tari-project / tari / 39739883018

77%

Build Type

push

github

Committed by web-flow

Commit Message

fix(common-types): refuse identity and non-point address keys, harden seed and wallet storage (#8154)

## Summary

Remediation for the `tari_common_types` review, plus the wallet and
console-wallet changes it required. No consensus rules change.

- **Addresses.** `verify_send` and the key-manager Diffie-Hellman and
stealth derivations refuse identity and non-point keys. Strict
`TariAddress::from_bytes` decompresses both keys through the new
`CompressedKey::from_canonical_bytes_validated`; the identity point
stays decodable. Burns no longer pass the placeholder address to the
builder. UTXO selection skips and marks invalid any stored output whose
keys no longer resolve.
- **Cipher seed.** wasm32 birthday is computed from the 2022 genesis
like native; a future birthday scans from height 0; version 3 (Argon2id)
is written only when a user passphrase is supplied, version 2 otherwise,
both decode; decode and encipher use zeroized buffers; serde writes the
enciphered form and still reads the legacy struct.
- **Storage.** `decrypt_bytes_integral_nonce` returns `Hidden`. Imported
keys are bound to their public key with a lazy rewrite of legacy rows
and a secret·G check. The wallet type is stored encrypted under the main
key, migrated once under secondary-key version 3 (the version byte is
bound into the main-key AEAD), with a scrub marker that reads the WAL
checkpoint result.
- **Coinbase and scanning.** One `validate_coinbase_request` (dual
one-sided address, valid non-identity keys, payment id and extra within
limits) runs in both base-node template handlers (unobscured, naming the
entry index) and in the builder. Scanning and recovery skip invalid
counterparty keys instead of aborting the block. Ledger burns refuse a
host-held sender offset.
- **Undecodable rows.** Lists skip rows that fail to decode; keyed
lookups fail closed; gRPC reports them as `DATA_LOSS` with resume data;
an undecodable pending outbound transaction can be cancelled.
- **FFI and docs.... (continued)

Coverage Stats

1265 of 1357 new or added lines in 27 files covered. (93.22%)

691 existing lines in 30 files now uncovered.

136313 of 178197 relevant lines covered (76.5%)

337845.07 hits per line