contracts(audit): v0.6.0 audit-fix pass — H-01, M-01, M-03 + tests

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: aiken-lang/setup-aiken@v1
         with:
-          version: v1.1.21
+          version: v1.1.22
       - run: aiken fmt --check
       - run: aiken check -D
       - run: aiken build

CHANGELOG.md

@@ -4,6 +4,39 @@ All notable changes to the PEACE Protocol are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.6.0] - 2026-05-07
+
+Audit-fix release closing the actionable findings from the 2026-05-07
+self-audit (`app/contracts/audits/audit_report.md`). Genesis parameter
+signature changed (breaking), all five validator hashes change, and
+the off-chain happy-path scripts + GUI tx-builder needed paired
+updates to stay in lockstep with the new on-chain semantics.
+
+### Deployment notes (read this before launching)
+- All five validator hashes are different. Re-run `app/contracts/compile.sh` and `app/commands/00_createScriptReferences.sh` against a fresh bootstrap UTxO, then update the GUI's per-network env vars: `ENCRYPTION_CONTRACT_ADDRESS_*`, `BIDDING_CONTRACT_ADDRESS_*`, `REFERENCE_CONTRACT_ADDRESS_*`, `*_POLICY_ID_*`, `GENESIS_TOKEN_NAME_*`, and the three `*_REF_TX_HASH_*` / `*_REF_OUTPUT_INDEX_*` pairs (see `app/gui/be/src/config/index.ts`).
+- This is a hard fork: existing UTxOs at the old contract addresses are unaffected (still spendable under their original validators), but new mints / transitions go to the new addresses. There is no migration path by design (hyperstructure semantics).
+
+### Fixed
+- contracts(H-01): pin `stake_credential == None` and `reference_script == None` on every continuing protocol output across encryption.ak (5 sites: EntryEncryptionMint, UseEncryption, UseSnark, CancelEncryption, UpdateEncryptionPrice) and bidding.ak (2 sites: EntryBidMint, UpdateBidPrice), plus the two `UseBid` singleton-input filters and the `UseEncryption` bid-input lookup. Closes the stake-credential hijack — the permissionless TTL-expired CancelEncryption branch is the highest-impact path.
+- contracts(M-01): genesis policy now takes a third compile-time parameter `reference_hash: ScriptHash` and asserts `ReferenceDatum.reference == reference_hash` at mint time. The reference-validator trust anchor is now enforced on-chain instead of relying on operator off-chain discipline. To break the bootstrap cycle, reference.ak is re-keyed from `(_genesis_pid, _genesis_tkn)` to `(_tx_id, _tx_idx)` so it can be built before genesis.
+- contracts(M-03): `verify_groth16` now rejects over-supplied `public` lists via `expect [] = leftover_public` instead of silently truncating past `nPublic - 1`. Pattern-matches on the empty list to avoid re-introducing the `aiken/collection/list` import.
+- contracts(I-08): `compile.sh` token-name builder now mirrors `util.construct_token_name` (`bytes([idx]) + tx_id_hex`) instead of CBOR-encoding tx_idx. The old builder diverged from the on-chain semantic for tx_idx ≥ 24 (CBOR major-type-0 emits 2 bytes). Asserts `0 ≤ tx_idx ≤ 255` up front.
+- gui(I-08): `computeTokenName` in `fe/src/services/transactions/txUtils.ts` had the same CBOR/byte mismatch for **encryption / bidding** mints. Pre-existing latent bug — every entry-mint with `output_index >= 24` would have failed on-chain with a token-name mismatch. Now mirrors `bytearray.push` byte-for-byte; throws on out-of-range `outputIndex`.
+- commands(H-01): every encryption/bidding script-address build in `app/commands/` (14 sites across 11 scripts) was using `--stake-key-hash ${staking_credential}` — the operator-side equivalent of the H-01 attack pattern. Removed the flag everywhere; addresses are now bare script-only as the v0.6.0 validators require.
+- commands(I-08): replaced 7 `cbor2.dumps`-based token-name builders with the bytewise form across 6 scripts (01a, 02a, 02b, 03, 05, 07a, 07b). Renamed local `tx_idx_cbor` → `tx_idx_byte` for accuracy.
+
+### Changed
+- contracts(BREAKING): genesis policy signature is now `validator contract(tx_id, tx_idx, reference_hash)`. compile.sh builds reference.ak first, derives its hash, then threads it into the genesis build.
+- contracts: reference.ak parameter signature changed from `(_genesis_pid, _genesis_tkn)` to `(_tx_id, _tx_idx)`. Both are unused — the swap exists only to break the bootstrap cycle introduced by M-01. Reference UTxO address differs per deployment.
+- contracts(I-02): test fixtures now expose `mk_addr_with_stake` and `mk_output_with_ref_script` covering all four stake_credential variants (None, Some(Inline(VerificationKey(_))), Some(Inline(Script(_))), Some(Pointer(_))) plus reference_script Some/None.
+- contracts: 8 new H-01 perimeter regression tests covering all adversarial stake variants plus reference_script attached on `is_protocol_output` / `is_protocol_input`.
+- contracts: 1 new M-03 over-supply negative test (`fail_groth_proof1_public_oversupplied`) extracted from `valid_groth_proof1`'s VK / proof / public / commitment-wires fixture.
+- contracts: baseline bench scaffolding under `lib/benchmarks/` (8 bench blocks across groth and util) — adds `aiken-lang/fuzz v2.2.0` as a dependency. Numbers are NOT optimal; this is the audit-required baseline so future optimization claims can quote a before/after delta.
+- contracts: inline rationale comments at every site flagged as carried Intentional (H-02, H-03, H-04, L-03, I-05) so future readers don't re-discover the design.
+- contracts: validator sizes after refactor — encryption 8,945 (+903 vs pre-fix 8,042), bidding 4,149 (−1,671 — net improvement from cleaner UseBid destructure), genesis 1,094, groth 1,664 (+22 from M-03), reference 29.
+- gui: `computeTokenName` unit tests updated to assert the new byte-for-byte semantics (the CBOR-form assertions for `outputIndex >= 24` were the I-08 bug expressed as test contract).
+- docs: v0.6.0 audit-fix notes added to `app/contracts/README.md` and `app/gui/CLAUDE.md` (Conventions & Gotchas) covering the four off-chain coupling points future contributors need to know about.
+
 ## [0.5.3] - 2026-05-04
 
 ### Added

app/commands/01a_createGenesisTx.sh

@@ -32,8 +32,11 @@ tx_id=$(jq -r '.genesis_tx_id' ${CONFIG_JSON})
 tx_idx=$(jq -r '.genesis_tx_idx' ${CONFIG_JSON})
 
 genesis_pid=$(cat ../contracts/hashes/genesis.hash)
-tx_idx_cbor=$(python3 -c "import cbor2;encoded=cbor2.dumps(${tx_idx});print(encoded.hex())")
-full_genesis_tkn="${tx_idx_cbor}${tx_id}"
+# I-08: mirror on-chain util.construct_token_name (`bytearray.push(idx)`).
+# The old `cbor2.dumps(idx)` form diverged from on-chain whenever
+# tx_idx >= 24, since CBOR major-type-0 emits two bytes there.
+tx_idx_byte=$(python3 -c "idx=${tx_idx}; assert 0 <= idx <= 255, f'tx_idx must be in [0, 255], got {idx}'; print(bytes([idx]).hex())")
+full_genesis_tkn="${tx_idx_byte}${tx_id}"
 genesis_tkn="${full_genesis_tkn:0:64}"
 
 mint_asset="1 ${genesis_pid}.${genesis_tkn}"

app/commands/02a_updateReferenceTx.sh

@@ -33,8 +33,8 @@ tx_id=$(jq -r '.genesis_tx_id' ${CONFIG_JSON})
 tx_idx=$(jq -r '.genesis_tx_idx' ${CONFIG_JSON})
 
 genesis_pid=$(cat ../contracts/hashes/genesis.hash)
-tx_idx_cbor=$(python3 -c "import cbor2;encoded=cbor2.dumps(${tx_idx});print(encoded.hex())")
-full_genesis_tkn="${tx_idx_cbor}${tx_id}"
+tx_idx_byte=$(python3 -c "idx=${tx_idx}; assert 0 <= idx <= 255; print(bytes([idx]).hex())")  # I-08: mirror on-chain bytearray.push
+full_genesis_tkn="${tx_idx_byte}${tx_id}"
 genesis_tkn="${full_genesis_tkn:0:64}"
 
 genesis_asset="1 ${genesis_pid}.${genesis_tkn}"

app/commands/02b_removeReferenceTx.sh

@@ -30,8 +30,8 @@ tx_id=$(jq -r '.genesis_tx_id' ${CONFIG_JSON})
 tx_idx=$(jq -r '.genesis_tx_idx' ${CONFIG_JSON})
 
 genesis_pid=$(cat ../contracts/hashes/genesis.hash)
-tx_idx_cbor=$(python3 -c "import cbor2;encoded=cbor2.dumps(${tx_idx});print(encoded.hex())")
-full_genesis_tkn="${tx_idx_cbor}${tx_id}"
+tx_idx_byte=$(python3 -c "idx=${tx_idx}; assert 0 <= idx <= 255; print(bytes([idx]).hex())")  # I-08: mirror on-chain bytearray.push
+full_genesis_tkn="${tx_idx_byte}${tx_id}"
 genesis_tkn="${full_genesis_tkn:0:64}"
 
 # get script utxo

app/commands/03_createEncryptionTx.sh

@@ -24,11 +24,10 @@ collat_address=$(cat ${collat_wallet_path}/payment.addr)
 collat_pkh=$(${cli} conway address key-hash --payment-verification-key-file ${collat_wallet_path}/payment.vkey)
 
 # stake key
-staking_credential=$(jq -r '.staking_credential' ${CONFIG_JSON})
 
 # encryption
 encryption_script_path="../contracts/contracts/encryption_contract.plutus"
-encryption_script_address=$(${cli} conway address build --payment-script-file ${encryption_script_path} --stake-key-hash ${staking_credential} ${network})
+encryption_script_address=$(${cli} conway address build --payment-script-file ${encryption_script_path} ${network})
 encryption_pid=$(cat ../contracts/hashes/encryption.hash)
 
 echo -e "\033[0;36m Gathering Alice UTxO Information  \033[0m"
@@ -62,8 +61,8 @@ first_utxo=$(jq -r 'keys[0]' ./tmp/alice_utxo.json)
 string=${first_utxo}
 IFS='#' read -ra array <<< "$string"
 
-tx_idx_cbor=$(../venv/bin/python -c "import cbor2;encoded=cbor2.dumps(${array[1]});print(encoded.hex())")
-full_tkn="${tx_idx_cbor}${array[0]}"
+tx_idx_byte=$(../venv/bin/python -c "idx=${array[1]}; assert 0 <= idx <= 255; print(bytes([idx]).hex())")  # I-08: mirror on-chain bytearray.push
+full_tkn="${tx_idx_byte}${array[0]}"
 token_name="${full_tkn:0:64}"
 echo $token_name > ../data/encryption.token
 encryption_asset="1 ${encryption_pid}.${token_name}"

app/commands/03b_updateEncryptionPriceTx.sh

@@ -32,11 +32,10 @@ collat_address=$(cat ${collat_wallet_path}/payment.addr)
 collat_pkh=$(${cli} conway address key-hash --payment-verification-key-file ${collat_wallet_path}/payment.vkey)
 
 # stake key
-staking_credential=$(jq -r '.staking_credential' ${CONFIG_JSON})
 
 # encryption
 encryption_script_path="../contracts/contracts/encryption_contract.plutus"
-encryption_script_address=$(${cli} conway address build --payment-script-file ${encryption_script_path} --stake-key-hash ${staking_credential} ${network})
+encryption_script_address=$(${cli} conway address build --payment-script-file ${encryption_script_path} ${network})
 encryption_pid=$(cat ../contracts/hashes/encryption.hash)
 
 echo -e "\033[0;36m Gathering Alice UTxO Information  \033[0m"

app/commands/04a_removeEncryptionTx.sh

@@ -22,11 +22,10 @@ collat_address=$(cat ${collat_wallet_path}/payment.addr)
 collat_pkh=$(${cli} conway address key-hash --payment-verification-key-file ${collat_wallet_path}/payment.vkey)
 
 # stake key
-staking_credential=$(jq -r '.staking_credential' ${CONFIG_JSON})
 
 # encryption
 encryption_script_path="../contracts/contracts/encryption_contract.plutus"
-encryption_script_address=$(${cli} conway address build --payment-script-file ${encryption_script_path} --stake-key-hash ${staking_credential} ${network})
+encryption_script_address=$(${cli} conway address build --payment-script-file ${encryption_script_path} ${network})
 encryption_pid=$(cat ../contracts/hashes/encryption.hash)
 
 echo -e "\033[0;36m Gathering Alice UTxO Information  \033[0m"

app/commands/04b_cancelEncryptionTx.sh

@@ -22,11 +22,10 @@ collat_address=$(cat ${collat_wallet_path}/payment.addr)
 collat_pkh=$(${cli} conway address key-hash --payment-verification-key-file ${collat_wallet_path}/payment.vkey)
 
 # stake key
-staking_credential=$(jq -r '.staking_credential' ${CONFIG_JSON})
 
 # encryption
 encryption_script_path="../contracts/contracts/encryption_contract.plutus"
-encryption_script_address=$(${cli} conway address build --payment-script-file ${encryption_script_path} --stake-key-hash ${staking_credential} ${network})
+encryption_script_address=$(${cli} conway address build --payment-script-file ${encryption_script_path} ${network})
 encryption_pid=$(cat ../contracts/hashes/encryption.hash)
 
 echo -e "\033[0;36m Gathering Alice UTxO Information  \033[0m"

app/commands/05_createBidTx.sh

@@ -24,16 +24,15 @@ collat_address=$(cat ${collat_wallet_path}/payment.addr)
 collat_pkh=$(${cli} conway address key-hash --payment-verification-key-file ${collat_wallet_path}/payment.vkey)
 
 # stake key
-staking_credential=$(jq -r '.staking_credential' ${CONFIG_JSON})
 
 # bidding
 bidding_script_path="../contracts/contracts/bidding_contract.plutus"
-bidding_script_address=$(${cli} conway address build --payment-script-file ${bidding_script_path} --stake-key-hash ${staking_credential} ${network})
+bidding_script_address=$(${cli} conway address build --payment-script-file ${bidding_script_path} ${network})
 bidding_pid=$(cat ../contracts/hashes/bidding.hash)
 
 # encryption
 encryption_script_path="../contracts/contracts/encryption_contract.plutus"
-encryption_script_address=$(${cli} conway address build --payment-script-file ${encryption_script_path} --stake-key-hash ${staking_credential} ${network})
+encryption_script_address=$(${cli} conway address build --payment-script-file ${encryption_script_path} ${network})
 encryption_pid=$(cat ../contracts/hashes/encryption.hash)
 
 # reference
@@ -45,8 +44,8 @@ tx_id=$(jq -r '.genesis_tx_id' ${CONFIG_JSON})
 tx_idx=$(jq -r '.genesis_tx_idx' ${CONFIG_JSON})
 
 genesis_pid=$(cat ../contracts/hashes/genesis.hash)
-tx_idx_cbor=$(python3 -c "import cbor2;encoded=cbor2.dumps(${tx_idx});print(encoded.hex())")
-full_genesis_tkn="${tx_idx_cbor}${tx_id}"
+tx_idx_byte=$(python3 -c "idx=${tx_idx}; assert 0 <= idx <= 255; print(bytes([idx]).hex())")  # I-08: mirror on-chain bytearray.push
+full_genesis_tkn="${tx_idx_byte}${tx_id}"
 genesis_tkn="${full_genesis_tkn:0:64}"
 
 # encryption token
@@ -111,8 +110,8 @@ first_utxo=$(jq -r 'keys[0]' ./tmp/bob_utxo.json)
 string=${first_utxo}
 IFS='#' read -ra array <<< "$string"
 
-tx_idx_cbor=$(../venv/bin/python -c "import cbor2;encoded=cbor2.dumps(${array[1]});print(encoded.hex())")
-full_tkn="${tx_idx_cbor}${array[0]}"
+tx_idx_byte=$(../venv/bin/python -c "idx=${array[1]}; assert 0 <= idx <= 255; print(bytes([idx]).hex())")  # I-08: mirror on-chain bytearray.push
+full_tkn="${tx_idx_byte}${array[0]}"
 token_name="${full_tkn:0:64}"
 echo $token_name > ../data/bidding.token
 bidding_asset="1 ${bidding_pid}.${token_name}"

app/commands/05b_updateBidPriceTx.sh

@@ -34,11 +34,10 @@ collat_address=$(cat ${collat_wallet_path}/payment.addr)
 collat_pkh=$(${cli} conway address key-hash --payment-verification-key-file ${collat_wallet_path}/payment.vkey)
 
 # stake key
-staking_credential=$(jq -r '.staking_credential' ${CONFIG_JSON})
 
 # bidding
 bidding_script_path="../contracts/contracts/bidding_contract.plutus"
-bidding_script_address=$(${cli} conway address build --payment-script-file ${bidding_script_path} --stake-key-hash ${staking_credential} ${network})
+bidding_script_address=$(${cli} conway address build --payment-script-file ${bidding_script_path} ${network})
 bidding_pid=$(cat ../contracts/hashes/bidding.hash)
 
 echo -e "\033[0;36m Gathering Bob UTxO Information  \033[0m"

app/commands/06_removeBidTx.sh

@@ -22,11 +22,10 @@ collat_address=$(cat ${collat_wallet_path}/payment.addr)
 collat_pkh=$(${cli} conway address key-hash --payment-verification-key-file ${collat_wallet_path}/payment.vkey)
 
 # stake key
-staking_credential=$(jq -r '.staking_credential' ${CONFIG_JSON})
 
 # bidding
 bidding_script_path="../contracts/contracts/bidding_contract.plutus"
-bidding_script_address=$(${cli} conway address build --payment-script-file ${bidding_script_path} --stake-key-hash ${staking_credential} ${network})
+bidding_script_address=$(${cli} conway address build --payment-script-file ${bidding_script_path} ${network})
 bidding_pid=$(cat ../contracts/hashes/bidding.hash)
 
 echo -e "\033[0;36m Gathering Bob UTxO Information  \033[0m"

app/commands/07a_createSnarkTx.sh

@@ -60,16 +60,15 @@ collat_address=$(cat ${collat_wallet_path}/payment.addr)
 collat_pkh=$(${cli} conway address key-hash --payment-verification-key-file ${collat_wallet_path}/payment.vkey)
 
 # stake key
-staking_credential=$(jq -r '.staking_credential' ${CONFIG_JSON})
 
 # bidding
 bidding_script_path="../contracts/contracts/bidding_contract.plutus"
-bidding_script_address=$(${cli} conway address build --payment-script-file ${bidding_script_path} --stake-key-hash ${staking_credential} ${network})
+bidding_script_address=$(${cli} conway address build --payment-script-file ${bidding_script_path} ${network})
 bidding_pid=$(cat ../contracts/hashes/bidding.hash)
 
 # encryption
 encryption_script_path="../contracts/contracts/encryption_contract.plutus"
-encryption_script_address=$(${cli} conway address build --payment-script-file ${encryption_script_path} --stake-key-hash ${staking_credential} ${network})
+encryption_script_address=$(${cli} conway address build --payment-script-file ${encryption_script_path} ${network})
 encryption_pid=$(cat ../contracts/hashes/encryption.hash)
 
 # reference
@@ -92,8 +91,8 @@ tx_id=$(jq -r '.genesis_tx_id' ${CONFIG_JSON})
 tx_idx=$(jq -r '.genesis_tx_idx' ${CONFIG_JSON})
 
 genesis_pid=$(cat ../contracts/hashes/genesis.hash)
-tx_idx_cbor=$(python3 -c "import cbor2;encoded=cbor2.dumps(${tx_idx});print(encoded.hex())")
-full_genesis_tkn="${tx_idx_cbor}${tx_id}"
+tx_idx_byte=$(python3 -c "idx=${tx_idx}; assert 0 <= idx <= 255; print(bytes([idx]).hex())")  # I-08: mirror on-chain bytearray.push
+full_genesis_tkn="${tx_idx_byte}${tx_id}"
 genesis_tkn="${full_genesis_tkn:0:64}"
 
 # bidding token

app/commands/07b_createReEncryptionTx.sh

@@ -29,16 +29,15 @@ collat_address=$(cat ${collat_wallet_path}/payment.addr)
 collat_pkh=$(${cli} conway address key-hash --payment-verification-key-file ${collat_wallet_path}/payment.vkey)
 
 # stake key
-staking_credential=$(jq -r '.staking_credential' ${CONFIG_JSON})
 
 # bidding
 bidding_script_path="../contracts/contracts/bidding_contract.plutus"
-bidding_script_address=$(${cli} conway address build --payment-script-file ${bidding_script_path} --stake-key-hash ${staking_credential} ${network})
+bidding_script_address=$(${cli} conway address build --payment-script-file ${bidding_script_path} ${network})
 bidding_pid=$(cat ../contracts/hashes/bidding.hash)
 
 # encryption
 encryption_script_path="../contracts/contracts/encryption_contract.plutus"
-encryption_script_address=$(${cli} conway address build --payment-script-file ${encryption_script_path} --stake-key-hash ${staking_credential} ${network})
+encryption_script_address=$(${cli} conway address build --payment-script-file ${encryption_script_path} ${network})
 encryption_pid=$(cat ../contracts/hashes/encryption.hash)
 
 # reference
@@ -50,8 +49,8 @@ tx_id=$(jq -r '.genesis_tx_id' ${CONFIG_JSON})
 tx_idx=$(jq -r '.genesis_tx_idx' ${CONFIG_JSON})
 
 genesis_pid=$(cat ../contracts/hashes/genesis.hash)
-tx_idx_cbor=$(python3 -c "import cbor2;encoded=cbor2.dumps(${tx_idx});print(encoded.hex())")
-full_genesis_tkn="${tx_idx_cbor}${tx_id}"
+tx_idx_byte=$(python3 -c "idx=${tx_idx}; assert 0 <= idx <= 255; print(bytes([idx]).hex())")  # I-08: mirror on-chain bytearray.push
+full_genesis_tkn="${tx_idx_byte}${tx_id}"
 genesis_tkn="${full_genesis_tkn:0:64}"
 
 # bidding token

app/commands/08_decryptMessage.sh

@@ -19,11 +19,10 @@ encryption_pid=$(cat ../contracts/hashes/encryption.hash)
 encryption_tkn=$(cat ../data/encryption.token)
 
 # stake key
-staking_credential=$(jq -r '.staking_credential' ${CONFIG_JSON})
 
 # encryption
 encryption_script_path="../contracts/contracts/encryption_contract.plutus"
-encryption_script_address=$(${cli} conway address build --payment-script-file ${encryption_script_path} --stake-key-hash ${staking_credential} ${network})
+encryption_script_address=$(${cli} conway address build --payment-script-file ${encryption_script_path} ${network})
 
 asset=${encryption_pid}${encryption_tkn}
 

app/commands/99_displayAllBalances.sh

@@ -14,7 +14,6 @@ ${cli} conway query protocol-parameters ${network} --out-file ./tmp/protocol.jso
 ${cli} conway query tip ${network} | jq
 
 # stake key
-staking_credential=$(jq -r '.staking_credential' ${CONFIG_JSON})
 
 # Loop the contract in the contract folder
 for script_file in ../contracts/contracts/*.plutus; do
@@ -29,7 +28,7 @@ for script_file in ../contracts/contracts/*.plutus; do
     if [ "$contract" == "reference_contract.plutus" ]; then
         script_address=$(${cli} conway address build --payment-script-file ${script_file} ${network})
     else
-        script_address=$(${cli} conway address build --payment-script-file ${script_file} --stake-key-hash ${staking_credential} ${network})
+        script_address=$(${cli} conway address build --payment-script-file ${script_file} ${network})
     fi
 
     echo -e "\033[1;37m\n--------------------------------------------------------------------------------\033[0m"