fix: remediate 2026 Interfold contracts security audit [skip-line-limit]

[hmzakhalid]

Summary

• remediates 16 confirmed code findings from the 2026-07-15 contracts audit
• requires final DKG and decryption proofs in the protocol; skip_proof_aggregation is a ciphernode-only test/CI flag, defaults off, and supplies mock-only non-empty placeholders while production verifiers remain mandatory
• uses clean pre-deployment state and APIs: no migration sentinels, compatibility fallbacks, decryption-proof nullifier, or legacy slash routes
• regenerates the C-03 DecryptionAggregatorVerifier through the circuit tooling; no generated verifier was hand-edited
• does not include the audit report, audit README changes, or the audit PoC report/test

Security and protocol decisions to review

• H-01: when fee and slash tokens match, slash proceeds first fill the requester's original-payment shortfall and the remainder goes to currently active honest nodes. With no active honest nodes, same-token residual goes to the snapshotted treasury. When the tokens differ, the requester receives the slash asset as priority compensation without claiming value equivalence or using an oracle.
• H-01 settlement liveness: a slash escrowed after terminalization settles immediately. A different-token slash escrowed before terminalization remains durable but requires any caller to invoke permissionless settleSlashedFunds(e3Id, token), because terminalization only knows the E3 fee token.
• M-03: eligibility settings remain governable. A setting change advances the policy version, resets the aggregate active count, and makes cached operators fail closed until permissionless refresh; contracts cannot iterate the operator set automatically.
• M-04: each E3 snapshots its lifecycle dependencies. Previously used slashing managers remain authorized across rotation so in-flight E3s can finish; governance must revoke an old manager only after its E3s, proposals, and routes are terminal.
• M-08: bonding-token rotation remains fail-closed until old-token obligations are fully drained. Donated licence-token surplus can be swept without touching accounted liabilities, preventing dust from permanently blocking rotation.
• C-03: decryption proofs now bind an E3-specific domain through the C6/C6Fold/DecryptionAggregator circuit chain. This necessarily changes the generated DecryptionAggregator verification key and Solidity verifier.

Fixed findings

Critical

• C-01 — [Audit C-01] Emitted BFV public-key bytes are not bound to the proven commitment #1708 — 590c425e, 511602f9
• C-02 — [Audit C-02] Proof-disabled E3s allow unauthenticated key and plaintext takeover #1712 — d724131c, 1f3b2879, 9b344622
• C-03 — [Audit C-03] Decryption proofs are replayable across unrelated E3 contexts #1710 — 112eb755, a550e46a

High

• H-01 — [Audit H-01] Slashed ticket assets lose their token denomination in refund accounting #1711 — d858ae36, db322193
• H-03 — [Audit H-03] Deferred Lane A slash targets can exit before financial execution #1709 — 73826ad8
• H-04 — [Audit H-04] Upgrade validation has no committed baseline despite hard-coded storage slots #1714 — b124f06e, ecb4acb4

Medium

• M-01 — [Audit M-01] A stale exit-queue head permanently exhausts the 64-tranche cap #1717 — 79ba4e8f, 99545842, 9021c9fe, 66e3f498
• M-02 — [Audit M-02] A shared claim flag destroys one entitlement for dual-role accounts #1718 — 593fcfb6
• M-03 — [Audit M-03] Mutable bonding thresholds leave cached active status and count stale #1721 — 66735a2f
• M-04 — [Audit M-04] Dependency rotation is not snapshotted for in-flight E3s #1720 — 19fd9e75, e8000792
• M-05 — [Audit M-05] Failed slashed-fund routing is final and has no retry path #1719 — e1c6d3d9, a72a5bea
• M-07 — [Audit M-07] Refund/slash allocation changes apply retroactively to existing E3s #1716 — 1f5f57a9
• M-08 — [Audit M-08] Bonding asset rotation can strand or mis-account outstanding balances #1722 — df5c5802, f4c9ba95

Low

• L-01 — [Audit L-01] Permissionless sale deployment can be front-run to consume the one-shot config #1724 — cf7e9d0d
• L-02 — [Audit L-02] Verifier constructors accept zero/invalid trust anchors #1726 — a9a337ef
• L-03 — [Audit L-03] Core runtime bytecode has dangerously little release headroom #1723 — 6983f8f0

Local validation

• Hardhat coverage suite: 505 passing, 6 intentionally pending
• Rust: full workspace library suite green; formatting green
• SDK: build green; 9 tests passing
• Noir: formatting green; 154 tests passing
• generated DKG/decryption verifier consistency: green
• upgrade storage-layout validation: green against reviewed committed baselines
• size gate: Interfold 24,126 bytes (450 bytes EIP-170 headroom); both final aggregator verifiers 23,980 bytes
• contract lint: 0 errors, 4 pre-existing warnings
• template integration in ciphernode proof-skip mode: green
• licence headers and committee-configuration consistency: green

Issue resolution

Closes #1708
Closes #1709
Closes #1710
Closes #1711
Closes #1712
Closes #1714
Closes #1716
Closes #1717
Closes #1718
Closes #1719
Closes #1720
Closes #1721
Closes #1722
Closes #1723
Closes #1724
Closes #1726

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
crisp	Ready	Preview, Comment	Jul 18, 2026 11:15am
interfold-dashboard	Ready	Preview, Comment	Jul 18, 2026 11:15am
interfold-docs	Ready	Preview, Comment	Jul 18, 2026 11:15am