Skip to content

fix(server): validate auth commitments against initial account state#109

Open
HiteshMittal07 wants to merge 1 commit intoOpenZeppelin:mainfrom
HiteshMittal07:fix/validate-account-auth-config
Open

fix(server): validate auth commitments against initial account state#109
HiteshMittal07 wants to merge 1 commit intoOpenZeppelin:mainfrom
HiteshMittal07:fix/validate-account-auth-config

Conversation

@HiteshMittal07
Copy link
Copy Markdown

Overview
Ensures that the cosigner_commitments provided during account initialization exactly match the actual state of the account.

Changes

  • Validation Logic: Extracts expected auth configuration from the initial_state and compares it against the client-provided auth.
  • Security Fix: Rejects the configuration request if there is a mismatch, preventing the storage of unauthorized or incorrect signer lists in metadata.
  • Tests: Added test_configure_account_auth_mismatch and updated existing service tests to verify the enforcement of this consistency check.

Verification
Verified via unit tests: cargo test services::configure_account::tests (All 4 tests passed).

Fixes #102

@github-actions
Copy link
Copy Markdown

github-actions bot commented Jan 28, 2026

All contributors have signed the CLA ✍️ ✅
Posted by the CLA Assistant Lite bot.

@HiteshMittal07
Copy link
Copy Markdown
Author

I confirm that I have read and hereby agree to the OpenZeppelin Contributor License Agreement

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Validate cosigner_commitments on configure

1 participant