refactor(verify): collapse DleqLocation into a unit DleqInvalid#16
Merged
Conversation
The charge contract checks DLEQ only on the swap-returned signatures, per draft-cashu-charge-01 $security-dleq; presented input proofs are never DLEQ-checked (the swap is the authoritative oracle). Drop the unused second location so ChargeError::DleqInvalid is a unit variant expressing the one check performed. Behavior is unchanged: the swap-output DLEQ gate, the verification-failed/402 mapping, and the resource-not-served path are all untouched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aligns the charge contract's DLEQ type with
draft-cashu-charge-01§security-dleq (latest spec,9e3f973): the server verifies DLEQ only on the swap-returned signatures, never on presented input proofs (the swap is the authoritative oracle). pops already behaved this way — this drops the vestigialDleqLocation::InputProofscaffold so the type expresses the single check performed.Type-level only — zero behavior change. Verified preserved:
swap_ceremony::verify_swap_output_dleq) — untouched (not in the diff)SwapOutputDleqInvalid → DleqInvalid → verification-failed / 402 / resource-not-servedcharge_error_codestill emits"dleq-invalid"ChargeError::DleqInvalidbecomes a unit variant;DleqLocationis removed. 7 files, +30/−74.Evidence:
cargo test -p pops-core-verify(176) +cargo test --workspace(all 4 crates) +cargo clippy --all-targets -D warnings+ wasm-target build — all green. Built + reviewed via the build kit (frozen spec → implementer → independent adversarial verifier; money-path + clean-cut gates).Spec contract: orveth/mpp-specs#1
draft-cashu-charge-01@9e3f973.🤖 Generated with Claude Code