[Audit C-01] Emitted BFV public-key bytes are not bound to the proven commitment

[hmzakhalid]

Finding

Severity: Critical

Confirmed against baseline commit d4277510d. The baseline accepted a C5 proof for a public-key commitment while emitting caller-supplied BFV bytes without checking that those bytes canonically recomputed the proven commitment.

Full audit report

Required remediation

Validate canonical BFV public-key encoding at the client/indexer trust boundary, recompute its commitment, and require it to equal the C5 commitment before publication is accepted.

The dedicated fixing commit and remediation PR will be linked in a follow-up comment.

[hmzakhalid]

Fixed by commit 0ca8c84aac8e3fe4dae1d6e1582df6c5bfe4b9cc in PR #1727.

[hmzakhalid]

Supersedes the earlier remediation reference after the cleanup of PR #1727. Fixed by commit 86a2cb8 (C-01): clients/indexing now validate canonical serialized BFV keys against the C5-proven commitment.

[hmzakhalid]

Final C-01 SHA after the C-02 history cleanup: d5cef5c.

[hmzakhalid]

Final C-01 SHA after refreshing the CRISP secondary lockfile required by the indexer runtime dependency move: 650b0d1. The exact CRISP cargo build --locked now passes.

[hmzakhalid]

Final fixing commit after the branch history rewrite: 2d11808 (2d11808).

[hmzakhalid]

Supersedes the earlier commit reference after the C-01 correction was folded into its dedicated commit: 708d9cc. The indexer now decodes the BFV key and compares its computed circuit commitment to the on-chain commitment. It intentionally does not require byte-for-byte reserialization because fhe.rs normalizes an internal variable-time flag on threshold-aggregated keys.

[hmzakhalid]

Confirmed fixed in final commit 590c425. The indexer now decodes the emitted BFV key and verifies its semantic commitment against the C5-proven commitment before accepting it.

[hmzakhalid]

Final remediation in PR #1727: 590c425 implements the C-01 indexer binding, and 511602f makes the SDK reject an unbound committee public key.