Merge branch 'andrius/audit-fixes-2026-05-14' into 'main'

Audit fixes for report 2026-05-14

See merge request flarenetwork/ftso/fast-updates!42

Author: adg-flare

go-client/client/client.go

@@ -164,16 +164,11 @@ func CreateFastUpdatesClient(cfg *config.Config, valuesProvider provider.ValuesP
 	}
 
 	if cfg.Client.SortitionPrivateKey == "" {
-		fastUpdatesClient.key, err = sortition.KeyGen()
-		if err != nil {
-			return nil, fmt.Errorf("CreateFastUpdatesClient: KeyGen: %w", err)
-		}
-		logger.Info("generated new private sortition key: %s", "0x"+fastUpdatesClient.key.Sk.Text(16))
-	} else {
-		fastUpdatesClient.key, err = sortition.KeyFromString(cfg.Client.SortitionPrivateKey)
-		if err != nil {
-			return nil, fmt.Errorf("CreateFastUpdatesClient: KeyGen: %w", err)
-		}
+		return nil, fmt.Errorf("CreateFastUpdatesClient: sortition_private_key must be provided via configuration")
+	}
+	fastUpdatesClient.key, err = sortition.KeyFromString(cfg.Client.SortitionPrivateKey)
+	if err != nil {
+		return nil, fmt.Errorf("CreateFastUpdatesClient: KeyFromString: %w", err)
 	}
 
 	fastUpdatesClient.registeredEpochs = make(map[int64]bool)

go-client/config.toml

@@ -2,8 +2,12 @@
 # Use --config parameter to specify the path to the configuration file.
 
 [client]
-signing_private_key = "0xd49743deccbccc5dc7baa8e69e5be03298da8688a15dd202e20f15d5e0e9a9fb"
-sortition_private_key = "0xd49743deccbccc5dc7baa8e69e5be03298da8688a15dd202e20f15d5e0e9a9fb"
+# Voter signing key registered in VoterRegistry. 32-byte hex string.
+# Example: "0xd49743deccbccc5dc7baa8e69e5be03298da8688a15dd202e20f15d5e0e9a9fb"
+signing_private_key = ""
+# Sortition key registered in VoterRegistry, used to generate verifiable
+# randomness for submission ordering. 32-byte hex string. See keygen/.
+sortition_private_key = ""
 fast_updater_address = "0x9B931f5d3e24fc8C9064DB35bDc8FB4bE0E862f9"
 fast_updates_configuration_address = "0x9A53e14B58383642cdB2bb4D5C46989F05C6B5f9"
 submission_address = "0x2cA6571Daa15ce734Bbd0Bf27D5C9D16787fc33f"
@@ -15,11 +19,15 @@ max_weight = 512
 value_provider_url = "http://127.0.0.1:3101/feed-values/0"
 
 [transactions]
-accounts = [
-    "0xd49743deccbccc5dc7baa8e69e5be03298da8688a15dd202e20f15d5e0e9a9fb",
-    "0x23c601ae397441f3ef6f1075dcb0031ff17fb079837beadaf3c84d96c6f3e569",
-    "0xee9d129c1997549ee09c0757af5939b2483d80ad649a0eda68e8b0357ad11131",
-]
+# Funded EOA private keys used to submit fast-update transactions.
+# Multiple accounts let the client submit in parallel for the same
+# block window. Each entry is a 32-byte hex string.
+# Example:
+# accounts = [
+#     "0xd49743deccbccc5dc7baa8e69e5be03298da8688a15dd202e20f15d5e0e9a9fb",
+#     "0x23c601ae397441f3ef6f1075dcb0031ff17fb079837beadaf3c84d96c6f3e569",
+# ]
+accounts = []
 gas_limit = 2500000
 value = 0
 gas_price_multiplier = 2.5

go-client/provider/feed_provider.go

@@ -98,16 +98,18 @@ func StringToDeltas(update string) []byte {
 	return deltas
 }
 
-// Sorts values according to feeds order.
+// Sorts values according to feeds order, returning nil for any
+// requested feed not present in feedValues so the caller can rely on
+// positional indexing.
 func sortFeedValues(feeds []FeedId, feedValues []FeedValue) []*float64 {
-	var values []*float64
-	for _, feed := range feeds {
-		for _, v := range feedValues {
-			if v.Feed == feed {
-				values = append(values, v.Value)
-				break
-			}
-		}
+	valuesByFeed := make(map[FeedId]*float64, len(feedValues))
+	for _, v := range feedValues {
+		valuesByFeed[v.Feed] = v.Value
+	}
+
+	values := make([]*float64, len(feeds))
+	for i, feed := range feeds {
+		values[i] = valuesByFeed[feed]
 	}
 	return values
 }