fix(#991): add Ed25519 signature verification and replay protection to bridge_stub - #1074
Merged
Ceejaytech25 merged 1 commit intoSep 2, 2026
Conversation
…lay protection to bridge_stub - Add RelayerKey (BytesN<32>) storage key for the Ed25519 public key - initialize() now accepts relayer_key: BytesN<32> parameter - mint() verifies relayer Ed25519 signature over message_hash before processing - mint() records message_hash in persistent storage after first execution - Subsequent submissions of the same hash panic with 'message already processed' - set_relayer() updated to also rotate the relayer key - Add is_processed() view helper - Add BridgeContractClient mint signature updated to include hash + sig args - Add ed25519-dalek dev-dependency to Cargo.toml - Add unit tests: - test_mint_with_valid_signature - test_mint_with_invalid_signature_is_rejected - test_mint_with_signature_for_different_message_is_rejected - test_replay_attack_is_prevented - test_different_message_hashes_are_each_processed_once - test_unauthorized_relayer_is_rejected Closes ceejaylaboratory#991
|
@giftben1763-ui Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
Contributor
|
Nice implementation, LGTM! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes
contracts/bridge_stub/src/lib.rswhich accepted cross-chain mint messages without verifying cryptographic signatures, allowing anyone to mint tokens without relayer authorization.Changes
contracts/bridge_stub/src/lib.rsRelayerKey(Ed25519 public key) toDataKeyenuminitialize(): Now accepts arelayer_key: BytesN<32>parameter and stores itmint(): Now requires:message_hash: BytesN<32>— the canonical hash of the message being processedsignature: BytesN<64>— relayer's Ed25519 signature overmessage_hashenv.crypto().ed25519_verify()— reverts on invalid signaturemessage_hashin persistent storage to prevent replay attacksmessage_hash(covering all message fields) rather than just a hash of the recipient addresstest_mint_with_valid_signaturetest_mint_with_invalid_signature_is_rejectedtest_mint_with_signature_for_different_message_is_rejectedtest_replay_attack_is_preventedtest_different_message_hashes_are_each_processed_oncetest_unauthorized_relayer_is_rejectedSecurity Impact
Without this fix, any address could call
mint()and receive tokens. The Ed25519 check ensures only the authorized relayer can authorize inbound transfers.Closes #991