Skip to content

Add coinbase merkle proof validation in verify transaction inclusion#139

Open
olga24912 wants to merge 12 commits into
mainfrom
tx64
Open

Add coinbase merkle proof validation in verify transaction inclusion#139
olga24912 wants to merge 12 commits into
mainfrom
tx64

Conversation

@olga24912
Copy link
Copy Markdown
Collaborator

Add verify_transaction_inclusion_v2 with coinbase merkle proof validation to mitigate the 64-byte transaction forgery vulnerability. The original method is marked as deprecated.

@olga24912 olga24912 requested a review from a team April 28, 2026 17:41
Comment thread contract/src/lib.rs
Comment thread contract/tests/test_basics.rs
Comment thread contract/.gitattributes
@karim-en
Copy link
Copy Markdown
Collaborator

Please fix the CI

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a new verify_transaction_inclusion_v2 pathway (contract + relayer) that validates a coinbase merkle proof in addition to the target transaction merkle proof, intended to mitigate the 64-byte transaction Merkle proof forgery issue.

Changes:

  • Introduce ProofArgsV2 and contract method verify_transaction_inclusion_v2; deprecate verify_transaction_inclusion.
  • Add relayer support (NearClient::verify_transaction_inclusion_v2) and integration test flow for v2 verification.
  • Add contract tests covering v2 valid/invalid coinbase proofs and related error cases.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
relayer/tests/integration_tests.rs Adds an integration test and flow exercising relayer calls to the v2 verification method.
relayer/src/near_client.rs Adds verify_transaction_inclusion_v2, refactors verify-response parsing, and tweaks batch tx nonce handling.
relayer/src/adaptive_batch.rs Simplifies num_parallel_txs computation using checked_div.
contract/tests/test_basics.rs Adds unit tests for verify_transaction_inclusion_v2 behavior (valid/invalid proofs, confirmations, etc.).
contract/src/lib.rs Deprecates v1 verification and adds v2 method with coinbase merkle proof validation.
contract/Cargo.toml Bumps contract crate version to 0.5.0.
contract/Cargo.lock Updates lockfile version entry to 0.5.0.
contract/.gitattributes Removes LFS rule for a test data file.
btc-types/src/contract_args.rs Adds ProofArgsV2 and conversion into existing ProofArgs.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +500 to +506
// Always print so the gas measurement is visible under
// `cargo test ... -- --nocapture`, regardless of RUST_LOG.
println!(
"[{method_label}] gas_burnt = {gas_burnt} ({} TGas, rounded), tokens_burnt = {tokens_burnt}",
gas_burnt / 1_000_000_000_000
);
info!("[{method_label}] gas_burnt = {gas_burnt}, tokens_burnt = {tokens_burnt}");
Comment thread contract/src/lib.rs
) == header.block_header.merkle_root,
"Incorrect coinbase merkle proof"
);

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants