tari-project / tari / 34588130420
76%

DEFAULT BRANCH: development
Ran
Jobs 1
Files 779
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 62.729% (+0.06%) from 62.671%
34588130420

push

github

web-flow 
fix: ledger nonce handling (#8002)

Description
---
ensures nonce handling is safe and cannot be reused 

<!-- greptile_comment -->

<!-- greptile_summary -->

<h2><a
href="https://app.greptile.com/api/retrigger?id=63000283"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://greptile-static-assets.s3.amazonaws.com/badges/RetriggerDark.svg?v=1"><source
media="(prefers-color-scheme: light)"
srcset="https://greptile-static-assets.s3.amazonaws.com/badges/Retrigger.svg?v=1"><img
alt="Retrigger"
src="https://greptile-static-assets.s3.amazonaws.com/badges/Retrigger.svg?v=1"
align="right"></picture></a>Confidence Score: 3/5</h2>

The PR is not safe to merge while pre-mine signing still permits
deterministic nonce reuse and consequent private-key recovery.

<h2><a
href="https://app.greptile.com/ide/claude-code?prompt=%23%23%23%20Issue%201%0Aapplications%2Fminotari_ledger_wallet%2Fcommon%2Fsrc%2Flegacy_nonce.rs%3A82%0AThe%20nonce-safety%20fix%20remains%20incomplete%20for%20pre-mine%20spending.%20This%20whitelist%20allows%20%60PreMine%60%20and%20%60OneSidedSenderOffset%60%20keys%20to%20use%20a%20caller-selected%20deterministic%20%60Random%60%20nonce%20index%2C%20and%20the%20legacy%20handler%20re-derives%20that%20nonce%20without%20recording%20or%20consuming%20it.%20A%20compromised%20host%20can%20request%20signatures%20for%20the%20same%20key%20and%20nonce%20indices%20with%20different%20challenges%20and%20recover%20the%20signing%20private%20key.%20For%20a%20sender-offset%20signature%2C%20this%20can%20also%20expose%20the%20associated%20pre-mine%20script%20private%20key.%20This%20path%20needs%20the%20same%20one-shot%20enforcement%20as%20normal%20signing.%0A%0A**How%20this%20was%20verified%3A**%20The%20allowed%20production%20branches%20reach%20a%20device%20handler%20that%20re-derives%20the%20same%20key%20and%20nonce%20for%20every%20request%20without%20recording%20or%20consuming%20the%20nonce%20index.%0A%0A---%0A%0AFor%20each%20issue%20above%2C%20det... (continued)

411 of 555 new or added lines in 10 files covered. (74.05%)

45 existing lines in 11 files now uncovered.

86184 of 137391 relevant lines covered (62.73%)

193487.43 hits per line

Uncovered Changes

Lines Coverage ∆ File
73
0.0
0.0% applications/minotari_ledger_wallet/comms/src/accessor_methods.rs
57
69.03
3.38% base_layer/transaction_components/src/key_manager/manager.rs
6
17.04
-0.21% base_layer/transaction_key_manager/src/legacy_key_manager/inner.rs
3
97.54
applications/minotari_ledger_wallet/common/src/ephemeral_nonce.rs
3
12.76
-0.1% base_layer/transaction_key_manager/src/legacy_key_manager/wrapper.rs
1
45.74
0.07% base_layer/transaction_components/src/transaction_components/wallet_output.rs
1
72.93
0.0% base_layer/transaction_components/src/transaction_components/wallet_output_builder.rs

Coverage Regressions

Lines Coverage ∆ File
10
73.07
-0.51% comms/core/src/connectivity/manager.rs
10
69.72
-1.4% comms/dht/src/connectivity/mod.rs
5
87.57
-0.91% comms/core/src/connection_manager/peer_connection.rs
4
88.3
0.18% applications/minotari_ledger_wallet/common/src/common_types.rs
4
87.3
-6.35% comms/core/src/connection_manager/requester.rs
4
82.14
-0.79% comms/core/src/noise/socket.rs
3
92.18
-0.63% comms/dht/src/outbound/broadcast.rs
2
0.0
0.0% applications/minotari_ledger_wallet/comms/src/accessor_methods.rs
1
89.82
-0.18% base_layer/p2p/src/services/liveness/service.rs
1
84.0
-0.2% comms/core/src/connection_manager/dialer.rs
1
83.65
-0.16% comms/core/src/protocol/rpc/client/mod.rs
Jobs
ID Job ID Ran Files Coverage
1 34588130420.1 779
62.73
GitHub Action Run
Source Files on build 34588130420