Skip to content

fix: validate cached ancestor expiry#69

Draft
leopoldjoy wants to merge 1 commit into
mainfrom
audit/check-cached-ancestor-expiry
Draft

fix: validate cached ancestor expiry#69
leopoldjoy wants to merge 1 commit into
mainfrom
audit/check-cached-ancestor-expiry

Conversation

@leopoldjoy

Copy link
Copy Markdown
Contributor

Summary

  • check cached notAfter metadata for every ancestor during the cached-chain walk
  • preserve revocation and broken-chain fail-closed behavior
  • add direct CertManager coverage for an expired grandparent

Audit finding

Addresses external finding #14.

Tests

  • forge fmt --check
  • forge test --match-path test/CertManager.t.sol (39 passed, 1 skipped)
  • forge test (205 passed, 1 skipped)

Size note

Production CertManager is 24,508 bytes, leaving 68 bytes under EIP-170. Test/demo harnesses may still exceed the limit; the production contract remains within it.

Co-authored-by: OpenCode <opencode-noreply@coinbase.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant