Mint: recompute ehash quote amounts from the share hash #44

New issue

Open

opened 2026-10-15 18:06:10 +01:00 by vnprc-agent · 0 comments

vnprc-agent commented

2026-10-15 18:06:10 +01:00

Collaborator

Make the mint derive each ehash quote's amount from the share hash itself, so the pool's asserted number is informational at most and a mint-side floor governs issuance.

Primary goals:

Mint-side recompute — the mint validates amount == calculate_ehash_amount(header_hash, minimum_difficulty) (or simply recomputes and ignores the pool's value), using ehash::calculate_ehash_amount (protocols/ehash/src/work.rs:11) which it already depends on via the quote path.
Configurable floor with a sane minimum — the mint's minimum_difficulty comes from its own config, refuses to start below a floor (suggest 24), and is logged at startup next to the pool's claimed value.
Kill the over-issuance class — with the current shipped configs (config/shared/*.toml set [ehash] minimum_difficulty = 0 and roles/pool/src/lib/mod.rs:95 falls back to 32 only when the key is absent), every accepted share is credited 2^leading_zeros units — a 32-zero-bit share earns ~4.3e9 units instead of 1. Mint-side recompute makes the pool's knob unable to inflate issuance regardless of config drift.

Current state and specifics

The mint trusts MintQuoteRequest.amount verbatim (roles/mint/src/lib/sv2_connection/quote_processing.rs): it pays the quote at epoch finality for whatever amount the pool asserted, up to 2^63-1, keyed to any locking key in the request. The fields the mint would need to check the work — the share's header_hash — are already in the message; leading_zero_bits is computed there today but only for a log line (estimated_min_difficulty), never enforced. Dedup is by (header_hash, locking_key) uniqueness only.

The full findings write-up is notes/hashpool/security-review-2026-10-15.md (findings H-1 and C-1).

Scope

In scope: amount validation/recompute in the mint quote path, mint-side minimum_difficulty config + startup floor, tests covering mismatched/over-claimed amounts.

Out of scope, tracked separately: authenticated quote creation (pool holds a mint-issued token) — the planned auth layer; this issue stands independently as defense in depth so a leaked or misconfigured pool key cannot mint unbounded supply. Pool-side config cleanup (collapsing the three difficulty knobs) is its own follow-up once the mint enforces the truth.

Make the mint derive each ehash quote's amount from the share hash itself, so the pool's asserted number is informational at most and a mint-side floor governs issuance. Primary goals: - **Mint-side recompute** — the mint validates `amount == calculate_ehash_amount(header_hash, minimum_difficulty)` (or simply recomputes and ignores the pool's value), using `ehash::calculate_ehash_amount` (`protocols/ehash/src/work.rs:11`) which it already depends on via the quote path. - **Configurable floor with a sane minimum** — the mint's `minimum_difficulty` comes from its own config, refuses to start below a floor (suggest 24), and is logged at startup next to the pool's claimed value. - **Kill the over-issuance class** — with the current shipped configs (`config/shared/*.toml` set `[ehash] minimum_difficulty = 0` and `roles/pool/src/lib/mod.rs:95` falls back to 32 only when the key is absent), every accepted share is credited `2^leading_zeros` units — a 32-zero-bit share earns ~4.3e9 units instead of 1. Mint-side recompute makes the pool's knob unable to inflate issuance regardless of config drift. ### Current state and specifics The mint trusts `MintQuoteRequest.amount` verbatim (`roles/mint/src/lib/sv2_connection/quote_processing.rs`): it pays the quote at epoch finality for whatever amount the pool asserted, up to 2^63-1, keyed to any locking key in the request. The fields the mint would need to check the work — the share's `header_hash` — are already in the message; `leading_zero_bits` is computed there today but only for a log line (`estimated_min_difficulty`), never enforced. Dedup is by `(header_hash, locking_key)` uniqueness only. The full findings write-up is `notes/hashpool/security-review-2026-10-15.md` (findings H-1 and C-1). ### Scope In scope: amount validation/recompute in the mint quote path, mint-side `minimum_difficulty` config + startup floor, tests covering mismatched/over-claimed amounts. Out of scope, tracked separately: authenticated quote creation (pool holds a mint-issued token) — the planned auth layer; this issue stands independently as defense in depth so a leaked or misconfigured pool key cannot mint unbounded supply. Pool-side config cleanup (collapsing the three difficulty knobs) is its own follow-up once the mint enforces the truth.

vnprc-agent referenced this issue

2026-10-15 18:38:07 +01:00

Adopt architecture principles: track the protocol, not the product #46

vnprc-agent referenced this issue

2026-10-18 23:18:23 +01:00

Verification feature map: behavior-level map the verify-merge skill drives #48