Skip to content

Logbook July 2026

Jump to bottom
Paolo Veronelli edited this page Jul 24, 2026 · 2 revisions

Logbook — July 2026

Week of Jul 6 — A security hole surfaced in the migration path: the Migrating mint let anyone forge a genuine state token for any cage's asset name and Sweep its contributor deposits. The week was spent closing it — spec, plan, and tasks on Tuesday, then a two-commit fix merged Wednesday that parameterizes the state validator with a previousPolicies allowlist and rewrites validateMigration to prove provenance through four ordered guards: allowlisted oldPolicy, a spent predecessor input carrying it, owner authorization, and full field-preservation of the migrated State. A migrate_forged_token_cannot_sweep regression and a live devnet gate confirm the exploit is closed and the off-chain hash still matches the newly parameterized script.

Tuesday 7th

Migration provenance fix (PV)

Issue: #76

Wednesday 8th

Migration provenance fix (PV)

Issue: #76

  • Merged fix(76): authenticate migration provenance to stop cage-token forgery #96 — the Migrating mint path could forge a genuine state token for any cage's asset name and Sweep its contributor deposits; the fix parameterizes the state validator with an immutable previousPolicies allowlist and rewrites validateMigration to prove provenance via four ordered guards (allowlisted oldPolicy, a spent predecessor input carrying it, owner authorization, full field-preservation of the migrated State). Off-chain adds applyPreviousPolicies and applies the empty genesis allowlist so cfgScriptHash still matches the on-chain script; a migrate_forged_token_cannot_sweep regression plus a live cage-tests-e2e devnet gate (6 examples, 0 failures) confirm the exploit is closed and the applied hash matches

Logbook

Clone this wiki locally