Skip to content

Security audit fixes: Phase 1-3 + cross-review (GRETH-001~075, ~117 cross-repo findings)#276

Open
Richard1048576 wants to merge 12 commits intomainfrom
bugfix/security-fixes
Open

Security audit fixes: Phase 1-3 + cross-review (GRETH-001~075, ~117 cross-repo findings)#276
Richard1048576 wants to merge 12 commits intomainfrom
bugfix/security-fixes

Conversation

@Richard1048576
Copy link
Collaborator

@Richard1048576 Richard1048576 commented Mar 5, 2026 •
edited
Loading

Summary

Phase 1 Fixes (2026-02-23 Audit, 19 findings — all fixed)

  • GRETH-002/003/004 (CRITICAL): Mint precompile caller, release-mode block validation, cursor drop order
  • GRETH-001/005-019: RPC signer recovery, CLI validation, relayer hardening

Round 2 Design Review (2026-02-27, GRETH-020~028)

  • Accepted fixes implemented; rejected fixes rolled back in 88125970f

Phase 3 Audit + Fixes (2026-03-05, GRETH-029~075)

47 findings, 41 valid and implemented:

Severity Total Valid Implemented
CRITICAL 2 2 2
HIGH 13 13 13
MEDIUM 21 16 16
LOW 11 10 10
Total 47 41 41

CRITICAL fixes:

  • GRETH-029: Timeout on all pipeline barriers + panic monitoring
  • GRETH-030: Cap cache eviction at persist_height

HIGH fixes:

  • GRETH-031: Implement block_hash_ref() (was unimplemented!() — trivial DoS)
  • GRETH-032/033: Fix precompile state merge on epoch-change paths (token loss)
  • GRETH-036: Bounded channels (OOM prevention)
  • GRETH-037/038: Typed event bus with timeout

Cross-Module Deep Audit (2026-03-05)

Parallel audit across grevm, gravity-aptos, contracts, gravity-sdk identified ~117 unique findings total:

Repository New Findings Key Issues
grevm 40 (3 rounds) TOCTOU still exploitable, CommitGuard incomplete, coinbase MVMemory gap
gravity-aptos ~80 (4 rounds) GTxnBytes todo (4 rounds unfixed!), GravityExtension unsigned, JWK cascade
contracts 25 No governance timelock, StakePool reentrancy, O(n²) epoch transitions
gravity-reth 47 BLOCKHASH unimplemented, cache eviction, pipeline deadlock

6 cross-module contradictions and 5 catastrophic hypotheses documented in audit_review_topics/phase3_cross_review_final.md.

Top 3 Systemic Risks

  1. Panic propagation chains — Any unwrap()/assert!() in grevm/gravity-aptos/gravity-reth cascades to halt all validators
  2. Serialization format coupling — BCS/serde_json mismatches between Solidity/Rust create silent corruption
  3. Missing timeout/recovery — DKG stalls, pipeline deadlocks, config init races have no auto-recovery

Cross-repo dependency

GRETH-042 adds failed_proposer_indices: Vec<u64> to OrderedBlock. gravity-sdk needs matching update.

Test plan

  • cargo check --bin reth passes
  • cargo build --bin reth --release --features "jemalloc asm-keccak"
  • cargo nextest run --workspace
  • E2E test with epoch transition scenarios

🤖 Generated with Claude Code

@github-actions
Copy link
Contributor

github-actions bot commented Mar 5, 2026

Your PR title doesn't follow the Conventional Commit guidelines.

Example of valid titles:

  • feat: add new user login
  • fix: correct button size
  • docs: update README

Usage:

  • feat: Introduces a new feature
  • fix: Patches a bug
  • chore: General maintenance tasks or updates
  • test: Adding new tests or modifying existing tests
  • bench: Adding new benchmarks or modifying existing benchmarks
  • perf: Performance improvements
  • refactor: Changes to improve code structure
  • docs: Documentation updates
  • ci: Changes to CI/CD configurations
  • revert: Reverts a previously merged PR
  • deps: Updates dependencies

Breaking Changes

Breaking changes are noted by using an exclamation mark. For example:

  • feat!: changed the API
  • chore(node)!: Removed unused public function

Help

For more information, follow the guidelines here: https://www.conventionalcommits.org/en/v1.0.0/

@Richard1048576 Richard1048576 changed the title Security audit fixes + Phase 2 audit report (GRETH-001 through GRETH-066) Security audit fixes: Phase 1 + Phase 3 implementation (GRETH-001~075) Mar 5, 2026
@Richard1048576 Richard1048576 changed the title Security audit fixes: Phase 1 + Phase 3 implementation (GRETH-001~075) Security audit fixes: Phase 1-3 + cross-review (GRETH-001~075, ~117 cross-repo findings) Mar 5, 2026
Richard1048576 and others added 12 commits March 10, 2026 15:44
@Richard1048576 @claude
docs: add security fix checklist with GRETH-001–019 tracking
1f67fff 
Records all 28 security findings across gravity-reth, gravity-sdk, and
gravity_chain_core_contracts with fix commit hashes, type (code fix /
mitigation / design doc), and current status.

Branches:
  gravity-reth  bugfix/security-fixes — cbccf02, 14b6ce5, f16d356
  gravity-sdk   bugfix/security-fixes — a0bf499

Remaining open: GRAV-005 (contracts repo, separate agent).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Richard1048576 @claude
docs: add security audit report and design documents for 19 findings
1c93f38 
Security audit report covering GRETH-001 through GRETH-019:
- 4 CRITICAL (signer recovery, cursor lifetime, mint precompile, block validation)
- 9 HIGH (persistence, path traversal, state root, oracle, relayer, tx pool)
- 6 MEDIUM (read-your-writes, BLS input, tx filter, state integrity, CLI, DKG)

Design documents detail the fix approach for each severity level.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Richard1048576 @claude
ci: add Claude Code security review GitHub Action
d811867 
Adds automated security review on PRs using anthropics/claude-code-security-review.
Runs on non-draft PRs, uses claude-sonnet-4-6, excludes docs/tests/benches/.github.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Richard1048576
ci: enable run-every-commit and full fetch depth for security review
9efdb70
@Richard1048576 @claude
docs: update GRETH-011 status to receipt proof fix (b7ef203)
3e7a5c7 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Richard1048576 @claude
docs: mark GRAV-005 as fixed (f4c8325 in contracts repo)
10dfed7 
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@nekomoto911 @Richard1048576
docs: add round 2 security audit design documents for 9 findings (#272)
ae1f547 
Security audit round 2 covering GRETH-020 through GRETH-028:
- 2 HIGH (debug-only validation, silent system txn failure)
- 3 MEDIUM (mint precompile trailing bytes, unsafe Send impl, unwrap panic)
- 4 LOW/INFO (nonce truncation, state merge overwrite, same-RPC verification, timestamp check)

Design documents detail the problem and fix approach for each severity level.
@nekomoto911 @Richard1048576
add review comments for GRETH-011 ~ GRETH-018 (#273)
0041ed2
@Lchangliang @Richard1048576
docs: add lightman review comments for GRETH-025 and GRETH-026
34e0248
@ByteYue @Richard1048576
update greth 023 review state
f9f1d7c 
Updated review comments to reflect acceptance of Plan A for the `OracleRelayerManager` changes.
@Richard1048576 @claude
docs: add Phase 2 security audit report (2026-03-05)
a2a62a7 
Multi-agent parallel audit identified 48 new findings across the execution
pipeline, parallel EVM, state integrity, oracle relayer, and GCEI protocol.
Includes 2 CRITICAL (pipeline deadlock, cache eviction), 14 HIGH, 21 MEDIUM,
and 11 LOW severity issues not covered in the 2026-02-23 audit.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Richard1048576 @claude
docs: remove 6 invalid findings from Phase 3 audit report
c56790e 
Removed GRETH-047 (wait_persist_gap by design), GRETH-048 (DELEGATECALL
precompile semantics wrong), GRETH-055 (already fixed by GRETH-022),
GRETH-056 (no orphaned entries), GRETH-061 (wrong function signature),
GRETH-067 (state not lost via DatabaseCommit). Updated counts: 47→41.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@Richard1048576 Richard1048576 force-pushed the bugfix/security-fixes branch from 2e9bae2 to c56790e Compare March 10, 2026 07:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@Richard1048576 @nekomoto911 @Lchangliang @ByteYue