Skip to content

Multiproof audit 2 fixes#251

Open
roger-bai-coinbase wants to merge 7 commits intomainfrom
tee-audit-2-fixes
Open

Multiproof audit 2 fixes#251
roger-bai-coinbase wants to merge 7 commits intomainfrom
tee-audit-2-fixes

Conversation

@roger-bai-coinbase
Copy link
Copy Markdown
Contributor

@roger-bai-coinbase roger-bai-coinbase commented Apr 13, 2026 •
edited
Loading

Summary

Hardens NitroEnclaveVerifier journal verification around certificate expiry and general multiproof audit follow-ups.

Changes

  • After trusted-prefix checks, reject verification when any remaining certificate in the journal chain has a notAfter before block.timestamp (audit finding 1).
  • Remove stale or misleading comments (finding 3).
  • Document that a revoked intermediate can become trusted again if re-added with a new expiry (finding 5).
  • Add a test that an expired leaf past trustedCertsPrefixLen yields InvalidTimestamp and is not cached.
  • Additional documentation on CWIA offsets in AggregateVerifier

@cb-heimdall
Copy link
Copy Markdown
Collaborator

cb-heimdall commented Apr 13, 2026 •
edited
Loading

🟡 Heimdall Review Status

Requirement Status More Info
Reviews 🟡 0/1
Denominator calculation
Show calculation
1 if user is bot 0
1 if user is external 0
2 if repo is sensitive 0
From .codeflow.yml 1
Additional review requirements
Show calculation
Max 0
0
From CODEOWNERS 0
Global minimum 0
Max 1
1
1 if commit is unverified 0
Sum 1

@roger-bai-coinbase roger-bai-coinbase marked this pull request as ready for review April 13, 2026 19:43
@kadir4789
Copy link
Copy Markdown

kadir4789 commented Apr 14, 2026

ABC

@kadir4789
Copy link
Copy Markdown

kadir4789 commented Apr 14, 2026

abc

kadir4789
kadir4789 reviewed Apr 14, 2026
View reviewed changes
Copy link
Copy Markdown

@kadir4789 kadir4789 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

abc

@kadir4789
Copy link
Copy Markdown

kadir4789 commented Apr 14, 2026

abc1

@roger-bai-coinbase roger-bai-coinbase changed the title Tee audit 2 fixes Multiproof audit 2 fixes Apr 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@leopoldjoy leopoldjoy Awaiting requested review from leopoldjoy

1 more reviewer

@kadir4789 kadir4789 kadir4789 left review comments

Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@roger-bai-coinbase @cb-heimdall @kadir4789