fix: remediate 2026 Interfold contracts security audit [skip-line-limit]

[hmzakhalid]

Summary

• remediates 16 confirmed code findings from the 2026-07-15 contracts audit
• requires final DKG and decryption proofs in the protocol; skip_proof_aggregation is a ciphernode-only test/CI flag, defaults off, and supplies mock-only non-empty placeholders while production verifiers remain mandatory
• uses clean pre-deployment state and APIs: no migration sentinels, compatibility fallbacks, or legacy slash routes
• regenerates the C-03 DecryptionAggregator verifier through the circuit tooling; no generated verifier was hand-edited
• does not include the audit report or audit PoC report/test

Security and protocol decisions to review

• H-01: when fee and slash tokens match, slash proceeds first fill the requester's original-payment shortfall and the remainder goes to currently active honest nodes. When the tokens differ, the requester receives the slash asset as priority compensation without claiming value equivalence. Same-token residual with no active honest nodes goes to the snapshotted treasury.
• M-03: eligibility settings remain governable. A setting change advances the policy version, resets the aggregate active count, and makes cached operators fail closed until permissionless refresh.
• M-04: each E3 snapshots its lifecycle dependencies. Previously used slashing managers remain authorized across rotation so in-flight E3s can finish; governance must explicitly revoke an old manager only after its E3s, proposals, and routes are terminal.
• M-08: bonding-token rotation remains fail-closed until the old token's obligations are fully drained. For the licence token this includes the registry's complete old-token balance, so unsolicited dust must also be cleared before rotation.

Fixed findings

Critical

• C-01 — [Audit C-01] Emitted BFV public-key bytes are not bound to the proven commitment #1708 — 590c425e
• C-02 — [Audit C-02] Proof-disabled E3s allow unauthenticated key and plaintext takeover #1712 — d724131c
• C-03 — [Audit C-03] Decryption proofs are replayable across unrelated E3 contexts #1710 — 112eb755

High

• H-01 — [Audit H-01] Slashed ticket assets lose their token denomination in refund accounting #1711 — d858ae36, db322193
• H-03 — [Audit H-03] Deferred Lane A slash targets can exit before financial execution #1709 — 73826ad8
• H-04 — [Audit H-04] Upgrade validation has no committed baseline despite hard-coded storage slots #1714 — b124f06e, ecb4acb4

Medium

• M-01 — [Audit M-01] A stale exit-queue head permanently exhausts the 64-tranche cap #1717 — 79ba4e8f, 99545842
• M-02 — [Audit M-02] A shared claim flag destroys one entitlement for dual-role accounts #1718 — 593fcfb6
• M-03 — [Audit M-03] Mutable bonding thresholds leave cached active status and count stale #1721 — 66735a2f
• M-04 — [Audit M-04] Dependency rotation is not snapshotted for in-flight E3s #1720 — 19fd9e75, e8000792
• M-05 — [Audit M-05] Failed slashed-fund routing is final and has no retry path #1719 — e1c6d3d9, a72a5bea
• M-07 — [Audit M-07] Refund/slash allocation changes apply retroactively to existing E3s #1716 — 1f5f57a9
• M-08 — [Audit M-08] Bonding asset rotation can strand or mis-account outstanding balances #1722 — df5c5802

Low

• L-01 — [Audit L-01] Permissionless sale deployment can be front-run to consume the one-shot config #1724 — cf7e9d0d
• L-02 — [Audit L-02] Verifier constructors accept zero/invalid trust anchors #1726 — a9a337ef
• L-03 — [Audit L-03] Core runtime bytecode has dangerously little release headroom #1723 — 6983f8f0

Validation

• Hardhat: 505 passing, 2 intentionally pending
• Rust workspace library tests: 237 passing across the two largest ZK helper/prover suites, with the full workspace library run green
• ciphernode source-aligned integration in proof-skip mode: 3 passing, 2 intentionally ignored
• SDK build and tests: 7 passing
• Noir: formatting green, 154 tests passing
• generated DKG/decryption verifier consistency: green
• upgrade storage-layout validation: green against reviewed committed baselines
• size gate: Interfold 24,058 bytes (518 bytes EIP-170 headroom); both final aggregator verifiers 23,980 bytes
• contract lint: 0 errors, 4 pre-existing warnings
• template and CRISP contract compilation: green

Issue resolution

Closes #1708
Closes #1709
Closes #1710
Closes #1711
Closes #1712
Closes #1714
Closes #1716
Closes #1717
Closes #1718
Closes #1719
Closes #1720
Closes #1721
Closes #1722
Closes #1723
Closes #1724
Closes #1726

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
crisp	Error		Jul 17, 2026 12:20pm
interfold-dashboard	Ready	Preview, Comment	Jul 17, 2026 12:20pm
interfold-docs	Ready	Preview, Comment	Jul 17, 2026 12:20pm