[audit][S02] State sync can complete with committed child data missing

[QuantumExplorer]

Audit group: S02. Classification: security. Provisional severity: high.

Static review of audited snapshot 2fa0f133 identifies a remaining child-completeness gap in state synchronization. A completed session can retain the expected top-level root while a committed nonempty descendant has not been restored. The supported case requires a fresh or empty destination child namespace beneath an authenticated parent; current develop and deployment exposure were not assessed by this tracking pass.

The expected contract is that successful synchronization restores all state committed by the trusted root. Empty-child completion instead establishes that the destination currently has no child data. The relevant branch bypasses the restorer's expected child-commitment check and consumes the restorer without its ordinary finalization obligations. Subsequent discovery treats the local child as empty. Final root equality uses the parent commitments already present in the root tree, rather than independently reconstructing the absent descendant storage.

The distinction between root and child matters. Omitting a nonempty top-level tree fails final root comparison. A destination already containing a nonempty child can fail the local empty check. Those controls do not prove source emptiness for a fresh child destination. An application-level full consistency traversal before promotion may detect missing contents, but that is additional to this completion path.

Merged PR #559 describes the original empty-child concern and explicitly relies on PR #558's final root check for the fresh-destination case. The preserved source trace finds that reliance insufficient. This report therefore tracks the remaining verification obligation, not the already effective prepopulated-destination check.

Introduce checked empty-child finalization that verifies the expected parent-bound empty commitment and preserves every outstanding obligation until validation succeeds. Require descendant completeness before promotion. Genuine empty children must continue to restore correctly. This provisional static review did not execute a response reproduction or runtime round trip. Independent records rated the same mechanism high or medium; high here denotes the successful incomplete-state acceptance contract, not proven downstream exploitation.

Validation to complete

• Check complete descendant contents after successful ordinary nested-tree restoration, in addition to root equality.
• Verify checked empty finalization distinguishes genuine empty source children from incomplete destination storage.
• Preserve pending obligations on rejection and cover fresh versus prepopulated destination behavior.

Limits and existing work

• Residual of merged PR fix: validate empty subtree chunks during state sync (M2) #559, not a same-root existing issue; cross-reference the earlier fix rather than assuming it fully remediates the case.
• Separate from failure durability [audit][low] State sync commits subtree batches before final root verification #679/State sync can leave committed partial state when a sync fails late #775.
• High/medium disagreement and unknown deployment exposure remain recorded.

Related tracking: issue #679 (open), issue #775 (open), PR #559 (merged), PR #558 (merged), PR #840 (open).

Scope: saved GroveDB worktree with revision context 2fa0f133877420a0d9c91ba7bc51b1775ab8c783. This report does not establish that current develop or any deployed application is affected. Focused runtime validation remains outstanding.

Audit source and canonical finding identifiers

Source status: snapshot-backed (git_worktree); plain source locations are used because this is not a sealed commit-only scan.

Audited revision context: 2fa0f133877420a0d9c91ba7bc51b1775ab8c783.

The findings were manually reconciled from a preserved scan bundle. The native scan ended before final completion; these are provisional source-review findings, not a completed native scan certification.

Canonical finding ID: csf_de56df47d3a51c0a2b97b54b

Primary fingerprint: codex-security/v1:sha256:038206aa96cd1be8a54f0d2e2c95224bc9d3eab3442a4ece984a0bc2644f643e

Canonical finding ID: csf_86e5b3282479b36a9e4037ed

Primary fingerprint: codex-security/v1:sha256:14cffd42104661e79310b4f1ed6443a03b73e289ea1421fb3f05e264c73b0647

Canonical finding ID: csf_4455731f1adb7f87afa24732

Primary fingerprint: codex-security/v1:sha256:f23df6a284f856313e687255f770a259c8529bbfc351f86732d4215282f45213

Canonical finding ID: csf_6c0c9c7acc1d26371a742bde

Primary fingerprint: codex-security/v1:sha256:460863663cf0917a7dcaeaa10869e3cb0840fe9d540b7d13ccf13ef9eb763499

Canonical finding ID: csf_6e35ea6888f1021642a1dab9

Primary fingerprint: codex-security/v1:sha256:852118db66448d92fc80c65ca81f5fdc761435d5f362704975a7442cafb32f16

Canonical finding ID: csf_1359ef125825d4df46e8fc9c

Primary fingerprint: codex-security/v1:sha256:2721d2f7184d64c85ae0f5186bc69fc60356a9e157e7cfd06cf00d8a706fdabc

Canonical finding ID: csf_90ebf0d84620013e60f5adf1

Primary fingerprint: codex-security/v1:sha256:7e3e07f4eca9433cc2cb84c2db4e7080720cf1ef638f41c811609090aef26707

Source locations:

• Location (entrypoint): grovedb/src/replication/state_sync_session.rs:107
• Location (root_control): grovedb/src/replication/state_sync_session.rs:533
• Location (propagation): merk/src/merk/mod.rs:638
• Location (outcome): grovedb/src/lib.rs:634
• Location (expected_control): grovedb/src/replication/state_sync_session.rs:257-269
• Location (entrypoint): grovedb/src/replication/state_sync_session.rs:107-111
• Location (root_control): grovedb/src/replication/state_sync_session.rs:532-547
• Location (propagation): grovedb/src/lib.rs:565-579
• Location (propagation): merk/src/merk/mod.rs:638-649
• Location (outcome): grovedb/src/lib.rs:634-639
• Location (entrypoint): grovedb/src/replication/state_sync_session.rs:104-114
• Location (propagation): merk/src/merk/mod.rs:638-650
• Location (root_control): grovedb/src/replication/state_sync_session.rs:529-552
• Location (outcome): grovedb/src/replication/state_sync_session.rs:560-565
• Location (expected_control): grovedb/src/replication/state_sync_session.rs:256-274
• Location (propagation): grovedb/src/lib.rs:625-650
• Location (root_control): grovedb/src/replication/state_sync_session.rs:534-546
• Location (entrypoint): grovedb/src/replication/state_sync_session.rs:107-110
• Location (propagation): merk/src/merk/mod.rs:639-650
• Location (expected_control): grovedb/src/lib.rs:625-640
• Location (entrypoint): grovedb/src/replication/state_sync_session.rs:102-121
• Location (root_control): grovedb/src/replication/state_sync_session.rs:527-550
• Location (expected_control): merk/src/merk/restore.rs:652-659
• Location (outcome): grovedb/src/lib.rs:625-640
• Location (user_input): grovedb/src/replication/state_sync_session.rs:780-797
• Location (root_control): grovedb/src/replication/state_sync_session.rs:102-112
• Location (sink): grovedb/src/replication/state_sync_session.rs:529-547
• Location (supporting): merk/src/merk/mod.rs:638-649
• Location (supporting): grovedb/src/replication/state_sync_session.rs:673-675
• Location (expected_control): grovedb/src/replication/state_sync_session.rs:348-357
• Location (entrypoint): grovedb/src/replication/state_sync_session.rs:106-119
• Location (root_control): grovedb/src/replication/state_sync_session.rs:529-548
• Location (outcome): grovedb/src/replication/state_sync_session.rs:257-269
• Location (entrypoint): grovedb/src/replication/state_sync_session.rs:107-113
• Location (root_control): grovedb/src/replication/state_sync_session.rs:533-560
• Location (propagation): grovedb/src/replication/state_sync_session.rs:673-675
• Location (outcome): grovedb/src/replication/state_sync_session.rs:257-276

[QuantumExplorer]

This is Claude, closing on behalf of the maintainer.

Fixed in #840 (6ec8fee). An empty payload for a subtree is now accepted only when the commitment the parent holds is the empty-tree commitment (Restorer::expects_an_empty_tree: combine_hash(H(element), NULL_HASH) for parent-bound subtrees, bare NULL_HASH for unbound ones, with indexed members backstopped by the group's joint verification). Independently, is_sync_completed() now requires every prefix the session ever discovered (the root, every child read out of a restored parent, every header-announced secondary) to be in the processed set, so a dropped branch hangs the session instead of verifying. The orphaned-namespace variant (a fresh restore over a directory left by an abandoned incremental one) is closed by refusing to start any session while the incomplete-restore marker is set.

Tests: state_sync_empty_payload_for_a_populated_subtree_is_rejected, state_sync_indexed_lying_empty_header_rejected, a_marked_destination_refuses_to_start_another_restore.