fix(fabtoken): validate every input of an HTLC transfer

Signed-off-by: AkramBitar <akram@il.ibm.com>

Author: AkramBitar

.github/workflows/nightly-fuzz.yml

@@ -75,6 +75,9 @@ jobs:
           - name: fabtoken-action-limits
             pkg: ./token/core/fabtoken/v1/validator
             func: FuzzActionResourceLimits
+          - name: fabtoken-transfer-htlc-validate
+            pkg: ./token/core/fabtoken/v1/validator
+            func: FuzzTransferHTLCValidateNoPanic
           - name: zkatdlog-issue-bulletproof-verifier
             pkg: ./token/core/zkatdlog/nogh/v1/issue
             func: FuzzBulletProofVerifierNoPanic

docs/services/interop.md

@@ -56,6 +56,29 @@ which makes clock synchronisation a deployment requirement and sets a lower boun
 deadlines. See
 [HTLC Deadlines and Clock Synchronisation](../security/htlc_deadline_clock_assumptions.md).
 
+### HTLC Validation Rules
+Spending an HTLC-locked token is validated by each token driver's transfer validator
+(`TransferHTLCValidate` in `token/core/fabtoken/v1/validator` and
+`token/core/zkatdlog/nogh/v1/validator`). Both drivers enforce the same rules, so an action
+that is valid under one driver is valid under the other:
+
+*   **1-to-1 transfer only**: if *any* input of a transfer action is owned by an HTLC script,
+    the action must have **exactly one input and exactly one output**. An HTLC-owned input may
+    not be bundled with other inputs, and it may not fan out to several outputs. This matches
+    the `Claim` and `Reclaim` helpers in `token/services/interop/htlc`, which each spend a
+    single unspent token.
+*   **Per-input checks**: the type, quantity, and owner script of the input being spent are
+    checked against the single output; every input is validated on its own terms, never against
+    a fixed index.
+*   **No redeem**: the output corresponding to an HTLC spending must not be a redeem
+    (nil owner).
+*   **Deadline**: on a claim the script's deadline must not yet have passed; after the deadline
+    only the sender's reclaim branch is accepted. A newly created HTLC-locked output must carry
+    a deadline that is still in the future.
+*   **Metadata**: a claim must publish the preimage under the script's claim key; a lock must
+    publish the corresponding lock key. Both are counted so that a single action cannot reuse
+    one metadata entry for several HTLC operations.
+
 ### Cross-Network Finality
 The Interop Service coordinates with the **Network Service** across multiple DLT instances. It monitors the finality of "Lock" transactions on one network before initiating corresponding "Lock" transactions on another, ensuring that the atomic swap protocol can proceed safely.
 

token/core/fabtoken/v1/validator/validator_fuzz_test.go

@@ -7,14 +7,22 @@ SPDX-License-Identifier: Apache-2.0
 package validator_test
 
 import (
+	"context"
+	"crypto"
+	"encoding/json"
 	"testing"
+	"time"
 
 	fbactions "github.com/LFDT-Panurus/panurus/token/core/fabtoken/protos-go/v1/actions"
 	"github.com/LFDT-Panurus/panurus/token/core/fabtoken/v1/actions"
 	"github.com/LFDT-Panurus/panurus/token/core/fabtoken/v1/validator"
 	"github.com/LFDT-Panurus/panurus/token/driver"
 	driverv1 "github.com/LFDT-Panurus/panurus/token/driver/protos-go/v1"
 	"github.com/LFDT-Panurus/panurus/token/driver/protos-go/v1/request"
+	"github.com/LFDT-Panurus/panurus/token/services/identity"
+	"github.com/LFDT-Panurus/panurus/token/services/identity/x509"
+	"github.com/LFDT-Panurus/panurus/token/services/interop/encoding"
+	"github.com/LFDT-Panurus/panurus/token/services/interop/htlc"
 	"github.com/hyperledger-labs/fabric-smart-client/pkg/utils/proto"
 	"github.com/stretchr/testify/require"
 )
@@ -135,3 +143,94 @@ func FuzzActionResourceLimits(f *testing.F) {
 		}
 	})
 }
+
+// isHTLCOwner reports whether raw is a typed identity wrapping an HTLC script.
+func isHTLCOwner(raw []byte) bool {
+	owner, err := identity.UnmarshalTypedIdentity(raw)
+	if err != nil {
+		return false
+	}
+
+	return owner.Type == htlc.ScriptType
+}
+
+// FuzzTransferHTLCValidateNoPanic fuzzes the attacker-controlled owner bytes of the inputs of a
+// transfer action and asserts two properties of TransferHTLCValidate:
+//  1. it never panics, whatever the owner bytes and however many inputs there are;
+//  2. it never accepts an action in which an HTLC-owned input is accompanied by any other input.
+//
+// Property 2 is the regression guard for #2025, where every check in the HTLC branch was
+// hardcoded to InputTokens[0], so inputs 1..n of a multi-input HTLC transfer were never
+// validated and a structurally invalid action was accepted with a nil error.
+func FuzzTransferHTLCValidateNoPanic(f *testing.F) {
+	sender, err := identity.WrapWithType(x509.IdentityType, []byte("sender"))
+	require.NoError(f, err)
+	recipient, err := identity.WrapWithType(x509.IdentityType, []byte("recipient"))
+	require.NoError(f, err)
+
+	preimage := []byte("preimage")
+	hash := crypto.SHA256.New()
+	hash.Write(preimage)
+	img := hash.Sum(nil)
+	script := &htlc.Script{
+		Sender:    sender,
+		Recipient: recipient,
+		Deadline:  time.Now().Add(-1 * time.Hour), // expired -> Reclaim branch
+		HashInfo: htlc.HashInfo{
+			Hash:         img,
+			HashFunc:     crypto.SHA256,
+			HashEncoding: encoding.Base64,
+		},
+	}
+	scriptBytes, err := json.Marshal(script)
+	require.NoError(f, err)
+	htlcOwner, err := identity.WrapWithType(htlc.ScriptType, scriptBytes)
+	require.NoError(f, err)
+
+	// WrapWithType returns identity.Identity, a named []byte; f.Add requires the exact
+	// parameter types of the fuzz target, hence the explicit conversions.
+	htlcRaw, senderRaw := []byte(htlcOwner), []byte(sender)
+	f.Add(1, htlcRaw, senderRaw)   // valid single-input reclaim
+	f.Add(2, htlcRaw, htlcRaw)     // #2025 reproduction shape
+	f.Add(2, htlcRaw, senderRaw)   // htlc input plus an unrelated input
+	f.Add(2, senderRaw, htlcRaw)   // htlc input at a non-zero index
+	f.Add(1, senderRaw, senderRaw) // no htlc at all
+	f.Add(1, []byte{}, senderRaw)  // empty owner
+	f.Add(1, []byte("trunc"), senderRaw)
+	f.Add(3, htlcRaw, scriptBytes) // unwrapped script bytes as an owner
+
+	f.Fuzz(func(t *testing.T, inputs int, owner0, owner1 []byte) {
+		n := boundInt(inputs, 1, 8)
+
+		inputTokens := make([]*actions.Output, 0, n)
+		signatures := make([][]byte, 0, n)
+		for i := range n {
+			owner := owner0
+			if i%2 == 1 {
+				owner = owner1
+			}
+			inputTokens = append(inputTokens, &actions.Output{Owner: owner, Type: "ABC", Quantity: "100"})
+			signatures = append(signatures, []byte("sig"))
+		}
+
+		c := &validator.Context{
+			TransferAction: &actions.TransferAction{
+				Outputs: []*actions.Output{{Owner: sender, Type: "ABC", Quantity: "100"}},
+			},
+			InputTokens:     inputTokens,
+			Signatures:      signatures,
+			MetadataCounter: make(map[string]int),
+		}
+
+		var err error
+		require.NotPanics(t, func() {
+			err = validator.TransferHTLCValidate(context.Background(), c)
+		})
+
+		// An HTLC-owned input may only be spent by a 1-to-1 transfer: as soon as there is
+		// more than one input, the action must be rejected.
+		if n > 1 && (isHTLCOwner(owner0) || isHTLCOwner(owner1)) {
+			require.Error(t, err, "multi-input transfer with an htlc-owned input must be rejected")
+		}
+	})
+}