feat(precompiles): add native multisig storage

[joshieDo]

Adds the unregistered native multisig precompile with one-slot commitment storage, ABI dispatch, state validation, and quorum verification.

Stacked on #7236; reference implementation: #4069.

[github-actions]

✅ Changelog found on PR.

Edit changelog

[github-actions]

📊 Tempo Precompiles Coverage

precompiles

Coverage: 6446/10883 lines (59.23%)

File details

File	Lines	Coverage
src/account_keychain/dispatch.rs	16/42	38.10%
src/account_keychain/mod.rs	309/914	33.81%
src/address_registry/dispatch.rs	21/27	77.78%
src/address_registry/mod.rs	50/60	83.33%
src/current_committee/dispatch.rs	0/9	0.00%
src/current_committee/mod.rs	0/18	0.00%
src/dispatch.rs	126/152	82.89%
src/error.rs	52/169	30.77%
src/ip_validation.rs	10/10	100.00%
src/lib.rs	130/156	83.33%
src/native_multisig/auth.rs	0/106	0.00%
src/native_multisig/dispatch.rs	0/14	0.00%
src/native_multisig/mod.rs	0/118	0.00%
src/nonce/dispatch.rs	6/7	85.71%
src/nonce/mod.rs	44/58	75.86%
src/receive_policy_guard/dispatch.rs	0/12	0.00%
src/receive_policy_guard/mod.rs	0/139	0.00%
src/signature_verifier/dispatch.rs	15/23	65.22%
src/signature_verifier/mod.rs	13/55	23.64%
src/stablecoin_dex/dispatch.rs	59/71	83.10%
src/stablecoin_dex/mod.rs	998/1097	90.98%
src/stablecoin_dex/order/mod.rs	120/154	77.92%
src/stablecoin_dex/order/storage.rs	178/249	71.49%
src/stablecoin_dex/orderbook.rs	183/242	75.62%
src/storage/actions.rs	11/90	12.22%
src/storage/evm.rs	390/440	88.64%
src/storage/hashmap.rs	0/249	0.00%
src/storage/mod.rs	27/69	39.13%
src/storage/packing.rs	68/93	73.12%
src/storage/thread_local.rs	200/300	66.67%
src/storage/types/array.rs	0/72	0.00%
src/storage/types/bytes_like.rs	135/179	75.42%
src/storage/types/cache.rs	65/122	53.28%
src/storage/types/mapping.rs	27/48	56.25%
src/storage/types/mod.rs	47/71	66.20%
src/storage/types/primitives.rs	21/24	87.50%
src/storage/types/set.rs	28/192	14.58%
src/storage/types/slot.rs	80/101	79.21%
src/storage/types/vec.rs	103/261	39.46%
src/storage_credits/accounting.rs	79/92	85.87%
src/storage_credits/dispatch.rs	16/16	100.00%
src/storage_credits/mod.rs	138/193	71.50%
src/tip20/dispatch.rs	64/73	87.67%
src/tip20/mod.rs	657/801	82.02%
src/tip20/rewards.rs	242/260	93.08%
src/tip20/roles.rs	85/88	96.59%
src/tip20_channel_reserve/dispatch.rs	0/42	0.00%
src/tip20_channel_reserve/mod.rs	3/548	0.55%
src/tip20_factory/dispatch.rs	9/11	81.82%
src/tip20_factory/mod.rs	117/140	83.57%
src/tip403_registry/dispatch.rs	29/46	63.04%
src/tip403_registry/mod.rs	347/544	63.79%
src/tip_fee_manager/amm.rs	295/465	63.44%
src/tip_fee_manager/dispatch.rs	35/37	94.59%
src/tip_fee_manager/mod.rs	56/155	36.13%
src/validator_config/dispatch.rs	18/28	64.29%
src/validator_config/mod.rs	171/227	75.33%
src/validator_config_v2/dispatch.rs	30/33	90.91%
src/validator_config_v2/mod.rs	523/581	90.02%
src/zone_factory/dispatch.rs	0/15	0.00%
src/zone_factory/mod.rs	0/215	0.00%
src/zone_factory/portal.rs	0/60	0.00%

contracts

Coverage: 1/223 lines (0.45%)

File details

File	Lines	Coverage
src/lib.rs	1/1	100.00%
src/precompiles/receive_policy_guard.rs	0/78	0.00%
src/precompiles/storage_credits.rs	0/7	0.00%
src/precompiles/tip20.rs	0/50	0.00%
src/precompiles/tip20_channel_reserve.rs	0/27	0.00%
src/precompiles/tip403_registry.rs	0/9	0.00%
src/precompiles/validator_config_v2.rs	0/3	0.00%
src/precompiles/zone_factory.rs	0/48	0.00%

Total: 6447/11106 lines (58.05%)

📦 Download full HTML report

[joshieDo]

cyclops audit fast note="this belongs to the GH stack #7243 and the TIP 1061 is specified in the PR 7242. any bug not introduced by this PR should be clearly marked"

[tempoxyz-bot]

👁️ Cyclops Review

This change adds native multisig configuration storage, authorization helpers, and ABI dispatch scaffolding. The core quorum, storage, and versioning logic is well bounded, but three low-severity issues remain around reserved-address eligibility, state-dependent error classification, and authorization/config binding.

Reviewer Callouts

• ⚡ T11 activation wiring: The precompile is not registered or boundary-deployed in this PR, and its dispatch selectors have no local T11 gate. When wiring lands, ensure lookup and deployment activate together at T11 to avoid transaction-validity divergence.
• ⚡ Bootstrap preconditions: store_initial_config does not enforce the TIP's zero-nonce, empty-code, and no-EIP-7702-delegation requirements. Confirm the eventual caller enforces all three and preserves bootstrap writes across later call reverts.
• ⚡ Nested owner checks: The eventual nested-config callback must also reject nested owners with bytecode or EIP-7702 delegation.
• ⚡ Canonical owner source: Future authorization code must use the canonical ordered owner list rather than raw read_owner_weight mapping rows.
• ⚡ Reconstructed config salt: load_registered_config reconstructs InitMultisig with a zero salt, so account() does not recover the registered account. Consider a dedicated type or explicit API documentation before adding consumers.

[joshieDo]

cyclops audit fast note="this belongs to the GH stack #7243 and the TIP 1061 is specified in the PR 7242. any bug not introduced by this PR should be clearly marked"

[tempoxyz-bot]

👁️ Cyclops Review

Two verified Low-severity correctness issues were found. No exploitable consensus or state-transition vulnerability was identified.

Reviewer Callouts

• ⚡ Authorization/config binding: NativeMultisigAuthConfig::matches_signature does not bind Registered or BootstrapCompanion configurations to signature.account(). Current planned callers enforce this, but future pool or RPC callers must preserve the implicit contract.
• ⚡ Transient bootstrap guard: bootstrapped_account relies on transient storage being cleared between transactions rather than an explicit reset. Confirm that integration preserves this lifecycle assumption.
• ⚡ Storage-credit accounting: Bootstrap owner-set writes bypass TIP-1060 accounting while updates use the metered path. Confirm that intrinsic gas covers bootstrap slots as TIP-1061 requires.

[joshieDo]

cyclops audit fast note="this belongs to the GH stack #7243 and the TIP 1061 is specified in the PR 7242. any bug not introduced by this PR should be clearly marked"

[tempoxyz-bot]

👁️ Cyclops Review

This PR adds the storage, validation, and authorization foundations for TIP-1061 native multisig accounts. The precompile is not registered yet, so the two defense-in-depth findings are latent rather than exploitable on the current production path.

Reviewer Callouts

• ⚡ T11 wiring: Add the hardfork-gated lookup, reserve NATIVE_MULTISIG_ADDRESS in SYSTEM_PRECOMPILES, and seed tx_origin together.
• ⚡ Bootstrap preconditions: Confirm the handler checks zero nonce, empty code, and no delegation before storage writes or nonce consumption.
• ⚡ Authorization error contract: Re-check InvalidTransaction / ValidationFailed / Fatal classifications when the handler consumer lands.

[joshieDo]

cyclops audit fast note="this belongs to the GH stack #7243 and the TIP 1061 is specified in the PR 7242. any bug not introduced by this PR should be clearly marked"