[audit][S03] Non-root chunk restoration can panic before structural rejection

[QuantumExplorer]

Audit group: S03. Classification: security. Provisional severity: medium.

Static review of audited snapshot 2fa0f133 identifies a structural validation gap in non-root chunk restoration. The affected path can reach an unchecked key assumption instead of returning a chunk-validation error. This is a medium availability finding for integrations that expose the library's restoration workflow; the consequences of a panic depend on the host's handling policy.

The expected contract is that a successfully authenticated chunk also satisfies the structural requirements of the operation that consumes it. In the retained trace, chunk verification establishes the expected commitment but does not require a materialized keyed root. Non-root processing rewrites a stored parent link before the later writer performs its root-shape rejection. The rewrite therefore relies on an invariant that admission has not established.

The prerequisite is a pending non-root chunk with an existing parent link. Unknown chunk identifiers and mismatching commitments are rejected. Initial-root handling already returns a validation error for the corresponding unsupported root structure. Its test coverage does not establish that the earlier non-root parent-link branch is safe, and no successful wrong-root restoration is claimed here.

Merged PR #597 corrected the initial writer's missing-key handling; the remaining route occurs before that corrected code. PR #481 separately handles aggregate-data errors in parent-link rewriting. Existing issue #706 concerns aggregate verification, while #705 and PR #750 concern multi-chunk ordering. Those improvements are relevant counterevidence but do not enforce this earlier keyed-root requirement.

Validate the supported keyed-root shape before any parent-link update, and return a typed validation error when the invariant is absent. Keep initial and non-root processing consistent and preserve ordinary valid restoration. This report is based on provisional static control-flow review only. No input reproduction, runtime panic test, network service or deployed caller was exercised. A process-wide outage is not established; the supported result is an unchecked panic path in the library.

Validation to complete

• Verify root and non-root admission establish the same keyed-root invariant before mutation.
• Preserve existing initial-root rejection coverage and add ordinary non-root structural validation checks.
• Ensure failed structural checks return typed errors and leave restoration obligations coherent.

Limits and existing work

• Residual non-root route is distinct from merged PR fix: replace panicking unwraps in chunk restoration with error propagation (H5, M4) #597 initial-root fix.
• Runtime panic containment and affected deployment are unknown.

Related tracking: issue #706 (open), issue #705 (closed), PR #597 (merged), PR #481 (merged), PR #750 (merged).

Scope: saved GroveDB worktree with revision context 2fa0f133877420a0d9c91ba7bc51b1775ab8c783. This report does not establish that current develop or any deployed application is affected. Focused runtime validation remains outstanding.

Audit source and canonical finding identifiers

Source status: snapshot-backed (git_worktree); plain source locations are used because this is not a sealed commit-only scan.

Audited revision context: 2fa0f133877420a0d9c91ba7bc51b1775ab8c783.

The findings were manually reconciled from a preserved scan bundle. The native scan ended before final completion; these are provisional source-review findings, not a completed native scan certification.

Canonical finding ID: csf_5c2fbc5b30b32409a0ba6c5f

Primary fingerprint: codex-security/v1:sha256:e7e9c0505403113b4ef18456c7771bfec74e3e7336a5e302fa55c5d2c79303d0

Canonical finding ID: csf_56d2cd564c651da4076006c4

Primary fingerprint: codex-security/v1:sha256:f8d88f675e291d2965394cdcde846ede0cd837c3c5d4847f01471ce067be2c1e

Canonical finding ID: csf_261e564d817f9f12c0006a06

Primary fingerprint: codex-security/v1:sha256:1c76ffe4667d366c2715ccc89c097fd18d8f2e3c4b8b742a8518794fd21dccab

Source locations:

• Location (root_control): merk/src/merk/restore.rs:242-263
• Location (propagation): merk/src/merk/restore.rs:145-162
• Location (sink): merk/src/merk/restore.rs:501-508
• Location (entrypoint): grovedb/src/replication/state_sync_session.rs:109-111
• Location (entrypoint): merk/src/merk/restore.rs:242-259
• Location (propagation): merk/src/proofs/tree.rs:130-137
• Location (propagation): merk/src/merk/restore.rs:140-168
• Location (root_control): merk/src/merk/restore.rs:497-503
• Location (supporting): merk/src/merk/restore.rs:145-161
• Location (supporting): merk/src/merk/restore.rs:501-503
• Location (supporting): merk/src/proofs/tree.rs:135
• Location (supporting): merk/src/merk/restore.rs:255-258
• Location (propagation): merk/src/merk/restore.rs:125-180
• Location (root_control): merk/src/merk/restore.rs:251-290
• Location (sink): merk/src/merk/restore.rs:483-510
• Location (propagation): merk/src/merk/restore.rs:145-165
• Location (sink): merk/src/merk/restore.rs:501-503
• Location (supporting): merk/src/proofs/tree.rs:525-550

[QuantumExplorer]

This is Claude, closing on behalf of the maintainer.

Fixed in #840 (44f1eba, merged as 6ec8fee). A non-root chunk consisting of a bare Hash node verifies (its proof-tree hash is the expected hash) but has no key; rewrite_parent_link now returns InvalidChunkProof("non-root chunk cannot be a bare hash node") instead of unwrapping. Test: test_hash_only_non_root_chunk_returns_error_not_panic (the root-chunk case was already covered).