Repository navigation
Fix signer and board rotation with configuration-bound authorization - #2
Merged
Merged
Conversation
Ay-obami
changed the base branch from
audit/attestor-membership-count
to
main
September 28, 2026 09:22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Signer and board replacement left removed addresses authorized, rejected retained members, and retained partial quorums across configuration changes.
This patch clears old membership and versions each configuration. Pending signatures/votes reset on rotation; EIP-712 release instructions use version 2 with signerEpoch, invalidating old signatures even when a key is retained or re-added. Signing-window changes also invalidate pending payloads. Completed authorizations preserve their original signers, digest and deadline; completed reviews preserve their votes.
Service and frontend ABIs match v2. The signer service rejects v1 deployments, skips removed/already-collected signers, and revisits registry IDs in bounded batches. The frontend distinguishes finalized authors from the current roster. Migration policy: docs/AUTHORIZATION_ROTATION_V2.md.
Validation: seven contract regressions failed before the fix; 62 Foundry tests and seven mocked signer-service regressions pass, and frontend TypeScript passes. A new Anvil rehearsal deploys actual modules and invokes production signer/mock-custodian scan methods: service/Solidity digest agreement, stale-payload rejection, partial signer and board quorum resets, retained-member reapproval, preserved historical data and two settlements. It passed locally twice and now runs in CI. Independent review found no remaining important regression.
PR #1 is merged; this PR targets main. This is a breaking source release, not a public-network deployment. Existing v1 addresses retain v1 behavior; operators must coordinate new contracts and client configuration before public-network cutover. Settlement EIP-712 remains version 1. The rehearsal uses a mock token and mock custodian; it does not prove real-world custody settlement.