security(contracts): support verifier sets and quorum-based proof acceptance - #257
Open
emmyokolo2525-cyber wants to merge 1 commit into
Conversation
…eptance Implements bounded, versioned verifier sets with configurable m-of-n quorum acceptance for the Harpocrates registry (harpocrates-stellar#126). ## Contract changes (lib.rs) - VerifierSetRecord: versioned scalar contracttype (members stored at indexed keys VerifierSetMember(version, index) to comply with Soroban's no-generics-in-contracttype constraint) - QuorumResult enum: Approved / Rejected / Unavailable / VersionMismatch / Pending - propose_verifier_set_1/2/3: admin-only proposal with VERIFIER_SET_TIMELOCK_SECS (300 s) staged rotation guard - activate_verifier_set: promotes pending set after timelock, atomically retires the previously active set - disable_verifier_set: emergency disable; blocks future use without touching already-accepted proofs - register_anon_verified_quorum: calls every member via try_invoke_contract, tallies inline, commits nullifier + record only on Approved; emits QuorumFinalized event regardless of outcome - Bounds: proof ≤ 64 KB, public_inputs ≤ 4 KB, members ≤ 16, versions ≤ 8 - All existing entry points preserved for backward compatibility ## New error codes VerifierSetNotFound(14), QuorumNotReached(15), DuplicateVote(16), VerifierSetDisabled(17), VerifierSetNotActive(18), VersionMismatch(19), ProofTooLarge(20), VerifierSetFull(21), TooManyVerifierSets(22), TimelockNotExpired(23), NoPendingVerifierSet(24), InvalidThreshold(25) ## New events VerifierSetProposed, VerifierSetActivated, VerifierSetDisabledEvent, QuorumFinalized ## Tests (test_verifier_sets.rs — 26 new tests) Covers: propose/activate/disable lifecycle, timelock enforcement, quorum approval (1-of-1, 2-of-3), split decisions, unavailable verifiers, version mismatch boundary, rotation overlap, emergency disable, duplicate nullifier replay, duplicate proof_id, oversized proof bounds, backward compat with legacy register_anonymous_verified Result: 103 passed; 0 failed ## Frontend changes - stellarTypes.ts: useQuorum field on RegisterProofInput / NormalizedRegisterProofInput; new RegistryMethod entries for all verifier-set and quorum contract functions - harpocratesRegistry.ts: methodForTier routes to register_anon_verified_quorum when useQuorum=true; new admin helpers proposeVerifierSet, activateVerifierSet, disableVerifierSet, getActiveVerifierSet Closes harpocrates-stellar#126
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements bounded, versioned verifier sets with configurable m-of-n quorum acceptance for the Harpocrates Soroban registry.
Closes #126
Contract changes
New types
VerifierSetRecord— scalar contracttype (Soroban no-generics constraint); members stored atVerifierSetMember(version, index)QuorumResult—Approved | Rejected | Unavailable | VersionMismatch | PendingNew entry points
propose_verifier_set_1/2/3VERIFIER_SET_TIMELOCK_SECS(300 s) unlockactivate_verifier_setdisable_verifier_setregister_anon_verified_quorumtry_invoke_contract, tallies inline, only writes state onApprovedget_active_verifier_set/get_verifier_setQuorum logic
approved ≥ threshold→ Approved → proof registeredrejected > members − threshold→ Rejected (error ci: add Soroban formatting, lint, and contract-test checks #7)failures > members − threshold→ Unavailable (error security(backend): rate-limit upload and proof endpoints #15)circuit_versionset → VersionMismatch (error fix(backend): validate identity tier on proof registration #19)Bounds
New error codes
VerifierSetNotFound(14),QuorumNotReached(15),DuplicateVote(16),VerifierSetDisabled(17),VerifierSetNotActive(18),VersionMismatch(19),ProofTooLarge(20),VerifierSetFull(21),TooManyVerifierSets(22),TimelockNotExpired(23),NoPendingVerifierSet(24),InvalidThreshold(25)New contract events
VerifierSetProposed,VerifierSetActivated,VerifierSetDisabledEvent,QuorumFinalizedBackward compatibility
All existing methods (
set_verifier,register_anonymous_verified,register_source,register_seal, etc.) are fully preserved.Tests —
test_verifier_sets.rs(26 new tests)Covers every acceptance criterion from the issue:
register_anonymous_verifiedResult: 103 passed; 0 failed
Frontend changes
stellarTypes.ts:useQuorum?: booleanon input types; all newRegistryMethodentriesharpocratesRegistry.ts:methodForTierroutes toregister_anon_verified_quorumwhenuseQuorum=true; admin helpersproposeVerifierSet,activateVerifierSet,disableVerifierSet,getActiveVerifierSetWhat was tested
cargo test: 103 passed, 0 failedtsc --noEmit: clean