
         require(address(this).balance >= value, "Insufficient balance");
         totalTransactions++;
         totalSponsored += tx.gasprice * gasleft();
@@ -88,7 +94,7 @@ contract OpenMatrixPaymaster {
     /// @dev Uses call, not transfer: the 2300-gas stipend would permanently
     ///      strand funds if ownership moves to a smart-contract wallet
     ///      (multisig / ERC-4337 account) whose receive needs more gas.
-    function withdraw(uint256 amount) external onlyOwner {
+    function withdraw(uint256 amount) external onlyOwner nonReentrant {
         require(address(this).balance >= amount, "Insufficient balance");
         (bool ok, ) = payable(owner).call{value: amount}("");
         require(ok, "Withdraw failed");

gateway/service_routes.py

@@ -1029,11 +1029,13 @@ async def _handle_governance_create(self, request: web.Request) -> web.Response:
     async def _handle_governance_vote(self, request: web.Request) -> web.Response:
         body = await self._parse_body(request)
         self._require(body, "proposal_id", "voter", "support")
+        # governance.vote's parameter is `choice`, not `support` — passing
+        # support= raised TypeError (500) on every live vote. Map it here.
         result = await self._call(
             "governance", "vote",
             proposal_id=body["proposal_id"],
             voter=body["voter"],
-            support=body["support"],
+            choice=body["support"],
         )
         return self._ok(result)
 

runtime/blockchain/services/dispute_resolution/juror_pool.py

@@ -105,7 +105,8 @@ async def remove_juror(self, address: str) -> dict:
     # ------------------------------------------------------------------
 
     async def select_jurors(
-        self, dispute_id: str, count: int = 5, category: str | None = None
+        self, dispute_id: str, count: int = 5, category: str | None = None,
+        exclude: set[str] | None = None,
     ) -> list[dict]:
         """Select *count* jurors for a dispute using Chainlink VRF.
 
@@ -117,14 +118,21 @@ async def select_jurors(
             dispute_id: Identifier of the dispute requiring jurors.
             count: Number of jurors to select (default 5).
             category: Optional dispute category for expertise weighting.
+            exclude: Addresses barred from the panel (the dispute's own
+                parties) so a party cannot occupy a juror slot on their own
+                case — which would dilute the effective quorum even though
+                the vote() layer separately blocks them from casting.
 
         Returns:
             List of selected juror records.
 
         Raises:
             RuntimeError: If there are fewer eligible jurors than *count*.
         """
-        eligible = [j for j in self._jurors.values() if j["active"]]
+        barred = exclude or set()
+        eligible = [
+            j for j in self._jurors.values() if j["active"] and j["address"] not in barred
+        ]
         if len(eligible) < count:
             raise RuntimeError(
                 f"Not enough eligible jurors: need {count}, have {len(eligible)}"

runtime/blockchain/services/dispute_resolution/service.py

@@ -15,6 +15,7 @@
 """
 
 import logging
+import math
 import time
 import uuid
 from typing import Any
@@ -103,6 +104,12 @@ async def file_dispute(
                 f"Invalid category '{category}'. Must be one of: {sorted(VALID_CATEGORIES)}"
             )
 
+        # Reject NaN/Infinity BEFORE the floor check: every comparison against
+        # NaN is False and inf<floor is False, so a non-finite stake would slip
+        # past `stake_amount < base_stake` and defeat the anti-spam economic guard.
+        if not math.isfinite(stake_amount):
+            raise ValueError(f"Stake amount must be a finite number, got {stake_amount}")
+
         if stake_amount < self._base_stake:
             raise ValueError(
                 f"Stake {stake_amount} below minimum {self._base_stake}"
@@ -342,7 +349,8 @@ async def resolve(self, dispute_id: str) -> dict:
                 juror_count = latest["juror_count"]
 
             jurors = await self.juror_pool.select_jurors(
-                dispute_id, count=juror_count, category=dispute["category"]
+                dispute_id, count=juror_count, category=dispute["category"],
+                exclude={dispute["claimant"], dispute["respondent"]},
             )
             dispute["jurors"] = [j["address"] for j in jurors]
 
@@ -413,11 +421,15 @@ async def appeal(
             new_evidence=new_evidence,
         )
 
-        # Reset dispute for re-adjudication
+        # Reset dispute for re-adjudication. Clearing claims is REQUIRED: any
+        # stake_return / juror_reward recorded against the now-overturned round
+        # must not survive into settlement, or both the round-1 and round-2
+        # "winners" would hold a valid entitlement against the same dispute.
         dispute["status"] = "appealed"
         dispute["appeal_count"] += 1
         dispute["jurors"] = []  # will be re-selected with larger panel
         dispute["outcome"] = None
+        dispute["claims"] = {}
 
         logger.info(
             "Dispute appealed — id=%s appellant=%s level=%d",

tests/test_dispute_vote_claim.py

@@ -105,6 +105,49 @@ async def test_majority_juror_claims_minority_and_stranger_rejected():
         await svc.claim(d["dispute_id"], "0xstranger")
 
 
+@pytest.mark.asyncio
+@pytest.mark.parametrize("bad", ["nan", "inf", "-inf", "Infinity", "NaN", float("nan"), float("inf")])
+async def test_nonfinite_stake_rejected(bad):
+    """NaN/Infinity must not slip past the base-stake floor (all NaN/inf
+    comparisons against the floor are False)."""
+    svc = DisputeResolution(config={})
+    stake = float(bad) if isinstance(bad, str) else bad
+    with pytest.raises(ValueError, match="finite"):
+        await svc.file_dispute(
+            claimant="0xa", respondent="0xb", category="fraud",
+            evidence={"description": "x"}, stake_amount=stake)
+
+
+@pytest.mark.asyncio
+async def test_appeal_clears_stale_claims():
+    """A recorded entitlement must not survive re-adjudication."""
+    svc = DisputeResolution(config={})
+    d = await _filed_dispute(svc)
+    d["status"] = "resolved"
+    d["outcome"] = {"winner": "claimant", "juror_results": {}}
+    await svc.claim(d["dispute_id"], "0xclaimant")
+    assert d.get("claims")  # recorded
+    # Respondent must have staked before appeal is allowed.
+    d["respondent_stake"] = 100.0
+    await svc.appeal(d["dispute_id"], appellant="0xrespondent", new_evidence={})
+    assert d["claims"] == {}   # cleared — no stale entitlement into round 2
+    assert d["outcome"] is None and d["status"] == "appealed"
+
+
+@pytest.mark.asyncio
+async def test_juror_pool_excludes_parties():
+    """A dispute party cannot occupy a juror slot on their own case."""
+    from runtime.blockchain.services.dispute_resolution.juror_pool import JurorPool
+    pool = JurorPool(config={})
+    for addr in ("0xclaimant", "0xj1", "0xj2", "0xj3", "0xj4", "0xj5"):
+        await pool.register_juror(addr, expertise=["fraud"], stake=pool._min_stake)
+    selected = await pool.select_jurors("d1", count=5, category="fraud",
+                                        exclude={"0xclaimant", "0xrespondent"})
+    addrs = {j["address"] for j in selected}
+    assert "0xclaimant" not in addrs
+    assert len(addrs) == 5
+
+
 @pytest.mark.asyncio
 async def test_routes_registered_and_validate(aiohttp_client, tmp_path):
     """400 (required-field validation), never 404 — proves registration."""