tari-project / tari / 38240644255

77%

Build Type

push

github

Committed by web-flow

Commit Message

fix(ledger): sign device sender-offset keys only through the reviewed metadata instruction (#8104)

## Summary

A Ledger device's sender-offset keys could sign through
`GetRawSchnorrSignature` over a host-supplied 64-byte challenge, with
nothing on screen. Host side, `get_metadata_signature` took exactly that
route for change outputs, `wallet_output_builder` self-signing and the
no-recipient re-sign. So a compromised host could get metadata
signatures for outputs nobody was shown.

This PR makes `GetOneSidedMetadataSignature` the only way a
`OneSidedSenderOffset` key produces a metadata signature. The design
assumes the host lies, so the device signs only over data it builds
itself:
- **The script:** a stealth `PushPubKey` built from the receiver address
and the commitment mask.
- **The metadata hash:** `common` = H(version, features, covenant,
encrypted data, minimum value promise), hashed from raw fields.

A lie by the host therefore yields a signature that only verifies on an
output carrying exactly what the device saw.

### What changes

- **Device: raw Schnorr refusal.** `GetRawSchnorrSignature` refuses the
`OneSidedSenderOffset` branch with `BadBranchKey`, before the reserved
nonce is taken. The comms accessor and `sign_with_nonce_and_challenge`
mirror the refusal (`LedgerSenderOffsetRawSignature`). `PreMine` sender
offsets still sign raw; pre-mine step 3 needs it (see residuals).
- **Device: metadata hashed on the device.**
`GetOneSidedMetadataSignature` is now instruction `0x15`. `0x11` is
retired, so an old host's single APDU can't be misread as a chunk. The
request is split into chunks:
- **Chunk 0:** `account | network | sender_offset_key_index |
sender_offset_branch | value | commitment_mask | preimage_size(2) |
address_size(2) | address`.
- **Chunks 1 and on:** the consensus borsh preimage of `(version,
features, covenant, encrypted_data, minimum_value_promise)`, 250 bytes
per chunk, capped at 1280 bytes.

The device parses the whole prei... (continued)

Coverage Stats

967 of 1037 new or added lines in 14 files covered. (93.25%)

1297 existing lines in 30 files now uncovered.

123433 of 166413 relevant lines covered (74.17%)

1173719.05 hits per line