docs(protocol): URC production-readiness review for permissionless preconf - #22012
docs(protocol): URC production-readiness review for permissionless preconf#22012dantaik wants to merge 2 commits into
Conversation
…s preconf Adds a review evaluating the Universal Registry Contract (eth-fabric/urc @ 132bc79) for use as Taiko's operator-registry + slashing backbone for permissionless preconfirmations. Summary of the assessment: - Process/state: main frozen ~13 months; README still says "not ready for production"; Audit 3 unchecked and prior audits (Zellic, Hashlock) predate HEAD; standard-BLS fix stranded on unmerged signing-domain branch; no canonical deployment and zero production users. - Contract findings: two High (opt-in slashCommitment replay; self-triggerable slash-window escape), three Medium (delegation not binding slasher; cross-deployment signature replay -> wrongful equivocation slashing; getters misreport slashable status), plus Lows and a non-RFC-9380 signing scheme. - ePBS/FOCIL: Registry core is fork-agnostic; ePBS forces a Delegation/ Commitment schema decision before an immutable deploy and a rebuild of the slasher layer; FOCIL forces a gateway-ordering spec (Taiko-side). - Includes a full, prioritized change list split by owner (URC contract, URC process, fork-driven, Taiko integration). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EAxjMge8SpdSr3HJTTBgyk
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5d956591c8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - **E‑2 (P1):** Complete **§10.5 poster‑signature domain separation** (EIP‑712 with chainid + verifying contract); partially addressed by `#21346`. | ||
| - **E‑3 (P1):** Harden the `checkProposer` **liveness coupling**: it is called unconditionally inside `propose()` with no gas isolation and no `try/catch`, so a buggy/griefable checker halts the rollup. Add isolation and/or a bounded‑gas contract and a permissionless fallback. | ||
| - **E‑4 (P1):** The design doc assumes a **permissionless escape hatch** ("if forced‑inclusion delay exceeded, `Inbox` bypasses proposer checking"); the current `Inbox.sol` calls `checkProposer` **unconditionally** and the permissionless‑delay knobs are stored but never enforced (kimi‑k3 finding I‑01). Add the bypass if the design relies on it. | ||
| - **E‑5 (P0):** Re‑pin the URC dependency to the audited tag from B‑2, and reconcile the triplicated, inconsistent **handover‑slot constants** (Go default 8, Rust comment 4, ejector 4) before any of them become on‑chain window logic. |
There was a problem hiding this comment.
At the reviewed parent, the Go default is 8 (packages/taiko-client/driver/driver.go:37) and Rust's actual HAND_OVER_WINDOW_SLOTS is also 8 (packages/taiko-client-rs/crates/whitelist-preconfirmation-driver/src/api/service/mod.rs:49-53); only the Rust comment incorrectly says the Go default is 4, while the ejector runtime default is 4 (packages/ejector/src/config.rs:31). Describing these as three inconsistent constants and assigning E-5 P0 can lead maintainers to change the already-correct Rust runtime value rather than fix its stale comment and reconcile the ejector's actual 4-slot default.
Useful? React with 👍 / 👎.
🐋 DeepSeek Code Review🟡 Warnings
🔵 Suggestions
🟢 What Looks Good
Automatically triggered on PR update • model: |
- _buildProposal now calls the proposer checker gas-isolated (bounded gas + try/catch): a buggy or reverting checker can no longer halt the rollup (PR #22012 E-3). - On checker revert, permissionless proposing is allowed while the escape hatch is open: the oldest queued forced inclusion overdue beyond forcedInclusionDelay * permissionlessInclusionMultiplier (wires the previously-unenforced knob, kimi-k3 I-01 / PR #22012 E-4). The authorization runs BEFORE forced inclusions are consumed so the hatch can observe the stale inclusion it is gated on. - New Config field proposerCheckerGasLimit (validated; 3M on mainnet/devnet configs); LibForcedInclusion.isPermissionlessInclusionAllowed helper. - Tests: permissionless proposing succeeds for an unauthorized caller when the hatch is open (and consumes the overdue inclusion); reverts with PermissionlessProposingNotAllowed otherwise (not overdue / no inclusions).
2 participants
What
Adds
packages/protocol/docs/urc_production_readiness_review.md— a thorough production-readiness evaluation of the Universal Registry Contract (eth-fabric/urc@132bc79,mainHEAD) for use as Taiko's operator-registry + slashing backbone for permissionless preconfirmations, assuming ePBS (EIP-7732, Glamsterdam ~Q4 2026) then FOCIL (EIP-7805, Hegotá ~2027) land first.Bottom line
Not production-ready at
mainHEAD, on three independent grounds:mainfrozen ~13 months; README still says "not audited and is not ready for production use"; "Audit 3" unchecked; both prior audits (Zellic, Hashlock) predate HEAD (the Solady swap in#66is unreviewed) and neither report is public; the standard-BLS signing fix lives only on the unmergedsigning-domainbranch (whicheth-fabric/fabricuses, while ourpackage.jsonpinsurc#main); no canonical deployment anywhere and zero production users.slashCommitmenthas no replay guard → burn ~all collateral; self-triggerableslashWindowescape → permanent immunity + reclaim), three Medium (delegation doesn't bind the slasher; cross-deployment signature replay → wrongful equivocation slashing; getters misreport slashable status), plus Lows and a non-RFC-9380 signing scheme. Several are unpatchable after an immutable deploy.Delegation/Commitmentschema — frozen forever at deploy — has no builder/constraints notion.Recommendation: keep the permissioned
PreconfWhitelist(live since Aug 2025) as the interim path; adopt the URC only aftersigning-domainis merged, a fresh audit covers the exact bytecode (and prior reports are published), the contract bugs are fixed, and an ePBS-compatibility analysis of the schema exists. Pin to an audited tag, never a moving branch. This supports keeping our permissionless stack parked onpermissionless-preconf(moved offmain2026-07-04) until those gates clear.Contents
file:line, exploit scenarios, and fixes.Documentation only; no code or protocol behavior changes.
🤖 Generated with Claude Code
https://claude.ai/code/session_01EAxjMge8SpdSr3HJTTBgyk
Generated by Claude Code