fix: submitResult certificate checks
#1557
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
0xrajath
changed the title
submitResult checkssubmitResult certificate checks
ypatil12
reviewed
Jul 22, 2025
ypatil12
approved these changes
Jul 22, 2025
0xrajath
added a commit
that referenced
this pull request
Jul 22, 2025
**Motivation:** We need to add some additional certificate checks in the `submitResult` function of the TaskMailbox to prevent malicious behavior. **Modifications:** * Require check that the referenceTimestamp of the certificate equals the referenceTimestamp snapshotted at task creation time. * Require check that the messageHash of the certificate matches the hash of the task result. **Result:** Safe `submitResult`.
0xrajath
added a commit
that referenced
this pull request
Jul 24, 2025
**Motivation:** We need to add some additional certificate checks in the `submitResult` function of the TaskMailbox to prevent malicious behavior. **Modifications:** * Require check that the referenceTimestamp of the certificate equals the referenceTimestamp snapshotted at task creation time. * Require check that the messageHash of the certificate matches the hash of the task result. **Result:** Safe `submitResult`.
Merged
0xrajath
added a commit
that referenced
this pull request
Jul 25, 2025
**Motivation:** We need to add some additional certificate checks in the `submitResult` function of the TaskMailbox to prevent malicious behavior. **Modifications:** * Require check that the referenceTimestamp of the certificate equals the referenceTimestamp snapshotted at task creation time. * Require check that the messageHash of the certificate matches the hash of the task result. **Result:** Safe `submitResult`.
0xrajath
added a commit
that referenced
this pull request
Jul 30, 2025
**Motivation:** We need to add some additional certificate checks in the `submitResult` function of the TaskMailbox to prevent malicious behavior. **Modifications:** * Require check that the referenceTimestamp of the certificate equals the referenceTimestamp snapshotted at task creation time. * Require check that the messageHash of the certificate matches the hash of the task result. **Result:** Safe `submitResult`.
0xrajath
added a commit
that referenced
this pull request
Jul 30, 2025
# v1.8.0 Hourglass The Hourglass release consists of a framework that supports the creation of task-based AVSs. The task-based AVSs are enabled through a `TaskMailbox` core contract deployed to all chains that support a `CertificateVerifier`. Additionally AVSs deploy their `TaskAVSRegistrar`. The release has 3 components: 1. Core Contracts 2. AVS Contracts 3. Offchain Infrastructure The below release notes cover Core Contracts. For more information on the end to end protocol, see our [docs](https://github.com/Layr-Labs/hourglass-monorepo/blob/master/README.md) and [core contract docs](../docs/avs/task/TaskMailbox.md). ## Release Manager @0xrajath ## Highlights This hourglass release only introduces new contracts. As a result, there are no breaking changes or deprecations. 🚀 New Features Destination Chain Contracts - `TaskMailbox`: A core infrastructure contract that enables task-based AVS execution models. It provides a standardized way for AVSs to create tasks, have operators execute them, and submit verified results on-chain. The contract acts as a mailbox system where task creators post tasks with fees, and operators compete to execute and submit results with proper consensus verification. ## Changelog - feat: no consensus config [PR #1574](#1574) - fix: hourglass internal review fixes [PR #1570](#1570) - fix: addressing pr comments [PR #1568](#1568) - fix: deploy script - fix: deploy script - fix: hourglass release upgrade semver - fix: hourglass release upgrade semver - docs: changelog - fix: correct ecdsa message hash check [PR #1563](#1563) - fix: missing assume in fuzz test - fix: `submitResult` certificate checks [PR #1557](#1557) - chore: forge fmt - fix: certificate verifier interface changes - feat: hourglass zeus script [PR #1546](#1546) - fix: mock certificate verifiers [PR #1545](#1545) - feat: hourglass (task-based AVS framework) [PR #1534](#1534) --------- Co-authored-by: Nadir Akhtar <[email protected]>
Merged
0xrajath
added a commit
that referenced
this pull request
Jul 30, 2025
# v1.8.0 Hourglass The Hourglass release consists of a framework that supports the creation of task-based AVSs. The task-based AVSs are enabled through a `TaskMailbox` core contract deployed to all chains that support a `CertificateVerifier`. Additionally AVSs deploy their `TaskAVSRegistrar`. The release has 3 components: 1. Core Contracts 2. AVS Contracts 3. Offchain Infrastructure The below release notes cover Core Contracts. For more information on the end to end protocol, see our [docs](https://github.com/Layr-Labs/hourglass-monorepo/blob/master/README.md) and [core contract docs](../docs/avs/task/TaskMailbox.md). ## Release Manager @0xrajath ## Highlights This hourglass release only introduces new contracts. As a result, there are no breaking changes or deprecations. 🚀 New Features Destination Chain Contracts - `TaskMailbox`: A core infrastructure contract that enables task-based AVS execution models. It provides a standardized way for AVSs to create tasks, have operators execute them, and submit verified results on-chain. The contract acts as a mailbox system where task creators post tasks with fees, and operators compete to execute and submit results with proper consensus verification. ## Changelog - feat: no consensus config [PR #1574](#1574) - fix: hourglass internal review fixes [PR #1570](#1570) - fix: addressing pr comments [PR #1568](#1568) - fix: deploy script - fix: deploy script - fix: hourglass release upgrade semver - fix: hourglass release upgrade semver - docs: changelog - fix: correct ecdsa message hash check [PR #1563](#1563) - fix: missing assume in fuzz test - fix: `submitResult` certificate checks [PR #1557](#1557) - chore: forge fmt - fix: certificate verifier interface changes - feat: hourglass zeus script [PR #1546](#1546) - fix: mock certificate verifiers [PR #1545](#1545) - feat: hourglass (task-based AVS framework) [PR #1534](#1534)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation:
We need to add some additional certificate checks in the
submitResultfunction of the TaskMailbox to prevent malicious behavior.Modifications:
Result:
Safe
submitResult.