Skip to content

fix: require committee signatures for force-skip penalties - #527

Open
KSlashh wants to merge 1 commit into
devfrom
audit/29-force-skip-committee
Open

KSlashh wants to merge 1 commit into
devfrom
audit/29-force-skip-committee

Conversation

@KSlashh

@KSlashh KSlashh commented Nov 9, 2026

Copy link
Copy Markdown
Collaborator

Prevent the operator from sweeping the connector needed to enforce the previous kickoff slot.

  • Construct the force-skip connector with the graph's committee N-of-N key. The genesis Pre-Kickoff retains its operator key because it has no preceding graph.
  • Add committee nonce slots and SIGHASH_NONE signatures for input 1 of Quick-Challenge and Force-Skip-Kickoff, including digest binding, signature verification and simplified graph serialization.
  • Reduce operator pre-signatures from six to four.
  • Wait for the previous graph's committee signatures before broadcasting either penalty, and stop once the force-skip connector is settled.

Audit finding: M29.

Requires GOATNetwork/BitVM#23, targeting gc-v2. Cargo currently references that PR's branch; restore gc-v2 and refresh Cargo.lock after the dependency merges.

Nonce and signature message shapes change. Deploy all participating nodes together and recreate existing graphs.

Validation: includes a full operator/committee pre-signing regression checking the connector key, both penalty signatures, rejection of the operator key and simplified graph round-tripping. The zkm notes record passing bitvm-gc/node tests and clippy; these were not rerun during this review.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants