Security release/candidate 1 - #4109

Open

lionakhnazarov wants to merge 247 commits into

threshold-network:mainfrom

lionakhnazarov:security-release/candidate-1

Commits on Jul 12, 2026

Harden sensitive legacy surfaces

mswilkison
authored and
lionakhnazarov
committed
Add sensitive fix regression coverage

mswilkison
authored and
lionakhnazarov
committed
Allow PR path filters to read changed files

mswilkison
authored and
lionakhnazarov
committed
fix: address review findings from sensitive security fixes

piotr-roslaniec
authored and
lionakhnazarov
committed
docs(security): align operator-facing samples with diagnostics opt-in default

lrsaturnino
authored and
lionakhnazarov
committed
fix(deps): remediate Sysdig keep-client:v2.5.2 image vulnerabilities (#10)

authored and
lionakhnazarov
committed
fix(docker): bump Alpine base 3.21 -> 3.23 for OS-package CVEs (#15)

authored and
lionakhnazarov
committed
fix(deps): bump go-ethereum v1.13.15 -> v1.17.3 (#13)

authored and
lionakhnazarov
committed
Add renovate.json (#7)

renovate[bot]
authored and
lionakhnazarov
committed
fix(bitcoin): bounds-check untrusted transaction indexing (OOB crash cluster)

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(beacon/gjkr): guard nil revealed share in ComputeGroupPublicKeyShares

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(chain/ethereum): map RedemptionRequested TxMaxFee from the correct field

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(tbtc): eliminate data races in signingDoneCheck

piotr-roslaniec
authored and
lionakhnazarov
committed
test(net/retransmission): fix racy assertion in TestRetransmitExpectedNumberOfTimes

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(net/retransmission): eliminate data races in Ticker shutdown and ticker tests

piotr-roslaniec
authored and
lionakhnazarov
committed
chore: open testing-hardening epic integration branch

piotr-roslaniec
authored and
lionakhnazarov
committed
ci(client): add non-blocking race-detector test job

piotr-roslaniec
authored and
lionakhnazarov
committed
ci(client): enforce bounds-checked Transaction indexing via golangci-lint

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(client): bounds-check node-supplied tx indexing in redemption/moved-funds paths

piotr-roslaniec
authored and
lionakhnazarov
committed
test(bitcoin): add native coverage-guided fuzz targets for untrusted parsers

piotr-roslaniec
authored and
lionakhnazarov
committed
test: native fuzz targets for untrusted protobuf message unmarshalers

piotr-roslaniec
authored and
lionakhnazarov
committed
test(bitcoin): make fuzz seeds self-contained for the native-fuzzing shim

piotr-roslaniec
authored and
lionakhnazarov
committed
Revert "Merge pull request #33 from tlabs-xyz/epic/testing"

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(deps): update golang.org/x/exp digest to c48552f

renovate[bot]
authored and
lionakhnazarov
committed
chore(deps): update github.com/threshold-network/tss-lib digest to 86bd1a3

renovate[bot]
authored and
lionakhnazarov
committed
chore(deps): go mod tidy after merging x/exp (#23) and tss-lib (#19) bumps into epic

Piotr Rosłaniec
authored and
lionakhnazarov
committed
fix(deps): replace dependency redux-devtools-extension with @redux-devtools/extension

renovate[bot]
authored and
lionakhnazarov
committed
chore(deps): replace dependency babel-eslint with @babel/eslint-parser ^7.11.0

renovate[bot]
authored and
lionakhnazarov
committed
chore(deps): regenerate token-stakedrop lockfile for @babel/eslint-parser

Piotr Rosłaniec
authored and
lionakhnazarov
committed
chore: seed Tier 2 Byzantine DST epic

piotr-roslaniec
authored and
lionakhnazarov
committed
test(dkgtest): add Tier-2 determinism probe (work-package 0)

piotr-roslaniec
authored and
lionakhnazarov
committed
feat(interception): sender-attributed Strategy action API

piotr-roslaniec
authored and
lionakhnazarov
committed
test(byzantine): add Byzantine strategy library and DKG scenarios

piotr-roslaniec
authored and
lionakhnazarov
committed
test(signing): whole-protocol tECDSA signing harness + Byzantine scenario

piotr-roslaniec
authored and
lionakhnazarov
committed
test(tbtc): Byzantine coordination harness + withholding-leader scenario

piotr-roslaniec
authored and
lionakhnazarov
committed
test(byzantine): F-008 reconstruction-path corroboration + dkgtest log capture

piotr-roslaniec
authored and
lionakhnazarov
committed
test(signing): make Byzantine withhold test falsifiable

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(byzantine): address review findings on interceptor strategy API

piotr-roslaniec
authored and
lionakhnazarov
committed
Revert "Revert "Merge pull request #33 from tlabs-xyz/epic/testing""

piotr-roslaniec
authored and
lionakhnazarov
committed
docs(changelog): add CHANGELOG entry for testing/correctness hardening (#36)

Piotr Rosłaniec
authored and
lionakhnazarov
committed
docs(changelog): add CHANGELOG entry for Byzantine interceptor Strategy API (#34)

Piotr Rosłaniec
authored and
lionakhnazarov
committed
docs(changelog): add CHANGELOG entry for tECDSA signing test harness (#38)

Piotr Rosłaniec
authored and
lionakhnazarov
committed
docs(changelog): add CHANGELOG entry for Byzantine coordination harness (#39)

Piotr Rosłaniec
authored and
lionakhnazarov
committed
docs(changelog): add CHANGELOG entry for F-008 corroboration test (#40)

Piotr Rosłaniec
authored and
lionakhnazarov
committed
ci: continuous fuzzing via ClusterFuzzLite (Tier 1 / 1b)

piotr-roslaniec
authored and
lionakhnazarov
committed
ci(fuzz): grant security-events write for SARIF upload

piotr-roslaniec
authored and
lionakhnazarov
committed
test: rapid model-based property tests for the logic-bug class (Tier 1 / 1c)

piotr-roslaniec
authored and
lionakhnazarov
committed
chore: gitignore rapid property-test failure artifacts

piotr-roslaniec
authored and
lionakhnazarov
committed
ci(client): alert on nightly race-detector failures and widen race timeout

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(lint): type-constrain the tx-indexing ruleguard rule to bitcoin.Transaction

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(fuzz): pin go-118-fuzz-build to a commit SHA in the CFLite build

piotr-roslaniec
authored and
lionakhnazarov
committed
ci(fuzz): drop SARIF upload and pin ClusterFuzzLite actions by SHA

piotr-roslaniec
authored and
lionakhnazarov
committed
ci(fuzz): trigger PR fuzzing on fuzz-build infrastructure changes

piotr-roslaniec
authored and
lionakhnazarov
committed
ci(fuzz): guard against fuzz-target drift from the CFLite build list

piotr-roslaniec
authored and
lionakhnazarov
committed
test(net/libp2p): fuzz identity.Unmarshal, the pre-verification sender parse

piotr-roslaniec
authored and
lionakhnazarov
committed
test(chain/ethereum): assert all redemption event fields in the F-014 property

piotr-roslaniec
authored and
lionakhnazarov
committed
test(tecdsa/retry): assert success/failure explicitly in retry properties

piotr-roslaniec
authored and
lionakhnazarov
committed
test(bitcoin): assert serialization fixed point in the transaction fuzzer

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(fuzz): digest-pin the CFLite base-builder-go image

piotr-roslaniec
authored and
lionakhnazarov
committed
docs(fuzz): require a fine-grained, single-repo PAT for corpus storage

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(fuzz): keep checkout paths out of the drift guard's sed pattern

piotr-roslaniec
authored and
lionakhnazarov
committed
Bind tss-lib sessions to TECDSA session IDs

mswilkison
authored and
lionakhnazarov
committed
Address session nonce review feedback

mswilkison
authored and
lionakhnazarov
committed
Strengthen session nonce wiring tests

mswilkison
authored and
lionakhnazarov
committed
Bind signing nonces to attempt start blocks

mswilkison
authored and
lionakhnazarov
committed
Update tss-lib hardening integration

mswilkison
authored and
lionakhnazarov
committed
Thread signing/DKG session ID through attempt params

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(signingtest): pad harness session ID to clear tss-lib 16-byte floor

Piotr Rosłaniec
authored and
lionakhnazarov
committed
security: add whitebox pentesting materials

piotr-roslaniec
authored and
lionakhnazarov
committed
security: add findings and ignore env files

piotr-roslaniec
authored and
lionakhnazarov
committed
security: unify findings into single F-01 through F-17 numbering

piotr-roslaniec
authored and
lionakhnazarov
committed
security: add verification status to all 17 findings

piotr-roslaniec
authored and
lionakhnazarov
committed
security: update finding verification status to valid/not-remediated

piotr-roslaniec
authored and
lionakhnazarov
committed
security: update F-04 and F-05 findings status

piotr-roslaniec
authored and
lionakhnazarov
committed
security: downgrade F-06 to Low/Informational -- on-chain BLS verify mitigates impact

piotr-roslaniec
authored and
lionakhnazarov
committed
security: downgrade F-07 to Low/Mitigated by Design -- intentional cross-codebase pattern

piotr-roslaniec
authored and
lionakhnazarov
committed
security: downgrade F-08 to Low/Informational -- intentional post-TIP-092 governance design

piotr-roslaniec
authored and
lionakhnazarov
committed
security: mark F-09 remediated -- ReentrancyGuard added to submitRelayEntry

piotr-roslaniec
authored and
lionakhnazarov
committed
security: close F-10 as Informational -- cipher is XSalsa20-Poly1305 (NaCl secretbox), sound

piotr-roslaniec
authored and
lionakhnazarov
committed
security: update F-11 with self-correction (positive cache, not negative cache)

piotr-roslaniec
authored and
lionakhnazarov
committed
security: update F-12 -- downgrade to Low/Informational, remove K8s context, note operational design

piotr-roslaniec
authored and
lionakhnazarov
committed
security: update F-13 as fixed -- deduplicator TOCTOU race resolved

piotr-roslaniec
authored and
lionakhnazarov
committed
security: close F-14 as informational -- v1 contracts deprecated, immutable, zero balance

piotr-roslaniec
authored and
lionakhnazarov
committed
security: update F-15 as remediated -- exponent verified correct, test added

piotr-roslaniec
authored and
lionakhnazarov
committed
security: close F-16 as informational -- aggregation functions have no production callers

piotr-roslaniec
authored and
lionakhnazarov
committed
security: close F-17 as accepted -- single RPC endpoint is an architectural constraint

piotr-roslaniec
authored and
lionakhnazarov
committed
security: update F-02 status to partially remediated; fix README findings link

piotr-roslaniec
authored and
lionakhnazarov
committed
security: mark F-03 remediated -- HKDF-SHA256 with domain separation applied

piotr-roslaniec
authored and
lionakhnazarov
committed
security: close F-01 as invalid -- persistence layer encrypts key shares at rest

piotr-roslaniec
authored and
lionakhnazarov
committed
security: sync findings with latest remediations

piotr-roslaniec
authored and
lionakhnazarov
committed
security: address PR review feedback on findings and architecture docs

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(altbn128): replace unbounded try-and-increment hash-to-curve with bounded counter-based approach

piotr-roslaniec
authored and
lionakhnazarov
committed
security(F-03): replace SHA-256 with HKDF-SHA256 for ECDH key derivation

piotr-roslaniec
authored and
lionakhnazarov
committed
docs: add breaking changes changelog for security remediations

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(random-beacon): add ReentrancyGuard to submitRelayEntry (F-09)

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(tbtc): eliminate deduplicator TOCTOU by replacing Has+Add with atomic Add

piotr-roslaniec
authored and
lionakhnazarov
committed
test(altbn128): assert sqrtGfP2 exponent matches (p^2+15)/32

piotr-roslaniec
authored and
lionakhnazarov
committed
chore: ignore local env files and strix_runs directory

piotr-roslaniec
authored and
lionakhnazarov
committed
test(gjkr): replace inlined ECDH label logic with gjkrEcdhInfo call in MITM test

piotr-roslaniec
authored and
lionakhnazarov
committed
docs(altbn128): correct G1HashToPoint comment -- bounded but not normalised timing

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(tbtc): clarify deduplicator comment -- mutex-serialized not hardware-atomic

piotr-roslaniec
authored and
lionakhnazarov
committed
docs: correct G1HashToPoint timing claim in breaking changes doc

piotr-roslaniec
authored and
lionakhnazarov
committed
test(ephemeral): use labeled info in test helper; add nil-vs-label regression

piotr-roslaniec
authored and
lionakhnazarov
committed
ci: trigger contract workflows on security/whitebox-pentesting-materials PRs

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(random-beacon): replace OZ ReentrancyGuard with inline custom-error guard

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(random-beacon): fix Prettier formatting and gas offset for nonReentrant

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(random-beacon): update gas offset fixture to match new nonReentrant offset

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(gjkr): expose gjkrEcdhInfo via export_test.go for external test package

piotr-roslaniec
authored and
lionakhnazarov
committed
fix(security): pin MemberIndex uint8 invariant, fix F-02 wording, document panic

piotr-roslaniec
authored and
lionakhnazarov
committed
chore: trigger CI on PR #5 head

piotr-roslaniec
authored and
lionakhnazarov
committed
security: update F-09 fix description and add findings summary table to README

piotr-roslaniec
authored and
lionakhnazarov
committed
security: downgrade F-02 to Low -- public inputs only

piotr-roslaniec
authored and
lionakhnazarov
committed
security: resync overview docs against post-fix code

piotr-roslaniec
authored and
lionakhnazarov
committed
test(altbn128,tbtc): pin G1 wire format and add F-13 concurrent regression

piotr-roslaniec
authored and
lionakhnazarov
committed
test(random-beacon): add F-09 reentrancy, storage-layout, and gas-offset regressions

piotr-roslaniec
authored and
lionakhnazarov
committed
test(altbn128): gofmt fix on TestG1HashToPointWireFormat

piotr-roslaniec
authored and
lionakhnazarov
committed
test(random-beacon): satisfy contracts-lint on new test files

piotr-roslaniec
authored and
lionakhnazarov
committed
test(random-beacon): satisfy prettier on StorageLayout cast and string break

piotr-roslaniec
authored and
lionakhnazarov
committed
test(random-beacon): break long layout-assign per prettier

piotr-roslaniec
authored and
lionakhnazarov
committed
test(random-beacon): drop misframed refund-vs-cost check, fix slot hex coercion

piotr-roslaniec
authored and
lionakhnazarov
committed
chore: gitignore .claude/ and remove accidentally tracked session lock

piotr-roslaniec
authored and
lionakhnazarov
committed
test(random-beacon): remove stray blank line in Relay.test.ts

piotr-roslaniec
authored and
lionakhnazarov
committed
test(random-beacon): zero-pad slot index for getStorageAt (32-byte hex)

piotr-roslaniec
authored and
lionakhnazarov
committed
test(random-beacon): bypass ethers hexValue zero-stripping for getStorageAt

piotr-roslaniec
authored and
lionakhnazarov
committed
docs: add post-merge release and analysis notes

piotr-roslaniec
authored and
lionakhnazarov
committed
docs: add PR risk and release analyses for keep-common, tss-lib, keep-core-security

piotr-roslaniec
authored and
lionakhnazarov
committed
docs(changelog): assemble canonical CHANGELOG for all functional PRs in epic

Piotr Rosłaniec
authored and
lionakhnazarov
committed
fix(spv): compute required proof headers from actual header difficulties
lionakhnazarov
committed
test: align OOB guard error assertions with OutputAt/InputAt messages

lionakhnazarov
and
cursoragent
committed
fix(bitcoin): align out-of-range test assertion with OutputAt message

lrsaturnino
authored and
lionakhnazarov
committed
fix(bitcoin): guard Difficulty against a zero target

lrsaturnino
authored and
lionakhnazarov
committed
fix(beacon): make DKG-started deduplication atomic

lrsaturnino
authored and
lionakhnazarov
committed
fix(random-beacon): preserve change period when finalizing decrease-delay update

lrsaturnino
authored and
lionakhnazarov
committed
chore(spv): drop unused difficultyEpochLength constant and clarify header-cap comment

lrsaturnino
authored and
lionakhnazarov
committed
docs: clarify hash-to-point breaking-change scope and coordinated-upgrade requirement

lrsaturnino
authored and
lionakhnazarov
committed
fix(spv): fail loud on permanent proof header cap skip
lionakhnazarov
committed
fix(gjkr): fail closed on missing reconstructed share in phase 12
lionakhnazarov
committed
docs: add BC/OV operator table and OV-2 metric rename to changelog
lionakhnazarov
committed
chore: stop tracking Yarn install-state cache
lionakhnazarov
committed
docs: reconcile tss-lib pin with go.mod in CHANGELOG
lionakhnazarov
committed
docs: label non-security infra and CI scope in CHANGELOG
lionakhnazarov
committed
fix(rebase): restore go.sum and signing session-ID test expectations after upstream/main rebase

lionakhnazarov
and
cursoragent
committed

Commits on Jul 15, 2026

Commits on Jul 16, 2026

fix(deps): restore go-ethereum v1.17.3 and Go 1.25 after rebase
lionakhnazarov
committed

Uh oh!

Commits

Commits on Jul 12, 2026