Skip to content

test(proof): regression test for range proof mismatched commit#2567

Merged
mw2000 merged 1 commit into
mainfrom
mw2000/op-succinct-fix
May 12, 2026
Merged

test(proof): regression test for range proof mismatched commit#2567
mw2000 merged 1 commit into
mainfrom
mw2000/op-succinct-fix

Conversation

@mw2000
Copy link
Copy Markdown
Contributor

@mw2000 mw2000 commented May 7, 2026 •
edited
Loading

Core issue was fixed by #2581

This PR now adds a regression test for GHSA-5jh4-3p33-85xc

@vercel
Copy link
Copy Markdown

vercel Bot commented May 7, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
base Ignored Ignored Preview May 11, 2026 10:11pm

Request Review

@cb-heimdall
Copy link
Copy Markdown
Collaborator

cb-heimdall commented May 7, 2026 •
edited
Loading

✅ Heimdall Review Status

Requirement Status More Info
Reviews ✅ 1/1
Denominator calculation
Show calculation
1 if user is bot 0
1 if user is external 0
2 if repo is sensitive 0
From .codeflow.yml 1
Additional review requirements
Show calculation
Max 0
0
From CODEOWNERS 0
Global minimum 0
Max 1
1
1 if commit is unverified 1
Sum 2

@mw2000
Copy link
Copy Markdown
Contributor Author

mw2000 commented May 7, 2026

This is a port of succinctlabs/op-succinct#899

@mw2000 mw2000 enabled auto-merge May 7, 2026 21:32
@mw2000 mw2000 requested a review from 0x00101010 May 8, 2026 04:40
@linear
Copy link
Copy Markdown

linear Bot commented May 8, 2026

CHAIN-4349

@mw2000 mw2000 requested a review from danyalprout May 8, 2026 04:40
jackchuma
jackchuma previously approved these changes May 8, 2026
View reviewed changes
@mw2000 mw2000 added this pull request to the merge queue May 8, 2026
@github-merge-queue github-merge-queue Bot removed this pull request from the merge queue due to failed status checks May 8, 2026
@mw2000 mw2000 added this pull request to the merge queue May 8, 2026
@github-merge-queue github-merge-queue Bot removed this pull request from the merge queue due to failed status checks May 8, 2026
@mw2000 mw2000 added this pull request to the merge queue May 8, 2026
@github-merge-queue github-merge-queue Bot removed this pull request from the merge queue due to failed status checks May 8, 2026
@mw2000 mw2000 added this pull request to the merge queue May 8, 2026
@github-merge-queue github-merge-queue Bot removed this pull request from the merge queue due to failed status checks May 8, 2026
@mw2000 mw2000 force-pushed the mw2000/op-succinct-fix branch from eea1f70 to 06bd6e0 Compare May 8, 2026 20:06
github-actions[bot]
github-actions Bot reviewed May 8, 2026
View reviewed changes
Comment thread crates/proof/succinct/utils/client/src/witness/executor.rs Outdated
github-actions[bot]
github-actions Bot reviewed May 8, 2026
View reviewed changes
Comment thread crates/proof/succinct/scripts/prove/tests/exploit_regression.rs
github-actions[bot]
github-actions Bot reviewed May 8, 2026
View reviewed changes
Comment thread crates/proof/succinct/scripts/prove/Cargo.toml Outdated
@cb-heimdall cb-heimdall dismissed jackchuma’s stale review May 8, 2026 20:28

Approved review 4252328856 from jackchuma is now dismissed due to new commit. Re-request for approval.

github-actions[bot]
github-actions Bot reviewed May 8, 2026
View reviewed changes
Comment thread crates/proof/succinct/scripts/prove/tests/exploit_regression.rs Outdated
github-actions[bot]
github-actions Bot reviewed May 8, 2026
View reviewed changes
Comment thread crates/proof/succinct/utils/client/src/witness/executor.rs Outdated
@mw2000 mw2000 requested a review from jackchuma May 8, 2026 22:12
@mw2000
Copy link
Copy Markdown
Contributor Author

mw2000 commented May 8, 2026

The core issue was fixed by #2581. This main value add of this PR now is just the regression test

@mw2000 mw2000 changed the title fix(proof): assert derived block matches claim after derivation test(proof): regression test fo GHSA-5jh4-3p33-85xc May 11, 2026
@mw2000 mw2000 changed the title test(proof): regression test fo GHSA-5jh4-3p33-85xc test(proof): regression test for range proof mismatched commit May 11, 2026
@mw2000 mw2000 force-pushed the mw2000/op-succinct-fix branch from fda8881 to 00e2664 Compare May 11, 2026 20:40
@mw2000
fix(proof): assert derived block matches claim after derivation
9d06f18 
Closes GHSA-5jh4-3p33-85xc. advance_to_target silently downgrades the
local target on EndOfSource, allowing an adversary to bind a valid
output root to a future block number. Add a postcondition in
WitnessExecutor::run() that rejects execution when the derived safe
head block number differs from the claimed L2 block number.

Includes a gated exploit-regression integration test
(RUN_GHSA_EXPLOIT_REGRESSION=1) reproducing the attack shape.
@mw2000 mw2000 force-pushed the mw2000/op-succinct-fix branch from 00e2664 to 9d06f18 Compare May 11, 2026 22:11
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 11, 2026

Review Summary

The PR extracts the inline block-number mismatch check into ensure_derived_block_matches_claim and adds a thorough exploit-regression test for GHSA-5jh4-3p33-85xc. The code is well-structured and the test methodology (witness mutation + stderr capture + postcondition parsing) is sound.

No new issues found. The existing inline comments from a prior review run appear to be stale — the current revision has already addressed the #[ignore] gating and pub fn visibility suggestions, and the dead-code concern no longer applies since the old inline check was replaced (not duplicated) by ensure_derived_block_matches_claim.

One minor observation (not worth blocking): gag = "1.0" is defined inline rather than in workspace [dependencies]. This is fine for a single-crate dev-dependency, but could be hoisted to workspace deps for consistency if desired.

@mw2000 mw2000 enabled auto-merge May 12, 2026 00:05
@mw2000 mw2000 added this pull request to the merge queue May 12, 2026
Merged via the queue into main with commit 57c16ff May 12, 2026
24 checks passed
@mw2000 mw2000 deleted the mw2000/op-succinct-fix branch May 12, 2026 01:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments

@leopoldjoy leopoldjoy leopoldjoy approved these changes

@0x00101010 0x00101010 Awaiting requested review from 0x00101010

@danyalprout danyalprout Awaiting requested review from danyalprout

@jackchuma jackchuma Awaiting requested review from jackchuma

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@mw2000 @cb-heimdall @leopoldjoy @jackchuma