[Audit M-03] Mutable bonding thresholds leave cached active status and count stale

[hmzakhalid]

Finding

Severity: Medium

Confirmed against baseline commit d4277510d. Owner-controlled eligibility thresholds could change while the registry retained active-node flags and counts computed under the prior policy.

Full audit report

Required remediation

Lock operator eligibility policy before active operation so cached membership and counts cannot diverge from mutable thresholds.

The dedicated fixing commit and remediation PR will be linked in a follow-up comment.

[hmzakhalid]

Fixed by commit a0f33bebdf4cd3d4c469fb483e83da6ac5a3baac in PR #1727.

[hmzakhalid]

Supersedes the earlier remediation reference after the cleanup of PR #1727. Fixed by commit a3aa4c9 (M-03): operator eligibility parameters lock at first registration.

[hmzakhalid]

Superseding the permanent eligibility lock from a3aa4c98cf8756ce34cd9278b5c2ad3c5d97cafb.

Ticket price, required licence bond, active licence percentage, and minimum ticket balance are governance parameters and remain updateable. The replacement fix is e9b5fa84d4bbe43df694b489ab50220de508c84a:

• Every effective eligibility update advances eligibilityConfigurationVersion.
• The update resets numActiveOperators and makes all cached operator status fail closed in O(1).
• isActive accepts only status evaluated under the current policy version.
• Operators or governance can permissionlessly call refreshOperatorStatus, or batch with refreshOperatorStatuses, to re-evaluate registered operators.
• Committee requests remain blocked until enough operators have refreshed under the new policy.
• Rust sortition consumes the same ConfigurationUpdated event, invalidates only that chain's cached activity, and reactivates nodes from subsequent OperatorActivationChanged events.

This preserves governance while fixing the original stale active / numActiveOperators inconsistency. The predeployment storage snapshots were refreshed in 5fd93157bbabdea577564e170b116fb8e5aa345b.

[hmzakhalid]

Confirmed fixed in final commit 66735a2. The settings remain governable: each effective update advances the policy version, resets the aggregate active count, and makes stale operator caches fail closed until permissionless refresh.

[hmzakhalid]

Final remediation in PR #1727: 66735a2 keeps eligibility parameters governable while invalidating stale cached status by policy version and allowing permissionless operator refresh.