Audit group: P20. Classification: security. Provisional severity: high.
V1 query descent interprets composite element classification before binding it. Required descent can bypass the terminal-result branch containing empty-tree authentication, while the missing-layer decision depends on the same unbound classification. This can turn an omitted descent into an incorrect absence outcome despite a valid root.
Authenticate element type and emptiness before inclusion, descent, or absence decisions, and reject required descents without authenticated supporting evidence.
PR #631 binds empty trees included in results; #633/#782 strengthen terminal child-hash checks, and #781 binds available subset lower layers. This group concerns paths omitted before those result/layer checks. It is distinct from raw reference representation and optional terminal enumeration.
Source-based assessment only; this audit did not reproduce the reported behavior at runtime.
Validation to complete
- Compare required descents and branched ancestor absence against trusted query outcomes using existing bounded valid fixtures and the intended inclusion options.
Related tracking: PR #631 (merged), PR #633 (merged), PR #781 (merged), PR #782 (merged).
Scope: saved GroveDB worktree with revision context 2fa0f133877420a0d9c91ba7bc51b1775ab8c783. This report does not establish that current develop or any deployed application is affected. Focused runtime validation remains outstanding.
Audit source and canonical finding identifiers
Source status: snapshot-backed (git_worktree); plain source locations are used because this is not a sealed commit-only scan.
Audited revision context: 2fa0f133877420a0d9c91ba7bc51b1775ab8c783.
The findings were manually reconciled from a preserved scan bundle. The native scan ended before final completion; these are provisional source-review findings, not a completed native scan certification.
Canonical finding ID: csf_a905bf7c4c67d69d1021f935
Primary fingerprint: codex-security/v1:sha256:5d7d9e497e5d67d68c3d48b697951d26d55650d5e7ddd4614d89f6012a1dc9b7
Source locations:
- Location (root_control):
grovedb/src/operations/proof/verify.rs:2063-2067
- Location (supporting):
grovedb/src/operations/proof/verify.rs:2132-2149
- Location (sink):
grovedb/src/operations/proof/verify.rs:2213-2223
- Location (outcome):
grovedb/src/operations/proof/verify.rs:449-465
- Location (supporting):
merk/src/proofs/query/verify.rs:381-394
- Location (supporting):
merk/src/proofs/tree.rs:153-165
Audit group: P20. Classification: security. Provisional severity: high.
V1 query descent interprets composite element classification before binding it. Required descent can bypass the terminal-result branch containing empty-tree authentication, while the missing-layer decision depends on the same unbound classification. This can turn an omitted descent into an incorrect absence outcome despite a valid root.
Authenticate element type and emptiness before inclusion, descent, or absence decisions, and reject required descents without authenticated supporting evidence.
PR #631 binds empty trees included in results; #633/#782 strengthen terminal child-hash checks, and #781 binds available subset lower layers. This group concerns paths omitted before those result/layer checks. It is distinct from raw reference representation and optional terminal enumeration.
Source-based assessment only; this audit did not reproduce the reported behavior at runtime.
Validation to complete
Related tracking: PR #631 (merged), PR #633 (merged), PR #781 (merged), PR #782 (merged).
Scope: saved GroveDB worktree with revision context
2fa0f133877420a0d9c91ba7bc51b1775ab8c783. This report does not establish that currentdevelopor any deployed application is affected. Focused runtime validation remains outstanding.Audit source and canonical finding identifiers
Source status: snapshot-backed (
git_worktree); plain source locations are used because this is not a sealed commit-only scan.Audited revision context:
2fa0f133877420a0d9c91ba7bc51b1775ab8c783.The findings were manually reconciled from a preserved scan bundle. The native scan ended before final completion; these are provisional source-review findings, not a completed native scan certification.
Canonical finding ID:
csf_a905bf7c4c67d69d1021f935Primary fingerprint:
codex-security/v1:sha256:5d7d9e497e5d67d68c3d48b697951d26d55650d5e7ddd4614d89f6012a1dc9b7Source locations:
grovedb/src/operations/proof/verify.rs:2063-2067grovedb/src/operations/proof/verify.rs:2132-2149grovedb/src/operations/proof/verify.rs:2213-2223grovedb/src/operations/proof/verify.rs:449-465merk/src/proofs/query/verify.rs:381-394merk/src/proofs/tree.rs:153-165