fix: bind jump permits to gate extension (shadow permit vulnerability) - #172
Open
0xxlegolas wants to merge 3 commits into
Open
fix: bind jump permits to gate extension (shadow permit vulnerability)#1720xxlegolas wants to merge 3 commits into
0xxlegolas wants to merge 3 commits into
Conversation
Store the issuing extension witness type on JumpPermit and verify it in validate_jump_permit (and delete_jump_permit_with_auth). This prevents a permit from being used after the gate's extension is revoked or swapped (shadow permits). Targets a fresh contract deployment, so no V2/migration is needed. Adds tests covering revoked and swapped extensions.
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes the “shadow permit” vulnerability in world::gate by binding JumpPermit validity to the currently-configured gate extension witness type, preventing permits minted under a previous extension configuration from being used after revocation or swap.
Changes:
- Adds
extension_type: TypeNametoJumpPermitand validates it against the gates’ configured extension duringjump_with_permit. - Introduces new abort reasons for extension/permit mismatches and exposes a
jump_permit_extensionaccessor. - Extends
gate_testswith scenarios covering revocation and extension swapping to ensure old permits cannot be reused.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| contracts/world/sources/assemblies/gate.move | Binds permits to extension type and enforces extension/permit consistency during validation and auth-based deletion. |
| contracts/world/tests/assemblies/gate_tests.move | Adds regression tests for permit invalidation after extension revocation and after extension swaps. |
Address PR review: make EExtensionNotConfigured generic (no longer mentions freezing) and drop "Linked" from EGateExtensionMismatch since the check runs before link validation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the shadow-permit vulnerability in
world::gatewhere aJumpPermitissued under one extension stayed valid after the gate's extension (Authwitness) was revoked or swapped.validate_jump_permitonly checkedroute_hash, expiry, and character, never the extension -- so legacy permits could bypass the active extension's logic.This is the fresh-deployment alternative to #153. Because we are deploying a new contract (no existing on-chain
JumpPermitobjects), we fixJumpPermitdirectly instead of introducing a backward-compatibleJumpPermitV2+ migration path. No new entrypoints, no migration tooling, no client/script changes.