canton: pin guardianGovernance on fee-charging CoreState references (#41)

Emitter.PublishMessage, EmitterRegistry.RegisterEmitter, and
ReplayRootRegistry.ClaimReplayRoot authenticated a caller-supplied CoreState
cid by comparing only its operator field. operator does not determine
guardianGovernance (fee custody's actual trust anchor), so a real or
compromised operator could co-sign a second, fully valid CoreState around an
attacker-controlled guardianGovernance/feeRecipient and redirect real fee
payments -- proven with a working PoC.

Add a GetGuardianGovernance read choice (reusing the shape already added
independently on canton-keyed-ntt, so that branch can drop its duplicate on
rebase), store an immutable guardianGovernance anchor on the three
fee-charging templates, and pin it before every charge alongside the
existing operator check. Three new regression tests construct a genuine
forged CoreState and confirm each charge now fails specifically on the new
check.

Claude-Session: https://claude.ai/code/session_01VFr5RtBKysvjdRN2nKmhMV

Author: bengtlofgren

canton/README.md

@@ -211,11 +211,17 @@ across guardian rotation). Two things follow:
 - **The operator cannot forge the guardian set.** Because `guardianGovernance`
   is a signatory, a compromised operator cannot `create` a `CoreState` bearing
   the real governance party — so any fetched or disclosed `CoreState` whose
-  `guardianGovernance` (or `operator`) field is the known anchor party is
-  **authentic by construction**, however its cid was obtained. Consumers
-  authenticate the payload, never the resolution path (§4.7). An operator
-  puppet could create a `CoreState` under a *different* governance party — but
-  its payload names the wrong parties and no consumer trusts it.
+  `guardianGovernance` field is the known anchor party is **authentic by
+  construction**, however its cid was obtained. Consumers authenticate the
+  payload, never the resolution path (§4.7). An operator puppet could create a
+  `CoreState` under a *different* governance party — but its payload names the
+  wrong parties and no consumer trusts it. **Pinning `operator` is weaker than
+  pinning `guardianGovernance`, and the two are not interchangeable:** a
+  compromised operator (a single hot key) *can* co-sign a `CoreState` whose
+  `operator` field is genuine but whose `guardianGovernance`/`feeRecipient` it
+  controls, so an `operator`-only pin accepts a shadow `CoreState`. For the fee
+  path — where `guardianGovernance` *is* the fee-custody anchor — only the
+  `guardianGovernance` pin is sufficient (see below).
 - **Governance stays low-friction.** `guardianGovernance` actively signs only at
   **genesis**; each `SubmitGovernanceVAA` transition inherits its authority from
   the archived contract (the same authority-propagation as the `Emitter` owner
@@ -412,11 +418,20 @@ instruments is a genesis-class ceremony):
   (NTT §10): `payer` co-controls the publish, so it cannot be a third party
   who did not authorize spending its own funds. Registries charge their own
   operator-set `registrationFee`/`claimFee` through the same choice; at fee 0
-  they skip the `CoreState` entirely.
+  they skip the `CoreState` entirely. Before charging, every call site pins the
+  `CoreState`'s authenticity by exercising `GetGuardianGovernance` and checking
+  it against the `guardianGovernance` committed on the emitter/registry —
+  **pinning the fee-custody anchor, not merely the `operator`** — so a forged
+  `CoreState` cannot redirect the fee (see the custody bullet).
 - **Custody is governance-controlled**: `feeRecipient` is the
   `guardianGovernance` threshold party, so accrued fees move only via the
   k-of-n guardian ceremony — the operator never touches them (the Canton
-  analog of "fees sit in the bridge contract"). A `TransferFees` governance
+  analog of "fees sit in the bridge contract"). This holds **even against a
+  compromised operator hot key**: because each charge pins `guardianGovernance`
+  (which a single operator key cannot forge — it is the guardians' k-of-n
+  external party) rather than `operator`, an operator that co-signs a shadow
+  `CoreState` under a throwaway `guardianGovernance`/`feeRecipient` it controls
+  is rejected at the pin before any funds move. A `TransferFees` governance
   VAA mints an on-ledger `FeeWithdrawalAuthorization` (signed by
   guardianGovernance, authority inherited from the consumed `CoreState`)
   recording the amount, the VAA's 32-byte recipient, and the VAA hash — the

canton/core/daml/Wormhole/Core/Fees.daml

@@ -20,6 +20,17 @@
 -- structurally: a foreign allocation's sender is a required controller the
 -- transaction never has.
 --
+-- The "blocks theft structurally" guarantee presupposes an AUTHENTIC
+-- 'CoreState' — a rogue one routes @receiver = feeRecipient@ to an
+-- attacker-controlled party. Authenticity is now pinned by the caller before
+-- every charge: each call site ('PublishMessage', 'RegisterEmitter',
+-- 'ClaimReplayRoot') exercises 'Wormhole.Core.State.GetGuardianGovernance' and
+-- checks it against the @guardianGovernance@ committed on the
+-- emitter/registry. Pinning @guardianGovernance@ (not just the operator)
+-- resists a compromised operator: the operator alone does not determine
+-- @feeRecipient@, so a shadow 'CoreState' the operator co-signs under a
+-- throwaway gg is rejected before any funds move.
+--
 -- AUTHENTICITY: allocation views are template-computed and forgeable — a
 -- hostile template can claim any instrument while moving nothing. The pin is
 -- the instrument admin's SIGNATURE on the allocation contract (amulet

canton/core/daml/Wormhole/Core/Setup.daml

@@ -60,14 +60,20 @@ mkInitialCoreState operator guardianGovernance govChain govContract initialGuard
 
 -- | The emitter-id registry the operator creates alongside the 'CoreState' at
 -- setup. Emitter ids are allocated sequentially; it also carries
--- @guardianObserver@ for 'RegisterEmitter' to thread into each 'Emitter'.
-mkInitialEmitterRegistry : Party -> Party -> Int -> EmitterRegistry
-mkInitialEmitterRegistry operator guardianObserver registrationFee =
-  EmitterRegistry with operator, guardianObserver, registrationFee, nextId = 0
+-- @guardianGovernance@ (the CoreState fee-custody anchor, pinned by
+-- 'RegisterEmitter' and threaded into each 'Emitter') and @guardianObserver@
+-- (threaded into each 'Emitter'). Pass the same @guardianGovernance@ the
+-- 'CoreState' was created with.
+mkInitialEmitterRegistry : Party -> Party -> Party -> Int -> EmitterRegistry
+mkInitialEmitterRegistry operator guardianGovernance guardianObserver registrationFee =
+  EmitterRegistry with operator, guardianGovernance, guardianObserver, registrationFee, nextId = 0
 
 -- | The replay-root registry (the stateless claim anchor) the operator
 -- creates alongside the 'CoreState' at setup. Hands a 'ReplayNode' trie root
--- to any consumer that claims one (see 'Wormhole.Core.Replay').
-mkInitialReplayRootRegistry : Party -> Int -> ReplayRootRegistry
-mkInitialReplayRootRegistry operator claimFee =
-  ReplayRootRegistry with operator, claimFee
+-- to any consumer that claims one (see 'Wormhole.Core.Replay'). Carries
+-- @guardianGovernance@ (the CoreState fee-custody anchor, pinned by
+-- 'ClaimReplayRoot'); pass the same @guardianGovernance@ the 'CoreState' was
+-- created with.
+mkInitialReplayRootRegistry : Party -> Party -> Int -> ReplayRootRegistry
+mkInitialReplayRootRegistry operator guardianGovernance claimFee =
+  ReplayRootRegistry with operator, guardianGovernance, claimFee

canton/core/daml/Wormhole/Core/State.daml

@@ -18,7 +18,15 @@
 -- never on how the cid was resolved: signatories cannot be forged, so a
 -- fetched or disclosed 'CoreState' whose @guardianGovernance@ field is the
 -- known governance party is authentic by construction — a compromised
--- @operator@ cannot fabricate one (it lacks that signature). Two invariants:
+-- @operator@ cannot fabricate one (it lacks that signature). The fee-custody
+-- anchor is pinned exactly this way: the fee-charging call sites
+-- ('PublishMessage', 'RegisterEmitter', 'ClaimReplayRoot') exercise
+-- 'GetGuardianGovernance' and compare it against the @guardianGovernance@
+-- committed on the emitter/registry BEFORE charging. Pinning @guardianGovernance@
+-- rather than @operator@ is what makes this hold against a compromised operator:
+-- @operator@ alone does not determine @feeRecipient@, so an operator co-signing a
+-- shadow 'CoreState' under a throwaway gg would pass an operator-pin but cannot
+-- forge the real gg (see 'GetGuardianGovernance'). Two invariants:
 --   * 'CoreState' singleton: co-signed by the @operator@ and a @guardianGovernance@
 --     party. The @guardianGovernance@ party is the guardians' governance anchor —
 --     in production a decentralized-namespace external party controlled by a
@@ -189,6 +197,24 @@ template CoreState
       controller reader
       do pure operator
 
+    -- | Read the @guardianGovernance@ anchor off an authentic 'CoreState' — a
+    -- STRONGER caller-side pin than 'GetOperator' for consumers that must resist
+    -- a compromised operator, not just a third-party forgery. A 'CoreState'
+    -- requires only SOME (operator, gg) signature pair, so an operator whose key
+    -- is compromised can co-sign a forged 'CoreState' (with a throwaway gg party
+    -- it controls and an attacker guardian set) that still passes an
+    -- operator-pin. Pinning @guardianGovernance@ closes that: gg is the
+    -- guardians' k-of-n external threshold party, whose signature a compromised
+    -- operator (a single hot participant key) cannot produce — so no forged
+    -- 'CoreState' can carry the real gg. Used by 'Wormhole.Ntt.Manager.Receive'
+    -- and the 'CoreState' fee-charging pins ('PublishMessage', 'RegisterEmitter',
+    -- 'ClaimReplayRoot').
+    nonconsuming choice GetGuardianGovernance : Party
+      with
+        reader : Party
+      controller reader
+      do pure guardianGovernance
+
     -- | Charge the governance-set per-publish fee ('messageFee'). Lives here —
     -- not on 'Emitter' — for two reasons: the fee amount is only knowable from
     -- this contract, and executing the allocation needs the FEE RECIPIENT'S
@@ -389,12 +415,15 @@ emitterAddressFor registrar owner emitterId =
 -- signature it lacks (see 'Emitter').
 template EmitterRegistry
   with
-    operator         : Party
-    guardianObserver : Party  -- threaded into each new Emitter by RegisterEmitter
-    registrationFee  : Int    -- onboarding fee, 10^-10 CoreState.feeInstrument
-                              -- units; operator-set at creation (archive +
-                              -- recreate to change), 0 for free registration
-    nextId           : Int
+    operator           : Party
+    guardianGovernance : Party  -- CoreState fee-custody trust anchor; pinned (NOT
+                                -- a signatory) in RegisterEmitter's fee charge so
+                                -- a forged CoreState under a rogue gg is rejected
+    guardianObserver   : Party  -- threaded into each new Emitter by RegisterEmitter
+    registrationFee    : Int    -- onboarding fee, 10^-10 CoreState.feeInstrument
+                                -- units; operator-set at creation (archive +
+                                -- recreate to change), 0 for free registration
+    nextId             : Int
   where
     signatory operator
 
@@ -415,12 +444,17 @@ template EmitterRegistry
       controller requester
       do
         -- Zero-fee registrations never touch the CoreState (single-disclosure
-        -- onboarding); fee'd ones charge through it, pinning its operator so a
-        -- fabricated CoreState cannot waive or redirect the fee.
+        -- onboarding); fee'd ones charge through it. The gg pin runs BEFORE the
+        -- charge: pinning @guardianGovernance@ (not just the operator) rejects a
+        -- CoreState a compromised operator co-signed under a throwaway gg it
+        -- controls — the operator field would match, but the fee-custody anchor
+        -- would not, so a forged CoreState cannot redirect the registration fee.
         case (registrationFee > 0, coreStateCid) of
           (False, _) -> pure ()
           (True, None) -> abort "registration fee due: pass the CoreState"
           (True, Some csCid) -> do
+            csGg <- exercise csCid GetGuardianGovernance with reader = requester
+            assertMsg "core state guardianGovernance mismatch" (csGg == guardianGovernance)
             csOperator <- exercise csCid ChargeFee with
               payer = requester
               fee = registrationFee
@@ -429,6 +463,7 @@ template EmitterRegistry
         reg' <- create this with nextId = nextId + 1
         emitter <- create Emitter with
           operator
+          guardianGovernance
           owner = requester
           guardianObserver
           emitterId = nextId
@@ -458,10 +493,13 @@ template EmitterRegistry
 -- contract grows.
 template ReplayRootRegistry
   with
-    operator : Party
-    claimFee : Int  -- onboarding fee, 10^-10 CoreState.feeInstrument units;
-                    -- operator-set at creation (archive + recreate to
-                    -- change), 0 for free claims
+    operator           : Party
+    guardianGovernance : Party  -- CoreState fee-custody trust anchor; pinned (NOT
+                                -- a signatory) in ClaimReplayRoot's fee charge so
+                                -- a forged CoreState under a rogue gg is rejected
+    claimFee           : Int    -- onboarding fee, 10^-10 CoreState.feeInstrument
+                                -- units; operator-set at creation (archive +
+                                -- recreate to change), 0 for free claims
   where
     signatory operator
 
@@ -473,13 +511,18 @@ template ReplayRootRegistry
         feeAllocation  : Optional (ContractId Allocation, ExtraArgs)
       controller consumer
       do
-        -- Zero-fee claims never touch the CoreState; fee'd ones charge
-        -- through it, pinning its operator so a fabricated CoreState cannot
-        -- waive or redirect the fee (see README §4.2).
+        -- Zero-fee claims never touch the CoreState; fee'd ones charge through
+        -- it. The gg pin runs BEFORE the charge: pinning @guardianGovernance@
+        -- (not just the operator) rejects a CoreState a compromised operator
+        -- co-signed under a throwaway gg it controls — the operator field would
+        -- match, but the fee-custody anchor would not, so a forged CoreState
+        -- cannot redirect the claim fee (see README §4.2).
         case (claimFee > 0, coreStateCid) of
           (False, _) -> pure ()
           (True, None) -> abort "claim fee due: pass the CoreState"
           (True, Some csCid) -> do
+            csGg <- exercise csCid GetGuardianGovernance with reader = consumer
+            assertMsg "core state guardianGovernance mismatch" (csGg == guardianGovernance)
             csOperator <- exercise csCid ChargeFee with
               payer = consumer
               fee = claimFee
@@ -498,12 +541,15 @@ template ReplayRootRegistry
 -- authority). Mirrors a Sui @EmitterCap@.
 template Emitter
   with
-    operator         : Party
-    owner            : Party
-    guardianObserver : Party  -- read-only guardian observer
-    emitterId        : Int      -- registry-allocated
-    emitterAddress   : Bytes32  -- emitterAddressFor operator owner emitterId, set at creation
-    sequence         : Int      -- next sequence to assign
+    operator           : Party
+    guardianGovernance : Party  -- CoreState fee-custody trust anchor; pinned (NOT
+                                -- a signatory) in PublishMessage's fee charge so
+                                -- a forged CoreState under a rogue gg is rejected
+    owner              : Party
+    guardianObserver   : Party  -- read-only guardian observer
+    emitterId          : Int      -- registry-allocated
+    emitterAddress     : Bytes32  -- emitterAddressFor operator owner emitterId, set at creation
+    sequence           : Int      -- next sequence to assign
   where
     -- Owner co-signs: only a transaction carrying the owner's authority can create
     -- a contract whose derived address is the owner's. This is the invariant
@@ -550,6 +596,13 @@ template Emitter
         feeAllocation    : Optional (ContractId Allocation, ExtraArgs)
       controller owner, payer
       do
+        -- Pin the fee-custody anchor BEFORE charging: 'guardianGovernance' (not
+        -- just the operator) is what determines where the fee lands. A
+        -- compromised operator can co-sign a forged CoreState under a throwaway
+        -- gg it controls — the operator field would match, but this check
+        -- rejects it, so the message fee cannot be redirected.
+        csGg <- exercise coreStateCid GetGuardianGovernance with reader = payer
+        assertMsg "core state guardianGovernance mismatch" (csGg == guardianGovernance)
         csOperator <- exercise coreStateCid ChargeMessageFee with
           payer
           feeAllocation

canton/test/daml/Test/TestCore.daml

@@ -56,8 +56,8 @@ setupWithInstrument mInstrument = do
     createCmd (mkInitialCoreState operator guardianGovernance solanaGovernanceChainId
                  defaultGovernanceContract [devnetGuardian] guardianObserver
                  feeInstrument guardianGovernance)
-  _ <- submit operator do createCmd (mkInitialEmitterRegistry operator guardianObserver 0)
-  _ <- submit operator do createCmd (mkInitialReplayRootRegistry operator 0)
+  _ <- submit operator do createCmd (mkInitialEmitterRegistry operator guardianGovernance guardianObserver 0)
+  _ <- submit operator do createCmd (mkInitialReplayRootRegistry operator guardianGovernance 0)
   pure (operator, guardianObserver, csId)
 
 -- | Register an emitter for @owner@, the production way: the requester submits
@@ -170,13 +170,15 @@ testImpersonationBlocked = do
   -- (a) Operator-alone forgery of Alice's address is impossible.
   submitMustFail operator do
     createCmd Emitter with
-      operator, owner = alice, guardianObserver, emitterId = 0
+      operator, guardianGovernance = a.guardianGovernance, owner = alice
+      guardianObserver, emitterId = 0
       emitterAddress = a.emitterAddress, sequence = 0
 
   -- (b) Operator + Mallory can create a same-id emitter, but its address differs.
   malloryEm <- submit (actAs operator <> actAs mallory) do
     createCmd Emitter with
-      operator, owner = mallory, guardianObserver, emitterId = 0
+      operator, guardianGovernance = a.guardianGovernance, owner = mallory
+      guardianObserver, emitterId = 0
       emitterAddress = emitterAddressFor operator mallory 0, sequence = 0
   Some m <- queryContractId mallory malloryEm
   assert (m.emitterAddress /= a.emitterAddress)