[audit][P03] MMR and dense limited proofs can select the wrong authenticated page

[QuantumExplorer]

Audit group: P03. Classification: security. Provisional severity: medium.

MMR and dense verification authenticates positions and values independently of result-vector order. GroveDB checks the position set, then truncates the supplied sequence. A limited query can therefore select a different page even though the complete set and root are valid.

Order verified entries by authenticated position and trusted query direction before limiting; align standalone and integrated result contracts.

Closed #691 concerns root-only dense proofs and was rejected in the rationale recorded by PR #838. This group preserves value/root and complete-position-set authentication and concerns subsequent ordering and truncation. PR #415 added set completeness; PR #786 supplies related range APIs.

Source-based assessment only; this audit did not reproduce the reported behavior at runtime.

Validation to complete

• Compare limited and unlimited results against trusted reads in both directions using ordinary valid proof fixtures across the MMR and dense adapters.

Related tracking: issue #691 (closed), PR #415 (merged), PR #786 (merged), PR #838 (open).

Scope: saved GroveDB worktree with revision context 2fa0f133877420a0d9c91ba7bc51b1775ab8c783. This report does not establish that current develop or any deployed application is affected. Focused runtime validation remains outstanding.

Audit source and canonical finding identifiers

Source status: snapshot-backed (git_worktree); plain source locations are used because this is not a sealed commit-only scan.

Audited revision context: 2fa0f133877420a0d9c91ba7bc51b1775ab8c783.

The findings were manually reconciled from a preserved scan bundle. The native scan ended before final completion; these are provisional source-review findings, not a completed native scan certification.

Canonical finding ID: csf_7ba4aa62d36b8da13b4f95cd

Primary fingerprint: codex-security/v1:sha256:753f0c0762fe56e91ec39a8cb6d2c2b89f5db92a62cabde1d60a3b5e78c5067e

Canonical finding ID: csf_6e5fb5975a150ebc8e6d4e03

Primary fingerprint: codex-security/v1:sha256:6297cba5be6afd0332a8ee847d08582ebb10773ba1cb21c09da50b3f06824d66

Source locations:

• Location (root_control): grovedb-merkle-mountain-range/src/proof.rs:261-280
• Location (implementation): grovedb-merkle-mountain-range/src/proof.rs:584-601
• Location (implementation): grovedb-dense-fixed-sized-merkle-tree/src/verify.rs:258-283
• Location (implementation): grovedb/src/operations/proof/verify.rs:2327-2383
• Location (implementation): grovedb/src/operations/proof/verify.rs:2600-2651
• Location (root_control): grovedb-dense-fixed-sized-merkle-tree/src/verify.rs:276-283
• Location (root_control): grovedb-merkle-mountain-range/src/proof.rs:590-599
• Location (propagation): grovedb-merkle-mountain-range/src/proof.rs:273-275
• Location (sink): grovedb/src/operations/proof/verify.rs:2643-2649
• Location (sink): grovedb/src/operations/proof/verify.rs:2372-2379
• Location: grovedb/src/operations/proof/verify.rs:2613-2654
• Location: grovedb/src/operations/proof/verify.rs:2330-2383
• Location: grovedb/src/operations/proof/verify.rs:403-465
• Location (root_control): grovedb-dense-fixed-sized-merkle-tree/src/verify.rs:262-264
• Location (root_control): grovedb-dense-fixed-sized-merkle-tree/src/verify.rs:280-281
• Location (root_control): grovedb-merkle-mountain-range/src/proof.rs:273-275
• Location (root_control): grovedb-merkle-mountain-range/src/proof.rs:591-597
• Location (outcome): grovedb/src/operations/proof/verify.rs:2643-2650
• Location (root_control): grovedb-merkle-mountain-range/src/proof.rs:273-276
• Location (propagation): grovedb-merkle-mountain-range/src/proof.rs:585-600
• Location (sink): grovedb/src/operations/proof/verify.rs:2363-2385
• Location (root_control): grovedb-dense-fixed-sized-merkle-tree/src/verify.rs:258-281
• Location (propagation): grovedb-dense-fixed-sized-merkle-tree/src/verify.rs:95-103
• Location (sink): grovedb/src/operations/proof/verify.rs:2622-2650
• Location (entrypoint): grovedb/src/operations/proof/generate.rs:3111-3115