canton: pin guardianGovernance on fee-charging CoreState references#41
Merged
bengtlofgren merged 1 commit intoJul 16, 2026
Merged
Conversation
Emitter.PublishMessage, EmitterRegistry.RegisterEmitter, and ReplayRootRegistry.ClaimReplayRoot authenticated a caller-supplied CoreState cid by comparing only its operator field. operator does not determine guardianGovernance (fee custody's actual trust anchor), so a real or compromised operator could co-sign a second, fully valid CoreState around an attacker-controlled guardianGovernance/feeRecipient and redirect real fee payments -- proven with a working PoC. Add a GetGuardianGovernance read choice (reusing the shape already added independently on canton-keyed-ntt, so that branch can drop its duplicate on rebase), store an immutable guardianGovernance anchor on the three fee-charging templates, and pin it before every charge alongside the existing operator check. Three new regression tests construct a genuine forged CoreState and confirm each charge now fails specifically on the new check. Claude-Session: https://claude.ai/code/session_01VFr5RtBKysvjdRN2nKmhMV
This was referenced Jul 16, 2026
3 tasks
bengtlofgren
added a commit
to wormholelabs-xyz/native-token-transfers
that referenced
this pull request
Jul 16, 2026
…ease wormholelabs-xyz/wormhole#41 merged and cut an official DAR release (canton-core-v0.2.0, built from integration/canton b5f88c38b). Replace the interim local-build artifact with the released one and update its sha256 and provenance note. Rebuilt all 4 packages and reran the full test suite against the new DAR: 37/37 passing.
This was referenced Jul 16, 2026
bengtlofgren
added a commit
that referenced
this pull request
Jul 16, 2026
…ew) (#45) #41 merged directly without going through PR review. Reverting the functional changes (the GetGuardianGovernance choice, the guardianGovernance field on Emitter/EmitterRegistry/ReplayRootRegistry, the pin assertions at the three fee-charging call sites, and the 3 regression tests proving them) so the fix can go through proper review this time. Deliberately does NOT touch #44 (comment cleanup) or anything else merged since -- only the functional pieces #41 introduced, hand-picked out of the current tree so #44's independent comment tightening survives untouched in the same files. Verified: dpm build clean, 41/41 tests passing (44 minus the 3 regression tests testing now-reverted functionality). A follow-up PR (the literal git revert of this commit) will re-propose adding this back, for review this time.
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Emitter.PublishMessage,EmitterRegistry.RegisterEmitter, andReplayRootRegistry.ClaimReplayRootauthenticated a caller-suppliedCoreStatecid by comparing only itsoperatorfield.operatordoes not determineguardianGovernance(fee custody's actual trust anchor), so a real or compromised operator could co-sign a second, fully validCoreStatearound an attacker-controlledguardianGovernance/feeRecipientand redirect real fee payments — proven with a working PoC during review.GetGuardianGovernanceread choice onCoreState, an immutableguardianGovernanceanchor on the three fee-charging templates, and a pin at all three call sites before every charge, alongside the existingoperatorcheck.CoreStateand confirm each charge now fails specifically on the new"guardianGovernance mismatch"check (verified by temporarily neutering the assertion and confirming the tests then fail via the "accepted a shadow CoreState" path, before reverting).Coordination note
canton-keyed-ntt(#30) already added an identicalGetGuardianGovernancechoice (same name/signature/doc) for NTT's inbound VAA verification, independently, for a different call site. Whichever of these two PRs lands second should rebase and drop its now-duplicate copy — the choice only needs to exist once.Test plan
dpm buildclean onwormhole-coreandwormhole-core-testdpm test: 44/44 passing, including the 3 new regression testshttps://claude.ai/code/session_01VFr5RtBKysvjdRN2nKmhMV