Skip to content

Multiproof audit fixes#227

Open
roger-bai-coinbase wants to merge 5 commits intomainfrom
multiproof-audit-fixes
Open

Multiproof audit fixes#227
roger-bai-coinbase wants to merge 5 commits intomainfrom
multiproof-audit-fixes

Conversation

@roger-bai-coinbase
Copy link
Contributor

Summary

Addresses four audit findings across AggregateVerifier and NitroEnclaveVerifier.

Changes

  • Finding 1 — Short-circuit on invalid parent: resolve() now immediately sets CHALLENGER_WINS and skips proof threshold and bond logic when the parent game is already invalid, preventing unnecessary state evaluation.
  • Finding 2 — Emit encoded journal in AttestationSubmitted: The AttestationSubmitted event now emits abi.encode(journal) (the decoded, validated journal) instead of the raw output bytes. Both attestation events also gain an indexed zkCoProcessor parameter for efficient filtering.
  • Finding 3 — Clarify challenge comment: Updated comment in resolve() to accurately describe the challenger reward flow.
  • Finding 4 — Extract _getDelay() helper: Deduplicates the proof-count-to-delay logic shared by _decreaseExpectedResolution() and _increaseExpectedResolution() into a single _getDelay() internal function.

@cb-heimdall
Copy link
Collaborator

🟡 Heimdall Review Status

Requirement Status More Info
Reviews 🟡 0/1
Denominator calculation
Show calculation
1 if user is bot 0
1 if user is external 0
2 if repo is sensitive 0
From .codeflow.yml 1
Additional review requirements
Show calculation
Max 0
0
From CODEOWNERS 0
Global minimum 0
Max 1
1
1 if commit is unverified 0
Sum 1

@roger-bai-coinbase roger-bai-coinbase marked this pull request as ready for review March 25, 2026 18:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants