Was this helpful?
// crates/proof/challenge/src/driver.rs
if self.pending_proofs.contains_key(&game_address) {
debug!(game = %game_address, "skipping game with pending proof session");
return Ok(());
}
let (status, tee_prover, zk_prover) = tokio::try_join!(
self.verifier_client.status(game_address),
self.verifier_client.tee_prover(game_address),
self.verifier_client.zk_prover(game_address),
)?;
// no countered_index re-validation before submit
let result = self
.submitter
.submit_dispute(game_address, proof_bytes, invalid_index, expected_root, intent)
.await;
match result {
Ok(_) => { self.pending_proofs.remove(&game_address); }
Err(e) => {
warn!(error = %e, game = %game_address, "dispute tx failed, will retry next tick");
// Leave entry as ReadyToSubmit for retry.
}
}// base-contracts/src/multiproof/AggregateVerifier.sol
function nullify(
bytes calldata proofBytes,
uint256 intermediateRootIndex,
bytes32 intermediateRootToProve
) external {
...
if (counteredByIntermediateRootIndexPlusOne > 0) {
if (intermediateRootIndex != counteredByIntermediateRootIndexPlusOne - 1) {
revert InvalidIntermediateRootIndex();
}
if (intermediateRootToProve != intermediateOutputRoot(intermediateRootIndex)) {
revert IntermediateRootMismatch(intermediateRootToProve, intermediateOutputRoot(intermediateRootIndex));
}
if (proofType != ProofType.ZK) revert InvalidProofType();
} else {
_checkIntermediateRoot(intermediateRootIndex, intermediateRootToProve);
}
...
}diff --git a/crates/proof/challenge/tests/driver.rs b/crates/proof/challenge/tests/driver.rs
index 341b0d6e5..0a9b6e2e4 100644
--- a/crates/proof/challenge/tests/driver.rs
+++ b/crates/proof/challenge/tests/driver.rs
@@ -1164,6 +1164,56 @@ async fn test_step_dual_proof_tee_fails_falls_back_to_zk_nullify() {
);
}
+#[tokio::test]
+async fn test_dual_proof_ready_to_submit_retry_remains_unbounded_after_external_challenge() {
+ base_cli_utils::init_test_tracing();
+
+ // AUDIT: start from a dual-proof, unchallenged game where the challenger
+ // enters the Nullify path and builds a pending proof from pre-challenge state.
+ let (l2, factory, root_15, _root_20) = base_game_mocks();
+ let initial_state = MockGameState {
+ tee_prover: DEFAULT_TEE_PROVER,
+ zk_prover: ZK_PROVER_ADDR,
+ intermediate_output_roots: vec![root_15, BOGUS_ROOT],
+ countered_index: 0,
+ ..game_state(20)
+ };
+ let verifier = single_game_verifier(initial_state.clone());
+
+ let zk = succeeded_zk_prover("dual-race-retry", vec![0xDE, 0xAD]);
+
+ // AUDIT: model deterministic nullify() submit reverts once the game is
+ // externally challenged before the pending submission lands.
+ let total_submit_failures =
+ Driver::<MockL2Provider, MockZkProofProvider, MockTxManager>::MAX_PROOF_RETRIES as usize
+ + 2;
+ let tx_manager = MockTxManager::with_responses(
+ (0..total_submit_failures)
+ .map(|_| Ok(receipt_with_status(false, DEFAULT_TX_HASH)))
+ .collect(),
+ );
+
+ let mut driver = test_driver(factory, Arc::clone(&verifier), l2, zk, tx_manager);
+
+ // AUDIT: dual-proof candidate should initiate ZK Nullify proof flow.
+ driver.step().await.unwrap();
+ let entry = driver.pending_proofs.get(&addr(0)).expect("proof should be pending after initiation");
+ assert!(matches!(entry.phase, ProofPhase::AwaitingProof { .. }));
+ assert_eq!(entry.intent, DisputeIntent::Nullify);
+
+ // AUDIT: external challenge flips countered_index semantics before submit.
+ let mut challenged_state = initial_state;
+ challenged_state.countered_index = 2; // 1-based => challenged index 1
+ verifier.update_game(addr(0), challenged_state);
+
+ for _ in 0..total_submit_failures {
+ driver.step().await.unwrap();
+ let entry = driver.pending_proofs.get(&addr(0)).expect("entry should be preserved");
+ assert!(entry.is_ready(), "phase should remain ReadyToSubmit after revert");
+ assert_eq!(entry.retry_count, 0, "submit retries are not bounded by proof retry counter");
+ }
+}
+
// ──────────────────────────────────────────────────────────────────────────
// Bond lifecycle integration testsCARGO_ENCODED_RUSTFLAGS='-Clink-arg=-fuse-ld=lld' cargo test -p base-challenger --test driver test_dual_proof_ready_to_submit_retry_remains_unbounded_after_external_challenge -- --nocapturerunning 1 test
2026-04-28T12:34:49.931248Z INFO base_challenger::scanner: scan complete games_found=1 scan_head=0 games_scanned=1
2026-04-28T12:34:49.931270Z INFO base_challenger::validator: validating intermediate output roots game=0x0000000000000000000000000000000000000000 starting_block=10 end_block=20 interval=5 intermediate_count=2
2026-04-28T12:34:49.931544Z WARN base_challenger::validator: invalid output root detected game=0x0000000000000000000000000000000000000000 block=20 index=1 expected=0x401da1446febeae61109677bc2f52e9e7bbb8313a6f3507529006ef0b49c2f60 claimed=0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
2026-04-28T12:34:49.931567Z INFO base_challenger::driver: invalid intermediate root detected, requesting proof game=0x0000000000000000000000000000000000000000 invalid_index=1 expected_root=0x401da1446febeae61109677bc2f52e9e7bbb8313a6f3507529006ef0b49c2f60 intent=Nullify
2026-04-28T12:34:49.931623Z INFO base_challenger::driver: proof job initiated game=0x0000000000000000000000000000000000000000 session_id=dual-race-retry
2026-04-28T12:34:49.931651Z INFO base_challenger::driver: proof ready, submitting dispute transaction game=0x0000000000000000000000000000000000000000 proof_len=3 action="nullify"
2026-04-28T12:34:49.931684Z INFO base_challenger::submitter: submitting dispute transaction game=0x0000000000000000000000000000000000000000 action="nullify" intermediate_root_index=1 intermediate_root_to_prove=0x401da1446febeae61109677bc2f52e9e7bbb8313a6f3507529006ef0b49c2f60 calldata_len=164
2026-04-28T12:34:49.931706Z WARN base_challenger::driver: dispute tx failed, will retry next tick error=transaction reverted: 0xdddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd game=0x0000000000000000000000000000000000000000
...