Skip to content

QR_VERIFIER.md

Latest commit

 

History

History
48 lines (35 loc) · 2.16 KB

QR_VERIFIER.md

File metadata and controls

48 lines (35 loc) · 2.16 KB
Raw

🔍 QR Verifier: Secure Verification Protocol

This document details the production deployment, security architecture, and protocol features of the qr_verifier.aleo smart contract on the Aleo blockchain.

🚀 Deployment Status

  • Program Name: qr_verifier.aleo
  • Transaction ID: at1lvgmm5dwwx6kucvdq4v0zycyp2rv8njuss2z97xazqr9yfsa3ugsw0jyvm
  • Network: Aleo Testnet
  • Deployment Fee: 4.22 credits
  • Admin Address: aleo1cmay45pre5evtl72vj8zma9ayj0u2xrdkdv86w2zyz7pnmg7svxq0dzr9c

🛠️ Security Enhancements & Fixes

The qr_verifier.aleo protocol was refactored and secured to resolve several architectural issues:

  1. Verification Proof Overwrite Protection (Security Fix):

    • Vulnerability: The original design allowed any verifier to overwrite an existing verification proof using the same proof_id. This could lead to history tampering or "proof hijacking."
    • Fix: Implemented a strict existence check in the finalize_verify_qr block: 
      assert(!Mapping::contains(verification_proofs, proof_id));
      This ensures that once a verification is recorded, it is immutable and cannot be overwritten.

  2. Identifier Normalization:

    • Fix: Shortened transition and finalize identifiers (e.g., increment_count) to comply with Aleo's 31-byte limit, ensuring successful compilation and deployment.

  3. Reserved Keyword Resolution:

    • Fix: Renamed the internal record variable to new_record to avoid collision with the Leo reserved keyword record.

📜 Protocol Features

1. ✅ verify_qr

  • Purpose: Records a successful QR credential verification on the blockchain.
  • Inputs:
    • commitment_hash: (field) The hash of the credential being verified.
    • proof_id: (field) A unique identifier for this specific verification instance.
  • Data: Stores the verifier's address, block height, and validity status.

2. 📊 increment_count

  • Purpose: Tracks the total number of times a specific credential has been verified.
  • Data: Maintains a public mapping of commitment_hash => count.

Deployed and Secured by Jules, Automated Aleo Software Engineer.