freeze(v8-v10): zero claim rewards & no-op random sampling

[branarakic]

Summary

Time-critical patch to stop the V8 → V10 transition reward leak before the next epoch boundary. Epoch reward pools on EpochStorage are no longer backed by escrowed TRAC (the V10 migration moved that backing out of contracts), so any non-zero reward emission on the live Staking / RandomSampling contracts would be paid out of delegators' staked principal.

This PR ships a freeze build that:

• Staking.claimDelegatorRewards is patched to always emit a zero reward and to never apply previously accumulated delegatorRollingRewards to stakeBase / nodeStake / totalStake. All surrounding bookkeeping (lastClaimedEpoch, hasDelegatorClaimedEpochRewards, isOperatorFeeClaimedForEpoch, netNodeEpochRewards = 0) keeps advancing so that _validateDelegatorEpochClaims does not block legitimate requestWithdrawal / cancelWithdrawal / redelegate flows. Pre-existing delegatorRollingRewards values are preserved untouched in storage so V10 can reconcile them later.
• RandomSampling.createChallenge and RandomSampling.submitProof become silent no-ops. They keep their profileExists / nodeExistsInShardingTable modifiers so unauthorized callers still get an early revert, but successful calls do not write to RandomSamplingStorage. This avoids client-side error spam for V8 nodes that are still polling the proofing loop.
• Version bumps: Staking._VERSION → "1.0.2-freeze", RandomSampling._VERSION → "1.0.1-freeze".
• deployments/{neuroweb,gnosis,base}_mainnet_contracts.json: Staking.deployed and RandomSampling.deployed flipped to false so hardhat-deploy redeploys both contracts on npm run deploy:<network> and atomically rotates them via Hub.setAndReinitializeContracts.

After Hub rotation the old Staking / RandomSampling addresses are removed from Hub.contractSet. Their bytecode remains on-chain (immutable), but every state-mutating call from them into StakingStorage / RandomSamplingStorage / DelegatorsInfo / EpochStorage reverts at the onlyContracts modifier (which checks Hub.isContract(msg.sender)). The old contracts are effectively neutralised — see HubRotationBricking.test.ts.

Mainnet rollout — DONE

Chain	Staking (1.0.2-freeze)	RandomSampling (1.0.1-freeze)	verify_freeze.ts
Base mainnet	0xDaa40BEb1D73bC43E437cDC3188abE565119619d	0xA32780d6A89542462271ca6d2d78373889F1C2d9	17/17 ✓
NeuroWeb mainnet	0xDaa40BEb1D73bC43E437cDC3188abE565119619d	0xA32780d6A89542462271ca6d2d78373889F1C2d9	17/17 ✓
Gnosis mainnet	0xDaa40BEb1D73bC43E437cDC3188abE565119619d	0xA32780d6A89542462271ca6d2d78373889F1C2d9	17/17 ✓

Deployer EOA has been removed from all 3 chains' Gnosis Safes after rollout — zero privileged access remains on the temporary deployer key.

Files

Area	File	Change
contract	contracts/Staking.sol	Freeze claimDelegatorRewards + version bump
contract	contracts/RandomSampling.sol	No-op createChallenge / submitProof + version bump
deploy	deployments/{neuroweb,gnosis,base}_mainnet_contracts.json	Post-rollout addresses + deployed: true for new freeze contracts
deploy	hardhat.config.ts, deployments/parameters.json	Operational fixes for neuroweb_mainnet (gasPrice to clear baseFee, stakeWithdrawalDelay override pinned to current on-chain value)
script	scripts/verify_freeze.ts	Post-deploy read-only verification across all 3 chains (17 invariants per chain)
script	scripts/audit_hub_registry.mjs	Full Hub registry audit per chain
script	scripts/replace_hub_slot.ts	Generic single-slot Hub registry update (env-driven, dry-run by default)
script	scripts/replace_stale_slots_{base,neuroweb,gnosis}_mainnet.ts	Per-chain operational batch (dry-run by default; REGISTRY_WRITE=1 to execute)
script	scripts/finalize_staking_swap_neuroweb_mainnet.ts	One-off Staking swap to recover from a hardhat-deploy partial-resume edge case
script	scripts/simulate_freeze_claim_base_mainnet.ts	Live-chain claimDelegatorRewards dry-run against a forked mainnet
script	scripts/registry_state_check_base_mainnet.mjs	On-chain verification that previously-registered addresses are no longer authorised by the Hub
test (new)	test/integration/StakingRewardsFreeze.test.ts	7 tests — Staking freeze invariants
test (new)	test/unit/RandomSamplingFreeze.test.ts	4 tests — RandomSampling no-op invariants
test (new)	test/integration/HubRotationBricking.test.ts	12 tests — Hub registry state + OLD-contract reverts
test	test/integration/{Staking,StakingRewards,RandomSampling}.test.ts, test/unit/{Staking,RandomSampling}.test.ts	Selected describe.skip of pre-freeze reward / score-accumulation suites with explanatory comments

scripts/verify_freeze.ts confirms, on a live RPC:

• Hub.getContractAddress("Staking" / "RandomSampling") returns the new addresses.
• The new contracts report the 1.0.2-freeze / 1.0.1-freeze versions.
• Hub.isContract(<old address>) is false for both Staking and RandomSampling pre-freeze addresses.
• An eth_call from the OLD Staking / RandomSampling addresses to a sensitive setter on StakingStorage / RandomSamplingStorage reverts with UnauthorizedAccess("Only Contracts in Hub") — confirming the onlyContracts gate now refuses them.

Test plan

• npx hardhat compile — clean build for both contracts.
• npx hardhat test test/integration/StakingRewardsFreeze.test.ts test/unit/RandomSamplingFreeze.test.ts test/integration/HubRotationBricking.test.ts — 23 passing.
• npx hardhat test test/unit/Staking.test.ts test/unit/RandomSampling.test.ts — 71 passing, 28 pending (skipped freeze-incompatible blocks).
• Base Sepolia rehearsal — deploy + verify_freeze.ts 13/13 PASS.
• Per-chain npm run deploy:<network> + verify_freeze.ts — 17/17 PASS on Base, NeuroWeb, Gnosis mainnet.

Made with Cursor

[cursor]

You have used all of your free Bugbot PR reviews.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[branarakic]

Thanks for putting this together. The contract-side freeze behavior looks aligned with the migration goal, and the focused freeze/bricking suites passed locally. I do think this needs changes before merge, mostly around the operational verifier.

Findings:

1. scripts/verify_freeze.ts appears to hard-code old RandomSampling addresses that do not match the committed mainnet deployment JSONs. The verifier snapshots 0xB440... / 0xe59c... / 0x2E44... at scripts/verify_freeze.ts:42-51, but the PR deployment JSONs still show the current RandomSampling address as 0x4B20D581695fb96db8FE78D8b12994fa43946eFA for base, gnosis, and neuroweb (deployments/base_mainnet_contracts.json:315, deployments/gnosis_mainnet_contracts.json:311, deployments/neuroweb_mainnet_contracts.json:345). If the JSONs are the source of truth before deployment, the post-deploy old-address bricking check may verify the wrong old contract and leave the actual prior address unchecked.

2. The old-contract probes in scripts/verify_freeze.ts can pass without proving the storage gate is what rejected the old code. oldStakingProbe.claimDelegatorRewards.staticCall(1, 0, 0x...) at scripts/verify_freeze.ts:186 accepts any revert, but those arbitrary inputs can fail before reaching an onlyContracts storage write. The RandomSampling probe at scripts/verify_freeze.ts:213-230 sets the result to ok in both the success and catch paths, so that check cannot fail. I would make these probes use known-valid state that reaches the intended write path, and assert the specific UnauthorizedAccess("Only Contracts in Hub") failure for old contracts.

3. npm run lint:ts currently fails on PR-added code. In particular scripts/verify_freeze.ts:69 uses a forbidden require() import, and the new freeze tests have Prettier errors (test/integration/StakingRewardsFreeze.test.ts and test/unit/RandomSamplingFreeze.test.ts). There are some unrelated existing unresolved-import lint errors too, but the PR adds enough lint failures to block CI if the lint job runs.

Verification I ran locally:

• npx hardhat test --network hardhat test/integration/StakingRewardsFreeze.test.ts test/unit/RandomSamplingFreeze.test.ts test/integration/HubRotationBricking.test.ts -> 23 passing
• npm run compile -> passed with “Nothing to compile”
• npm run lint:ts -> failed as described above
• npm run lint:sol -> exit 0, warnings only

Overall: freeze implementation looks directionally sound, but the post-deploy safety net needs to be exact here since that is what proves the old leak path is really bricked.

[branarakic]

Thanks for the review — findings 1 and 2 were both real bugs in verify_freeze.ts. Pushed fixes in 896c00d1.

(1) Wrong RandomSampling addresses — confirmed and fixed.
The actual current mainnet RandomSampling is 0x4B20D581695fb96db8FE78D8b12994fa43946eFA on all three chains (deterministic CREATE2 from RFC-26-update commit 90b2d522). The previous values I had hardcoded (0xB44086…, 0xe59cA2…, 0x2E44b0…) were not on chain at all, so the bricking probes would have been verifying empty addresses and the actual prior contract would have gone unchecked. Cross-checked against deployments/{neuroweb,gnosis,base}_mainnet_contracts.json. Also added testnet entries (neuroweb_testnet, gnosis_chiado_test, base_sepolia_test) for the dress-rehearsal deploy.

(2) Unsound old-contract probes — replaced with deterministic gate probes.
You were right on both halves: the Staking.claimDelegatorRewards.staticCall(1, 0, 0x…01) probe could revert at _validateDelegatorEpochClaims (Epoch must follow last claimed, etc.) long before reaching a storage write, and the RandomSampling.updateAndGetActiveProofPeriodStartBlock probe set ok = true in both the success and catch paths so it could literally never fail.

The replacement probes call the storage setters directly via eth_call with from = oldContractAddress:

• StakingStorage.setDelegatorStakeBase(1, bytes32(1), 0) from from: oldStaking
• RandomSamplingStorage.setActiveProofPeriodStartBlock(1) from from: oldRandomSampling

This exercises the HubDependent.onlyContracts modifier deterministically. PASS only if the revert message contains 'Only Contracts in Hub' or 'UnauthorizedAccess' (the gate's own custom error from HubLib). A successful call is now an explicit LEAK! — not a silent pass. Any other revert is reported as INCONCLUSIVE, which still fails the script (the authoritative Hub.isContract(old) === false check above remains the primary safety net).

Also added a sanity check that PRE_FREEZE_ADDRESSES.{Staking,RandomSampling} differs from the current Hub registration — catches “no rotation happened” or “stale snapshot” cases before the rest of the verification runs.

(3) Lint failures — already fixed in eadff089 (one commit before your review, you saw 5f23aa8c). require('hardhat') → import hre from 'hardhat' and prettier --write on the two new freeze test files. Current npm run lint && npm run format && npm run test all pass; CI is green.

Diff for the verify-script fix is +109 / -48. Happy to revisit if you want a different probe shape.

[branarakic]

Testnet rehearsal — Base Sepolia ✅

Did the full freeze rotation on base_sepolia_test (chain 84532) end-to-end via npm run deploy:base_sepolia_test. Hub.owner Safe (0xD9B816D9...) already has the deployer EOA in its owner list, so Hub._isMultiSigOwner accepted the rotation without any extra Safe choreography — exactly the path mainnet will take after we add the deployer to each chain's Safe for the deploy window.

Rotated:

• Staking 0x42b5938C...3BE5 → 0x7fFaCf01...Db2b (1.0.2-freeze)
• RandomSampling 0x95CF1b97...AF5A3 → 0xA2DA5A7C...DB7b (1.0.1-freeze)

scripts/verify_freeze.ts on base_sepolia_test: 13/13 PASS, including the storage-gate probes that prove StakingStorage.setDelegatorStakeBase and RandomSamplingStorage.setActiveProofPeriodStartBlock reject the OLD logic addresses with the exact UnauthorizedAccess("Only Contracts in Hub") custom error.

Two defensive fixes the rehearsal forced out (commit 41117ad3):

1. utils/helpers.ts — wrapped the post-deploy version() probe in a bounded backoff retry. Base Sepolia (and likely Base mainnet, same Optimism stack) sometimes lags a few seconds between mining a deploy tx and serving an eth_call against the new address, which made hardhat-deploy crash mid-script. Without this fix, the first two Base Sepolia deploys produced orphaned Staking contracts (visible in the explorer, never registered in the Hub).

2. scripts/verify_freeze.ts — added decodeRevert() that pulls err.data (and the L2-nested err.info.error.data fallback) and parses it through the storage contract's interface. The previous string-match path was correctly catching the bricking on Neuroweb/Gnosis but fell back to INCONCLUSIVE on Base because Ethers reports custom errors as "execution reverted (unknown custom error)" when the calling interface doesn't declare them. Verified the new probe passes on Base Sepolia after deploy.

Mainnet rollout is unblocked. Plan stays the same:

1. Add the deployer EOA to each chain's Safe (NeuroWeb, Gnosis, Base) — single Safe tx per chain, well under the threshold time.
2. npm run deploy:neuroweb_mainnet → verify_freeze.ts --network neuroweb_mainnet
3. Same for gnosis_mainnet and base_mainnet.
4. Remove the deployer EOA from each Safe.
5. Commit the post-deploy mainnet JSONs.

Epoch ends ~02:00 CEST tomorrow on all three mainnets, so the comfortable window is the next ~10h.

[branarakic]

Two follow-up findings + fixes since the last comment:

1. PRE_FREEZE_ADDRESSES had wrong mainnet RandomSampling values (commit `e4042bc7`)

Cross-checking against `Hub.getContractAddress("RandomSampling")` on each mainnet RPC revealed that all three hardcoded mainnet RandomSampling addresses (`0x4B20D581...46eFA`) were stale — `Hub.isContract()` returns `false` for that address on every mainnet. The deployment JSONs that I treated as authoritative were stale (older snapshot, never refreshed after a prior Hub upgrade). The live, currently-bricking-target addresses are per-chain:

Chain	Live `Hub.RandomSampling`
neuroweb_mainnet	`0xB44086bb163ebaf65e2927A3e34b904050324BEa`
gnosis_mainnet	`0xe59cA2ABB8020D828aeDA7d2de4bEFD5EB49FC1f`
base_mainnet	`0x2E44b083096a96A39340A25B96893192eEac1fB5`

If we'd shipped mainnet with the old constant, the bricking probe would have passed vacuously — checking that an address that was already removed years ago is still removed, while leaving the actual prior contract unverified. Same failure shape as Codex finding 1, just with a different wrong address. My fault.

Structural fix in the same commit: `verify_freeze.ts` now has a mode-detection layer that prevents this entire class of bug:

• PRE-DEPLOY mode (PRE matches Hub for both contracts) → assert that's true, exit clean. This is now a mandatory pre-flight gate before each mainnet deploy — if the snapshot is stale, the script refuses to greenlight.
• POST-DEPLOY mode (PRE differs from Hub for both) → full rotation/bricking/storage-gate suite, plus two new structural checks per OLD address: (a) `eth_getCode` non-empty, (b) `version()` returns a non-freeze string (proves it's the prior logic, not the new build).
• Mixed mode (matches one but not the other) → hard fail, points at the offending entry. This would have caught the bug if I'd only gotten one of the two wrong.

Verified across all reachable chains:

Chain	Mode	Result
`base_sepolia_test`	POST-DEPLOY	17/17 PASS (incl. structural checks: OLD Staking 44160 bytes / version="1.0.1", OLD RS 24916 bytes / version="1.0.0")
`neuroweb_mainnet`	PRE-DEPLOY	snapshot matches live Hub ✓
`gnosis_mainnet`	PRE-DEPLOY	snapshot matches live Hub ✓
`base_mainnet`	PRE-DEPLOY	snapshot matches live Hub ✓
`gnosis_chiado_test`	PRE-DEPLOY	snapshot matches live Hub ✓

2. Live-chain claim simulation against forked Base Sepolia (commit `c05a10ce`)

Branimir flagged that the rehearsal so far hadn't actually exercised a post-epoch-end `claimDelegatorRewards` call. Built a script that does exactly that without waiting for the boundary: `scripts/simulate_freeze_claim.ts` forks Base Sepolia at HEAD, fast-forwards EVM time past the next epoch boundary so the prior current epoch becomes finalized, impersonates a real delegator with non-zero stake, and calls `Staking.claimDelegatorRewards(...)` on the deployed freeze build. It then asserts the six freeze invariants on the actual on-chain state.

Result on Base Sepolia, identityId=1, delegator=`0xe94470a4BEaB39c497f8fE88D70F3a537bba55a2` (stakeBase 107.88 TRAC):

```
pre: stakeBase=107880310405325380343 nodeStake=170776442769310354765582 totalStake=22608584477289867580970654
rollingRewards=0 hasClaimed[480]=false lastClaimedEpoch=479
→ tx mined in fork, gas used: 222936
post: stakeBase=107880310405325380343 nodeStake=170776442769310354765582 totalStake=22608584477289867580970654
rollingRewards=0 hasClaimed[480]=true lastClaimedEpoch=480

✓ delegator stakeBase UNCHANGED (no payout to stake) delta=0
✓ node stake UNCHANGED (no node-level reward applied) delta=0
✓ total stake UNCHANGED (no system-wide TRAC inflation)
✓ delegator rollingRewards PRESERVED (not paid into stake)
✓ hasDelegatorClaimedEpochRewards advanced to TRUE (UX bookkeeping kept)
✓ lastClaimedEpoch advanced by exactly 1 pre=479 post=480

Live-chain freeze claim: ✓ PASS
```

This is the strongest live-chain proof of the freeze short of waiting for the actual mainnet epoch boundary — real Chronos timing, real DelegatorsInfo / StakingStorage state, real RandomSamplingStorage scores, and the full `_validateDelegatorEpochClaims` path against the bytecode actually deployed at the Hub-registered address. Reusable for post-deploy verification on the other forkable chains (chain config + delegator selection are the only knobs).

Mainnet rollout is now unblocked, with belt-and-braces.