Skip to content

Security/shielded pool hardening #109

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nol4lej merged 18 commits into from
Jul 6, 2026
Merged

Security/shielded pool hardening #109

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
456c3db
test(shielded-pool): harden pool-balance ledger invariant
nol4lej Jul 5, 2026
29caf5e
fix(shielded-pool): bind relayer field into the transaction-pool tag
nol4lej Jul 5, 2026
315d958
fix(shielded-pool): bound claim_shielded_fees proof and signals inputs
nol4lej Jul 5, 2026
68aeb08
fix(shielded-pool): bind merkle capacity guard to the fixed tree depth
nol4lej Jul 5, 2026
7c3069a
fix(shielded-pool): reject non-32-byte recipient in unshield binding
nol4lej Jul 5, 2026
f00c613
fix(shielded-pool): error on unattributable relay fee instead of drop…
nol4lej Jul 5, 2026
5610c10
perf(shielded-pool): bound unsigned transaction pool longevity
nol4lej Jul 5, 2026
5437cc7
docs(shielded-pool): clarify unverify_asset is a total freeze kill-sw…
nol4lej Jul 6, 2026
6264bb6
fix(shielded-pool): gate private_transfer on registered, verified asset
nol4lej Jul 6, 2026
f727869
fix(shielded-pool): use benchmarked weight and reject empty shield_batch
nol4lej Jul 6, 2026
dbdc0e5
fix(shielded-pool): harden the historic Merkle-root window
nol4lej Jul 6, 2026
d621ddc
docs(shielded-pool): clarify claim_shielded_fees note ownership
nol4lej Jul 6, 2026
5232cd8
fix(shielded-pool): guard asset registration against id collision
nol4lej Jul 6, 2026
aca7f8c
fix(shielded-pool): make Note.asset_id u32 to match the circuit
nol4lej Jul 6, 2026
c598415
fix(shielded-pool): register a relayer in fee-bearing benchmarks
nol4lej Jul 6, 2026
d3aa39a
chore: regenerate pallet weights on cpx62 VPS
nol4lej Jul 6, 2026
291cc26
chore(runtime): bump spec_version to 3 for shielded-pool hardening
nol4lej Jul 6, 2026
b69ce94
fix(shielded-pool): use real pallet-relayer in the test mock
nol4lej Jul 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
130 changes: 65 additions & 65 deletions frame/account-mapping/src/weights.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
//! Autogenerated weights for pallet_account_mapping
//!
//! THIS FILE WAS AUTO-GENERATED USING THE SUBSTRATE BENCHMARK CLI VERSION 53.0.0
//! DATE: 2026-07-04, STEPS: `50`, REPEAT: `20`, LOW RANGE: `[]`, HIGH RANGE: `[]`
//! DATE: 2026-07-06, STEPS: `50`, REPEAT: `20`, LOW RANGE: `[]`, HIGH RANGE: `[]`
//! WORST CASE MAP SIZE: `1000000`
//! HOSTNAME: `ubuntu-32gb-fsn1-1`, CPU: `AMD EPYC-Genoa Processor`
//! EXECUTION: , WASM-EXECUTION: Compiled, CHAIN: Some("dev"), DB CACHE: 1024
Expand Down Expand Up @@ -72,8 +72,8 @@ impl<T: frame_system::Config> WeightInfo for SubstrateWeight<T> {
// Proof Size summary in bytes:
// Measured: `19`
// Estimated: `1504`
// Minimum execution time: 7_250_000 picoseconds.
Weight::from_parts(7_520_000, 1504)
// Minimum execution time: 8_450_000 picoseconds.
Weight::from_parts(8_900_000, 1504)
.saturating_add(T::DbWeight::get().reads(4_u64))
.saturating_add(T::DbWeight::get().writes(2_u64))
}
Expand All @@ -93,8 +93,8 @@ impl<T: frame_system::Config> WeightInfo for SubstrateWeight<T> {
// Proof Size summary in bytes:
// Measured: `189`
// Estimated: `3533`
// Minimum execution time: 14_800_000 picoseconds.
Weight::from_parts(15_250_000, 3533)
// Minimum execution time: 16_630_000 picoseconds.
Weight::from_parts(17_570_000, 3533)
.saturating_add(T::DbWeight::get().reads(5_u64))
.saturating_add(T::DbWeight::get().writes(4_u64))
}
Expand All @@ -114,8 +114,8 @@ impl<T: frame_system::Config> WeightInfo for SubstrateWeight<T> {
// Proof Size summary in bytes:
// Measured: `61`
// Estimated: `5728`
// Minimum execution time: 32_150_000 picoseconds.
Weight::from_parts(33_079_000, 5728)
// Minimum execution time: 37_300_000 picoseconds.
Weight::from_parts(38_810_000, 5728)
.saturating_add(T::DbWeight::get().reads(6_u64))
.saturating_add(T::DbWeight::get().writes(4_u64))
}
Expand All @@ -139,8 +139,8 @@ impl<T: frame_system::Config> WeightInfo for SubstrateWeight<T> {
// Proof Size summary in bytes:
// Measured: `257`
// Estimated: `5728`
// Minimum execution time: 35_530_000 picoseconds.
Weight::from_parts(36_750_000, 5728)
// Minimum execution time: 41_600_000 picoseconds.
Weight::from_parts(42_370_000, 5728)
.saturating_add(T::DbWeight::get().reads(6_u64))
.saturating_add(T::DbWeight::get().writes(6_u64))
}
Expand All @@ -164,8 +164,8 @@ impl<T: frame_system::Config> WeightInfo for SubstrateWeight<T> {
// Proof Size summary in bytes:
// Measured: `360`
// Estimated: `6102`
// Minimum execution time: 58_210_000 picoseconds.
Weight::from_parts(59_360_000, 6102)
// Minimum execution time: 67_349_000 picoseconds.
Weight::from_parts(68_879_000, 6102)
.saturating_add(T::DbWeight::get().reads(8_u64))
.saturating_add(T::DbWeight::get().writes(7_u64))
}
Expand All @@ -185,8 +185,8 @@ impl<T: frame_system::Config> WeightInfo for SubstrateWeight<T> {
// Proof Size summary in bytes:
// Measured: `186`
// Estimated: `4172`
// Minimum execution time: 17_520_000 picoseconds.
Weight::from_parts(18_400_000, 4172)
// Minimum execution time: 20_320_000 picoseconds.
Weight::from_parts(20_940_000, 4172)
.saturating_add(T::DbWeight::get().reads(6_u64))
.saturating_add(T::DbWeight::get().writes(3_u64))
}
Expand All @@ -206,8 +206,8 @@ impl<T: frame_system::Config> WeightInfo for SubstrateWeight<T> {
// Proof Size summary in bytes:
// Measured: `256`
// Estimated: `4172`
// Minimum execution time: 18_780_000 picoseconds.
Weight::from_parts(19_170_000, 4172)
// Minimum execution time: 21_720_000 picoseconds.
Weight::from_parts(22_510_000, 4172)
.saturating_add(T::DbWeight::get().reads(6_u64))
.saturating_add(T::DbWeight::get().writes(3_u64))
}
Expand All @@ -233,8 +233,8 @@ impl<T: frame_system::Config> WeightInfo for SubstrateWeight<T> {
// Proof Size summary in bytes:
// Measured: `546`
// Estimated: `5728`
// Minimum execution time: 103_490_000 picoseconds.
Weight::from_parts(107_560_000, 5728)
// Minimum execution time: 119_829_000 picoseconds.
Weight::from_parts(123_109_000, 5728)
.saturating_add(T::DbWeight::get().reads(9_u64))
.saturating_add(T::DbWeight::get().writes(7_u64))
}
Expand All @@ -258,8 +258,8 @@ impl<T: frame_system::Config> WeightInfo for SubstrateWeight<T> {
// Proof Size summary in bytes:
// Measured: `299`
// Estimated: `5728`
// Minimum execution time: 61_740_000 picoseconds.
Weight::from_parts(63_240_000, 5728)
// Minimum execution time: 79_380_000 picoseconds.
Weight::from_parts(82_719_000, 5728)
.saturating_add(T::DbWeight::get().reads(7_u64))
.saturating_add(T::DbWeight::get().writes(4_u64))
}
Expand All @@ -281,8 +281,8 @@ impl<T: frame_system::Config> WeightInfo for SubstrateWeight<T> {
// Proof Size summary in bytes:
// Measured: `286`
// Estimated: `5728`
// Minimum execution time: 21_290_000 picoseconds.
Weight::from_parts(21_780_000, 5728)
// Minimum execution time: 24_779_000 picoseconds.
Weight::from_parts(25_740_000, 5728)
.saturating_add(T::DbWeight::get().reads(6_u64))
.saturating_add(T::DbWeight::get().writes(4_u64))
}
Expand All @@ -302,8 +302,8 @@ impl<T: frame_system::Config> WeightInfo for SubstrateWeight<T> {
// Proof Size summary in bytes:
// Measured: `186`
// Estimated: `3546`
// Minimum execution time: 15_510_000 picoseconds.
Weight::from_parts(16_100_000, 3546)
// Minimum execution time: 18_130_000 picoseconds.
Weight::from_parts(18_920_000, 3546)
.saturating_add(T::DbWeight::get().reads(5_u64))
.saturating_add(T::DbWeight::get().writes(3_u64))
}
Expand All @@ -323,8 +323,8 @@ impl<T: frame_system::Config> WeightInfo for SubstrateWeight<T> {
// Proof Size summary in bytes:
// Measured: `248`
// Estimated: `3647`
// Minimum execution time: 56_150_000 picoseconds.
Weight::from_parts(60_390_000, 3647)
// Minimum execution time: 71_810_000 picoseconds.
Weight::from_parts(73_830_000, 3647)
.saturating_add(T::DbWeight::get().reads(6_u64))
.saturating_add(T::DbWeight::get().writes(2_u64))
}
Expand All @@ -344,8 +344,8 @@ impl<T: frame_system::Config> WeightInfo for SubstrateWeight<T> {
// Proof Size summary in bytes:
// Measured: `237`
// Estimated: `4091`
// Minimum execution time: 18_669_000 picoseconds.
Weight::from_parts(19_100_000, 4091)
// Minimum execution time: 22_110_000 picoseconds.
Weight::from_parts(23_971_000, 4091)
.saturating_add(T::DbWeight::get().reads(6_u64))
.saturating_add(T::DbWeight::get().writes(3_u64))
}
Expand All @@ -365,8 +365,8 @@ impl<T: frame_system::Config> WeightInfo for SubstrateWeight<T> {
// Proof Size summary in bytes:
// Measured: `281`
// Estimated: `4091`
// Minimum execution time: 20_020_000 picoseconds.
Weight::from_parts(20_920_000, 4091)
// Minimum execution time: 23_269_000 picoseconds.
Weight::from_parts(24_750_000, 4091)
.saturating_add(T::DbWeight::get().reads(6_u64))
.saturating_add(T::DbWeight::get().writes(3_u64))
}
Expand All @@ -392,8 +392,8 @@ impl<T: frame_system::Config> WeightInfo for SubstrateWeight<T> {
// Proof Size summary in bytes:
// Measured: `393`
// Estimated: `5728`
// Minimum execution time: 126_160_000 picoseconds.
Weight::from_parts(130_300_000, 5728)
// Minimum execution time: 158_099_000 picoseconds.
Weight::from_parts(165_799_000, 5728)
.saturating_add(T::DbWeight::get().reads(8_u64))
.saturating_add(T::DbWeight::get().writes(5_u64))
}
Expand All @@ -413,8 +413,8 @@ impl<T: frame_system::Config> WeightInfo for SubstrateWeight<T> {
// Proof Size summary in bytes:
// Measured: `281`
// Estimated: `4091`
// Minimum execution time: 20_990_000 picoseconds.
Weight::from_parts(21_680_000, 4091)
// Minimum execution time: 24_210_000 picoseconds.
Weight::from_parts(25_259_000, 4091)
.saturating_add(T::DbWeight::get().reads(6_u64))
.saturating_add(T::DbWeight::get().writes(2_u64))
}
Expand All @@ -434,8 +434,8 @@ impl WeightInfo for () {
// Proof Size summary in bytes:
// Measured: `19`
// Estimated: `1504`
// Minimum execution time: 7_250_000 picoseconds.
Weight::from_parts(7_520_000, 1504)
// Minimum execution time: 8_450_000 picoseconds.
Weight::from_parts(8_900_000, 1504)
.saturating_add(RocksDbWeight::get().reads(4_u64))
.saturating_add(RocksDbWeight::get().writes(2_u64))
}
Expand All @@ -455,8 +455,8 @@ impl WeightInfo for () {
// Proof Size summary in bytes:
// Measured: `189`
// Estimated: `3533`
// Minimum execution time: 14_800_000 picoseconds.
Weight::from_parts(15_250_000, 3533)
// Minimum execution time: 16_630_000 picoseconds.
Weight::from_parts(17_570_000, 3533)
.saturating_add(RocksDbWeight::get().reads(5_u64))
.saturating_add(RocksDbWeight::get().writes(4_u64))
}
Expand All @@ -476,8 +476,8 @@ impl WeightInfo for () {
// Proof Size summary in bytes:
// Measured: `61`
// Estimated: `5728`
// Minimum execution time: 32_150_000 picoseconds.
Weight::from_parts(33_079_000, 5728)
// Minimum execution time: 37_300_000 picoseconds.
Weight::from_parts(38_810_000, 5728)
.saturating_add(RocksDbWeight::get().reads(6_u64))
.saturating_add(RocksDbWeight::get().writes(4_u64))
}
Expand All @@ -501,8 +501,8 @@ impl WeightInfo for () {
// Proof Size summary in bytes:
// Measured: `257`
// Estimated: `5728`
// Minimum execution time: 35_530_000 picoseconds.
Weight::from_parts(36_750_000, 5728)
// Minimum execution time: 41_600_000 picoseconds.
Weight::from_parts(42_370_000, 5728)
.saturating_add(RocksDbWeight::get().reads(6_u64))
.saturating_add(RocksDbWeight::get().writes(6_u64))
}
Expand All @@ -526,8 +526,8 @@ impl WeightInfo for () {
// Proof Size summary in bytes:
// Measured: `360`
// Estimated: `6102`
// Minimum execution time: 58_210_000 picoseconds.
Weight::from_parts(59_360_000, 6102)
// Minimum execution time: 67_349_000 picoseconds.
Weight::from_parts(68_879_000, 6102)
.saturating_add(RocksDbWeight::get().reads(8_u64))
.saturating_add(RocksDbWeight::get().writes(7_u64))
}
Expand All @@ -547,8 +547,8 @@ impl WeightInfo for () {
// Proof Size summary in bytes:
// Measured: `186`
// Estimated: `4172`
// Minimum execution time: 17_520_000 picoseconds.
Weight::from_parts(18_400_000, 4172)
// Minimum execution time: 20_320_000 picoseconds.
Weight::from_parts(20_940_000, 4172)
.saturating_add(RocksDbWeight::get().reads(6_u64))
.saturating_add(RocksDbWeight::get().writes(3_u64))
}
Expand All @@ -568,8 +568,8 @@ impl WeightInfo for () {
// Proof Size summary in bytes:
// Measured: `256`
// Estimated: `4172`
// Minimum execution time: 18_780_000 picoseconds.
Weight::from_parts(19_170_000, 4172)
// Minimum execution time: 21_720_000 picoseconds.
Weight::from_parts(22_510_000, 4172)
.saturating_add(RocksDbWeight::get().reads(6_u64))
.saturating_add(RocksDbWeight::get().writes(3_u64))
}
Expand All @@ -595,8 +595,8 @@ impl WeightInfo for () {
// Proof Size summary in bytes:
// Measured: `546`
// Estimated: `5728`
// Minimum execution time: 103_490_000 picoseconds.
Weight::from_parts(107_560_000, 5728)
// Minimum execution time: 119_829_000 picoseconds.
Weight::from_parts(123_109_000, 5728)
.saturating_add(RocksDbWeight::get().reads(9_u64))
.saturating_add(RocksDbWeight::get().writes(7_u64))
}
Expand All @@ -620,8 +620,8 @@ impl WeightInfo for () {
// Proof Size summary in bytes:
// Measured: `299`
// Estimated: `5728`
// Minimum execution time: 61_740_000 picoseconds.
Weight::from_parts(63_240_000, 5728)
// Minimum execution time: 79_380_000 picoseconds.
Weight::from_parts(82_719_000, 5728)
.saturating_add(RocksDbWeight::get().reads(7_u64))
.saturating_add(RocksDbWeight::get().writes(4_u64))
}
Expand All @@ -643,8 +643,8 @@ impl WeightInfo for () {
// Proof Size summary in bytes:
// Measured: `286`
// Estimated: `5728`
// Minimum execution time: 21_290_000 picoseconds.
Weight::from_parts(21_780_000, 5728)
// Minimum execution time: 24_779_000 picoseconds.
Weight::from_parts(25_740_000, 5728)
.saturating_add(RocksDbWeight::get().reads(6_u64))
.saturating_add(RocksDbWeight::get().writes(4_u64))
}
Expand All @@ -664,8 +664,8 @@ impl WeightInfo for () {
// Proof Size summary in bytes:
// Measured: `186`
// Estimated: `3546`
// Minimum execution time: 15_510_000 picoseconds.
Weight::from_parts(16_100_000, 3546)
// Minimum execution time: 18_130_000 picoseconds.
Weight::from_parts(18_920_000, 3546)
.saturating_add(RocksDbWeight::get().reads(5_u64))
.saturating_add(RocksDbWeight::get().writes(3_u64))
}
Expand All @@ -685,8 +685,8 @@ impl WeightInfo for () {
// Proof Size summary in bytes:
// Measured: `248`
// Estimated: `3647`
// Minimum execution time: 56_150_000 picoseconds.
Weight::from_parts(60_390_000, 3647)
// Minimum execution time: 71_810_000 picoseconds.
Weight::from_parts(73_830_000, 3647)
.saturating_add(RocksDbWeight::get().reads(6_u64))
.saturating_add(RocksDbWeight::get().writes(2_u64))
}
Expand All @@ -706,8 +706,8 @@ impl WeightInfo for () {
// Proof Size summary in bytes:
// Measured: `237`
// Estimated: `4091`
// Minimum execution time: 18_669_000 picoseconds.
Weight::from_parts(19_100_000, 4091)
// Minimum execution time: 22_110_000 picoseconds.
Weight::from_parts(23_971_000, 4091)
.saturating_add(RocksDbWeight::get().reads(6_u64))
.saturating_add(RocksDbWeight::get().writes(3_u64))
}
Expand All @@ -727,8 +727,8 @@ impl WeightInfo for () {
// Proof Size summary in bytes:
// Measured: `281`
// Estimated: `4091`
// Minimum execution time: 20_020_000 picoseconds.
Weight::from_parts(20_920_000, 4091)
// Minimum execution time: 23_269_000 picoseconds.
Weight::from_parts(24_750_000, 4091)
.saturating_add(RocksDbWeight::get().reads(6_u64))
.saturating_add(RocksDbWeight::get().writes(3_u64))
}
Expand All @@ -754,8 +754,8 @@ impl WeightInfo for () {
// Proof Size summary in bytes:
// Measured: `393`
// Estimated: `5728`
// Minimum execution time: 126_160_000 picoseconds.
Weight::from_parts(130_300_000, 5728)
// Minimum execution time: 158_099_000 picoseconds.
Weight::from_parts(165_799_000, 5728)
.saturating_add(RocksDbWeight::get().reads(8_u64))
.saturating_add(RocksDbWeight::get().writes(5_u64))
}
Expand All @@ -775,8 +775,8 @@ impl WeightInfo for () {
// Proof Size summary in bytes:
// Measured: `281`
// Estimated: `4091`
// Minimum execution time: 20_990_000 picoseconds.
Weight::from_parts(21_680_000, 4091)
// Minimum execution time: 24_210_000 picoseconds.
Weight::from_parts(25_259_000, 4091)
.saturating_add(RocksDbWeight::get().reads(6_u64))
.saturating_add(RocksDbWeight::get().writes(2_u64))
}
Expand Down
9 changes: 6 additions & 3 deletions frame/evm/precompile/shielded-pool/src/calls/claim_shielded_fees.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,18 +86,21 @@ where
return Err(err("claimShieldedFees: proof must be non-empty"));
}

let public_signals: Vec<u8> = abi::decode_bytes_at_slot(params, 160)?;
let public_signals_raw: Vec<u8> = abi::decode_bytes_at_slot(params, 160)?;

if public_signals.len() != 76 {
if public_signals_raw.len() != 76 {
return Err(err("claimShieldedFees: public_signals must be 76 bytes"));
}
let public_signals = public_signals_raw
.try_into()
.map_err(|_| err("claimShieldedFees: public_signals too long"))?;

Ok(pallet_shielded_pool::Call::<T>::claim_shielded_fees {
commitment,
amount,
asset_id,
memo,
proof: proof.into(),
proof,
public_signals,
})
}
Expand Down
2 changes: 1 addition & 1 deletion frame/evm/precompile/shielded-pool/src/mock.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,7 @@ impl pallet_evm::Config for Test {

parameter_types! {
pub const ShieldedPoolPalletId: PalletId = PalletId(*b"shldpool");
pub const MaxTreeDepth: u32 = 32;
pub const MaxTreeDepth: u32 = 20;
pub const MaxHistoricRoots: u32 = 100;
pub const MinShieldAmount: u128 = 100;
}
Expand Down
Loading
Loading