Skip to content

[audit][P05] Broad non-Merk proof checks allocate heavily before parent metadata is authenticated #856

Description

@QuantumExplorer

Audit group: P05. Classification: security. Provisional severity: medium.

Non-Merk completeness checks enumerate positions from parent counts before those metadata are bound to the trusted commitment. The existing cap bounds the work, but broad queries can still incur substantial allocation and diagnostic expansion even with a small result limit.

Authenticate parent metadata before count-dependent work where possible; precheck cardinality and use interval or streaming completeness with explicit allocation and diagnostic budgets.

PR #415 introduced soundness/completeness checks. PR #838 corrects the prior assumption that all count-dependent arithmetic follows parent authentication. Neither history item establishes that these enumeration budgets were resolved; this is distinct from unchecked MMR position arithmetic.

Source-based assessment only; this audit did not reproduce the reported behavior at runtime.

Validation to complete

  • Review interval/cardinality bounds and diagnostic limits using bounded existing completeness fixtures, with explicit separation of result limits and work budgets.

Related tracking: PR #415 (merged), PR #838 (open).

Scope: saved GroveDB worktree with revision context 2fa0f133877420a0d9c91ba7bc51b1775ab8c783. This report does not establish that current develop or any deployed application is affected. Focused runtime validation remains outstanding.

Audit source and canonical finding identifiers

Source status: snapshot-backed (git_worktree); plain source locations are used because this is not a sealed commit-only scan.

Audited revision context: 2fa0f133877420a0d9c91ba7bc51b1775ab8c783.

The findings were manually reconciled from a preserved scan bundle. The native scan ended before final completion; these are provisional source-review findings, not a completed native scan certification.

Canonical finding ID: csf_511bc8669ee3f63cc3810e8a

Primary fingerprint: codex-security/v1:sha256:feaceeb51b84317ed29dfdb3fc0822d7268f03f5fd7b00dcfb370eafc65947e4

Source locations:

  • Location (root_control): grovedb/src/operations/proof/verify.rs:2327-2383
  • Location (implementation): grovedb/src/operations/proof/verify.rs:1920-2004
  • Location (implementation): grovedb/src/operations/proof/verify.rs:2447-2473
  • Location (implementation): grovedb/src/operations/proof/verify.rs:2800-2833
  • Location (implementation): grovedb/src/operations/proof/verify.rs:2862-2888

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:proofs-queriesP groups: proof generation, verification, completeness and query semantics.audit:2026-09Reconciled September 2026 GroveDB audit; audited worktree at 2fa0f133.audit:needs-validationSaved source evidence reviewed; focused runtime and deployment validation outstanding.bugSomething isn't workingseverity:medium-provisionalMedium impact in the audited scenario; provisional static assessment.type:securityAudit reports a security property failure; deployment impact needs validation.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions