Support Ledger-friendly signatures in pallet-limit-orders#2966
Support Ledger-friendly signatures in pallet-limit-orders#2966UnArbosSix wants to merge 5 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🛡️ AI Review — Skeptic (security review)VERDICT: SAFE VERY HIGH scrutiny: 20-day-old account with no public repositories; mitigated by repository write access, matching author/committer identity, and no listed Gittensor association. Branch targets main. Static analysis found no signature bypass or malicious behavior. Both accepted payload forms remain bound to the complete SCALE-encoded order, the wrapped hash is derived internally from that order, ECDSA remains explicitly rejected, and the runtime specification version is bumped to 438. FindingsNo findings. ConclusionNo security vulnerabilities were found in the current diff. 🔍 AI Review — Auditor (domain review)VERDICT: 👎 UNKNOWN Gittensor association; repository write access, but the public account is under 30 days old with limited history. The spec version is correctly bumped to 438, although the PR body still says 437. The overlapping PRs only share common files and are not competing implementations. The new TypeScript test exercises an ed25519 software key, not the Ledger backend, so it does not resolve the producer-side incompatibility. No runtime execution was needed to confirm this interface mismatch. Findings
Prior-comment reconciliation
ConclusionThe verifier supports the proposed signature format, but the repository’s Ledger signing path still cannot produce it. The PR therefore does not yet deliver its core Ledger-compatibility goal. 📜 Previous run (superseded)
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👎 |
|
🔄 AI review updated — Skeptic: VULNERABLE |
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👎 |
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👎 |
|
🔄 AI review updated — Skeptic: SAFE Auditor: 👎 |
1 participant
Motivation
Limit orders currently accept only sr25519 signatures over the SCALE-encoded
VersionedOrder. This change aims to broaden signature compatibility by accepting ed25519 signatures and signatures over a<Bytes>-wrapped Blake2-256 order hash.Changes
MultiSignaturevariants during order validation while continuing to reject ECDSA.<Bytes>-wrapped order hash.Files of interest are
pallets/limit-orders/src/lib.rs,pallets/limit-orders/src/tests/auxiliary.rs, andpallets/limit-orders/src/benchmarking.rs.Behavioral impact
Existing sr25519 orders remain valid. The accepted signature surface expands to ed25519 and wrapped-hash signatures; ECDSA remains unsupported. The order hash remains bound to the complete SCALE-encoded order.
Testing
The PR adds pallet-level coverage for wrapped ed25519 acceptance and ECDSA rejection and updates the benchmark fixture. End-to-end coverage using the supported Ledger client is still required.