gno.land/r/gnops/valopers

Realm

Overview

Kind: Realm (renderable)
Name: valopers
Namespace: gnops
Files: 14 (gnomod.toml)
Exported functions: 13
Module: gno.land/r/gnops/valopers
gno: 0.9

Files (14)

z_govdao_only_principal_filetest.gnogno

1// PKGPATH: gno.land/r/zzprincipal2//3// The repointed authority names GovDAO, so a foreign realm crossing into4// valopers is NOT the principal the gate accepts.5//6// This is the runtime counterpart to7// ./z_foreign_realm_capability_filetest.gno. That file pins that the

Functions

AddToAuthList(cur interface {.seal func(); Address func() .uverse.address; IsCode func() bool; IsCurrent func() bool; IsEphemeral func() bool; IsUser func() bool; IsUserCall func() bool; IsUserRun func() bool; PkgPath func() string; Previous func() .uverse.realm; String func() string; Sub func(string) .uverse.realm; Subpath func() string}, addr string, member string)
Auth() string
DeleteFromAuthList(cur interface {.seal func(); Address func() .uverse.address; IsCode func() bool; IsCurrent func() bool; IsEphemeral func() bool; IsUser func() bool; IsUserCall func() bool; IsUserRun func() bool; PkgPath func() string; Previous func() .uverse.realm; String func() string; Sub func(string) .uverse.realm; Subpath func() string}, addr string, member string)
GetByAddr(addr string) struct{Moniker string; Description string; ServerType string; OperatorAddress .uverse.address; SigningPubKey string; SigningAddress .uverse.address; LastRotationHeight int64; KeepRunning bool; auth *gno.land/p/nt/ownable/exts/authorizable/v0.Authorizable}
NewAuthorityRotationProposalRequest(cur interface {.seal func(); Address func() .uverse.address; IsCode func() bool; IsCurrent func() bool; IsEphemeral func() bool; IsUser func() bool; IsUserCall func() bool; IsUserRun func() bool; PkgPath func() string; Previous func() .uverse.realm; String func() string; Sub func(string) .uverse.realm; Subpath func() string}, newContractPath string) struct{title string; description string; executor gno.land/r/gov/dao.Executor; filter gno.land/r/gov/dao.Filter}
NewInstructionsProposalRequest(cur interface {.seal func(); Address func() .uverse.address; IsCode func() bool; IsCurrent func() bool; IsEphemeral func() bool; IsUser func() bool; IsUserCall func() bool; IsUserRun func() bool; PkgPath func() string; Previous func() .uverse.realm; String func() string; Sub func(string) .uverse.realm; Subpath func() string}, newInstructions string) struct{title string; description string; executor gno.land/r/gov/dao.Executor; filter gno.land/r/gov/dao.Filter}
Register(cur interface {.seal func(); Address func() .uverse.address; IsCode func() bool; IsCurrent func() bool; IsEphemeral func() bool; IsUser func() bool; IsUserCall func() bool; IsUserRun func() bool; PkgPath func() string; Previous func() .uverse.realm; String func() string; Sub func(string) .uverse.realm; Subpath func() string}, moniker string, description string, serverType string, addr string, pubKey string)
Render(fullPath string) string
UpdateDescription(cur interface {.seal func(); Address func() .uverse.address; IsCode func() bool; IsCurrent func() bool; IsEphemeral func() bool; IsUser func() bool; IsUserCall func() bool; IsUserRun func() bool; PkgPath func() string; Previous func() .uverse.realm; String func() string; Sub func(string) .uverse.realm; Subpath func() string}, addr string, description string)
UpdateKeepRunning(cur interface {.seal func(); Address func() .uverse.address; IsCode func() bool; IsCurrent func() bool; IsEphemeral func() bool; IsUser func() bool; IsUserCall func() bool; IsUserRun func() bool; PkgPath func() string; Previous func() .uverse.realm; String func() string; Sub func(string) .uverse.realm; Subpath func() string}, addr string, keepRunning bool)
UpdateMoniker(cur interface {.seal func(); Address func() .uverse.address; IsCode func() bool; IsCurrent func() bool; IsEphemeral func() bool; IsUser func() bool; IsUserCall func() bool; IsUserRun func() bool; PkgPath func() string; Previous func() .uverse.realm; String func() string; Sub func(string) .uverse.realm; Subpath func() string}, addr string, moniker string)
UpdateServerType(cur interface {.seal func(); Address func() .uverse.address; IsCode func() bool; IsCurrent func() bool; IsEphemeral func() bool; IsUser func() bool; IsUserCall func() bool; IsUserRun func() bool; PkgPath func() string; Previous func() .uverse.realm; String func() string; Sub func(string) .uverse.realm; Subpath func() string}, addr string, serverType string)
UpdateSigningKey(cur interface {.seal func(); Address func() .uverse.address; IsCode func() bool; IsCurrent func() bool; IsEphemeral func() bool; IsUser func() bool; IsUserCall func() bool; IsUserRun func() bool; PkgPath func() string; Previous func() .uverse.realm; String func() string; Sub func(string) .uverse.realm; Subpath func() string}, addr string, newPubKey string)

Signatures reconstructed verbatim from vm/qfuncs — interface params keep their inline definitions.

Rendered

Rendered Raw gnoweb ↗

8// privileged CAPABILITY cannot be obtained; this one pins that the

9// PRINCIPAL cannot be minted — which is the other half of what the gate

10// depends on, and the half that was actually broken.

12// An earlier version of this file asserted only the rendered description

13// plus "instructions were not defaced" without ever attempting a write, so

14// it went red on a repoint revert purely because the golden path string

15// changed, and stayed GREEN with the authority swapped for a fully

16// permissive one. It now drives the two routes an attacker actually has.

18// Why it matters: under the previous ContractAuthority(ownPath) +

19// DoByCurrent pairing this property did not hold at all. rlm.Address()

20// inside any valopers crossing frame is unconditionally valopers' own

21// address, so the gate accepted every caller and its only real defence was

22// that no exported entrypoint happened to reach updateInstructions.

24// And pointing the gate at r/gov/dao only helps while that path is

25// unmintable. dao.NewSimpleExecutor + SimpleExecutor.Execute are both

26// exported, and Execute is declared in r/gov/dao, so before Execute gated

27// on its invoker ANY realm could mint a frame whose Previous() was

28// r/gov/dao and satisfy this gate — directly for a closure it obtained,

29// and for any exported valopers function whose signature was assignable to

30// `func(realm) error`. Section 2 below is the pin for that.

31package zzprincipal

36 "gno.land/p/nt/testutils/v0"

37 "gno.land/r/gnops/valopers"

38 "gno.land/r/gov/dao"

39 daov3init "gno.land/r/gov/dao/init/v0"

42// A real GovDAO exists and this realm is not a member of it, so the final

43// step fails on the proposal-creation gate rather than on "DAO not

44// initialized" -- which would pass for the wrong reason.

45var govdaoMember address = testutils.TestAddress("govdao-member")

47func init(cur realm) {

48 daov3init.InitWithUsers(cross(cur), govdaoMember)

51// reachInstructions is the shape an attacker needs: something declared

52// where it will run with a useful frame. Declared HERE, so it carries the

53// attacker's identity, not valopers' — the point being that even with the

54// governance principal minted for it, it cannot reach the write.

55func reachInstructions(cur realm) error {

56 // Nothing exported by valopers reaches updateInstructions, so the most

57 // an attacker can do from a forged governance frame is build the sealed

58 // request again. Build it, to prove construction is not the hole.

59 _ = valopers.NewInstructionsProposalRequest(cross(cur), "PWNED-VIA-FORGED-PRINCIPAL")

63func main(cur realm) {

64 // 1. The authority names GovDAO, and says so in a way a reader can act

65 // on. A non-canonical proposer cannot reproduce these bytes.

66 println("authority:", valopers.Auth())

68 // 2. The governance principal is not mintable. Wrapping any callback in

69 // dao's own exported executor used to hand out a frame whose

70 // Previous() is r/gov/dao; Execute now refuses an invoker from

71 // outside the proxy.

72 e := dao.NewSimpleExecutor(0, cur, reachInstructions, "")

73 println("forged-principal Execute:", e.Execute(cross(cur)))

75 // 3. The only remaining route is to ask GovDAO to adopt a request. A

76 // hostile realm cannot: this aborts (a GovDAO member still can, and

77 // then needs the votes — covered by

78 // r/gnops/valopers/proposal/filetests/z_governed_instructions_filetest.gno).

79 rendered := valopers.Render("")

80 println("instructions defaced:", strings.Contains(rendered, "PWNED"))

81 println("authority unchanged:", valopers.Auth())

83 dao.MustCreateProposal(cross(cur),

84 valopers.NewAuthorityRotationProposalRequest(cross(cur), "gno.land/r/attacker/dao"))

85 println("UNREACHABLE: outsider rotated the authority")

89// authority: contract_authority[contract=gno.land/r/gov/dao,proposer=contract-identity]

90// forged-principal Execute: execution denied: executors are only invocable by gno.land/r/gov/dao

91// instructions defaced: false

92// authority unchanged: contract_authority[contract=gno.land/r/gov/dao,proposer=contract-identity]

95// proposal creation must be done directly by a user or through the r/gov/dao proxy. caller realm: realm{gno.land/r/gov/dao:g1p84dvfh4wrplyxx4zsmy77a8rxcnjup2j7zv5r}; caller's previous: realm{gno.land/r/zzprincipal:g1036vewy55meppdzpngzsufahr389mldycavect}

vm/qrender output, sanitized (docs/render-security.md) and displayed in an empty-sandbox iframe — scripts, forms and popups cannot run. Links stay inert in-preview; right-click to open.

gno.land/r/gnops/valopers⧉

gno.land/r/gnops/valopers