fix(drive-abci)!: refuse IdentityCreate identity id and key proof failures before they consume the asset lock by shumkov · Pull Request #5431 · dashpay/platform

shumkov · 2026-10-14T10:53:58Z

Issue being fixed or feature implemented

An IdentityCreate is authorized by its asset lock's one-time key, which signs the transition's signable bytes. Two fields are left out of those bytes: the identity_id, and the proof-of-possession signature of each key. Each key signs those same bytes, so the asset lock signature cannot cover the key signatures.

Until now, the identity create advanced structure validation charged the asset lock when one of those two fields was wrong. That covers an identity_id other than the one the asset lock's outpoint derives, and a key whose proof of possession fails. Such a failure was a paid failure charged to the asset lock. The asset lock signature does not cover those values, so a failure in them must not consume the asset lock. A transition carrying such a value also must not enter the mempool. check_tx did not run this validation for IdentityCreate, so it admitted such a transition.

#4968 made the same change for IdentityCreateFromAddresses.

What was done?

The work is split into two commits.

1. Consensus at protocol version 14: refuse without a fee (fix(drive-abci)!: refuse IdentityCreate identity id and key proof failures unpaid (PV14))

There is a new identity_create advanced_structure v1. Only DRIVE_ABCI_VALIDATION_VERSIONS_V10 (protocol version 14) selects it.
v1 matches v0 except for two failures: an identity id mismatch, and a failed proof of possession. The second includes a signature on a hash-type key, which must stay empty. For these, v1 returns the error with no action.
The block therefore refuses the transition without a fee. No penalty is taken, no used tag is recorded, and the asset lock is left as it was.
As with any unpaid result, prepare_proposal drops such a transition and process_proposal rejects a block that holds one.
Key structure failures are still charged, because the asset lock signature covers the keys. Examples are a missing master key or duplicate keys.
The valid path records the same operations as v0, so the fees for a valid identity create do not change.
Protocol versions 1–13 keep v0.
The proof-of-possession check also fails for key data that does not parse, such as a malformed BLS public key. From protocol version 14 that failure is refused without a fee too, like any other proof failure, although the key data is signed: only the holder of the asset lock key can sign such data, and check_tx refuses it. The transition is refused either way; it just no longer costs the asset lock.

2. Admission at every protocol version: refuse at check_tx (fix(drive-abci): refuse IdentityCreate identity id and key proof failures at check_tx)

check_tx now checks that the identity id is the one the asset lock's outpoint derives. The check runs right after basic structure, before the asset lock proof is verified, so such a transition is refused without that verification.
IdentityCreate joins requires_advanced_structure_validation_with_state_on_check_tx, where IdentityCreateFromAddresses and MasternodeVote already are. check_tx then runs the transform followed by advanced structure validation: identity id, key structure, and every key's proof of possession.
For an IdentityCreate, check_tx keeps the action it built for advanced structure validation instead of transforming the transition a second time, so the asset lock proof (the instant lock signature, or the chain-locked transaction fetched from Core) and the asset lock signature are verified once, and their operations are counted once in the fee estimate. Every other transition is transformed at check_tx exactly as before.
Admission is not consensus, so every protocol version gets this. That includes networks still on protocol version 13, once their nodes run this release. This commit does not change block execution.
The validation pipeline chapter of the book describes both commits.
Follow-up commits correct comments only: the note on which protocol versions the check_tx tests sample; the protocol version 14 summary in v14.rs, which claimed that apart from four fixes everything matched protocol version 13; and the doc of identity create advanced structure v1, which now covers key data that does not parse.

check_tx cost

Method:

Machine: an Apple M4 Max VM with 8 vCPUs, release build.
Harness: Platform::check_tx on a fresh platform at the latest protocol version. Each figure is the median of up to 2,000 calls.
The test fixture's instant lock is not signed by a real quorum, so the instant lock signature check was timed on its own: one BLS verification, about 0.60 ms. It is added to every figure where check_tx reaches it. The refused identity id never reaches it. check_tx also skips it on Recheck and for a partially used asset lock.

keys	transition	before	after
1 ECDSA	valid	0.68 ms	0.74 ms
1 ECDSA	identity id not from the asset lock	0.68 ms, admitted	0.006 ms, refused
6 ECDSA	valid	0.72 ms	0.92 ms
6 ECDSA	last key's proof fails	0.71 ms, admitted	0.81 ms, refused
1 BLS	valid	0.67 ms	1.36 ms
6 BLS	valid	0.70 ms	4.6 ms
6 BLS	last key's proof fails	0.70 ms, admitted	4.5 ms, refused

The cost added is the proof-of-possession checks: about 27 µs per ECDSA key and about 630 µs per BLS key.
At most 6 keys are allowed (max_public_keys_in_creation). The 6-BLS-key worst case matches what IdentityCreateFromAddresses already costs at check_tx (3.9 ms with 6 BLS keys; it has no instant lock).
A transition check_tx refuses is not relayed to other nodes.
Recheck is unchanged at about 7 µs.
The "after" figures were measured before check_tx stopped transforming twice. For a valid transition they include a second transition signature check of about 30 µs, so they are slight upper bounds. Refused transitions never reached the second transform, so their figures are exact.

In-place changes to shipped generations

DRIVE_ABCI_VALIDATION_VERSIONS_V10
- Change: identity_create_state_transition.advanced_structure goes from Some(0) to Some(1).
- Selected by: PLATFORM_V14 only.
- Why consensus is not affected for any shipped version:
  - Protocol version 14 is not in a stable release. 5.0.0-rc.1 and rc.2 are prereleases, and the latest stable release ships protocol version 13.
  - Protocol version 14 is not activated on testnet or mainnet; both report protocol version 13.
  - So its table is amended in place rather than adding a new table version, and advanced_structure v0 is untouched.
- Caveat: a node running a 5.0.0 release candidate built before this change maps protocol version 14 to v0. Every node on a chain needs this change before protocol version 14 activates there.
check_tx_verification v0 (state_transition_to_execution_event_for_check_tx v0) and requires_advanced_structure_validation_with_state_on_check_tx
- Change: edited in place (the second is unversioned).
- Selected by: protocol versions 1–14. state_transition_to_execution_event_for_check_tx is 0 in every validation table.
- Why consensus is not affected:
  - Both decide mempool admission only.
  - Block execution never calls them. Neither does process_raw_state_transitions, which prepare_proposal and process_proposal run.
  - What they now refuse, a block also refuses: unpaid at protocol version 14, and as a charged failure at protocol versions 1–13.
  - For an IdentityCreate, the action check_tx now keeps is the one a second transform rebuilt from the same inputs. Every other transition is transformed exactly as before, so its admission and fee estimate are unchanged.

How Has This Been Tested?

Tests in identity_create/mod.rs, module fields_outside_the_asset_lock_signature. They run through Platform::check_tx and through process_raw_state_transitions, which prepare_proposal and process_proposal run.

check_tx tests, at protocol versions 1, 13 and latest. Each also checks that the correct transition is still admitted.

should_refuse_at_check_tx_an_identity_create_whose_identity_id_does_not_match_its_asset_lock. It also checks again after the asset lock is spent, which pins that the identity id is checked before the asset lock proof.
should_refuse_at_check_tx_an_identity_create_with_an_invalid_key_proof_of_possession
should_refuse_at_check_tx_an_identity_create_with_a_signature_on_a_hash_key
should_refuse_at_check_tx_an_identity_create_with_an_invalid_key_structure
should_verify_the_asset_lock_once_at_check_tx: an identity create with a chain asset lock proof is admitted, and Core is asked for the transaction exactly once.

Consensus tests:

should_refuse_unpaid_an_identity_create_whose_identity_id_does_not_match_its_asset_lock, ..._with_an_invalid_key_proof_of_possession and ..._with_a_signature_on_a_hash_key, at the latest version. Each checks that:
- the block result is unpaid;
- the asset lock is absent from state;
- Recheck still admits the valid transition;
- the valid transition then creates the identity with its full balance.
should_charge_the_asset_lock_for_an_identity_create_with_an_invalid_key_structure, at the latest version: the failure is still paid.
should_charge_the_asset_lock_for_an_identity_id_or_key_proof_fault_before_protocol_version_14, at protocol versions 1 and 13: v0's charged refusal is unchanged.

Other tests:

Strategy test identity_create_proposal_tests::should_reject_a_proposal_holding_an_identity_create_whose_identity_id_does_not_match_its_asset_lock. Through the ABCI handler on a test chain, process_proposal rejects a proposed block that holds such a transition. Its control proposal, which carries the derived identity id, is accepted.
check_tx::v0::tests::identity_can_create_with_semi_used_outpoint used to build its paid partial use from an empty master key signature, which is unpaid from protocol version 14. It now uses an identity without a master key, a key structure failure that is still paid.
The unit tests of requires_advanced_structure_validation_with_state_on_check_tx now include IdentityCreate.

Red → green:

Consensus commit: with advanced structure v1 routed to v0, the three unpaid tests and the strategy test fail; process_proposal returns Accept. With v1 they pass. The two charge tests pass both ways, by design.
check_tx commit, with its check_tx and predicate changes reverted: the four check_tx tests and the predicate unit test fail, because check_tx admits the faulty transition at protocol version 1.
check_tx commit, with only the early identity id check reverted: the identity id test fails, because once the asset lock is spent check_tx reports IdentityAssetLockTransactionOutPointAlreadyConsumedError instead of the identity id.
check_tx commit, with the advanced-structure action dropped again: should_verify_the_asset_lock_once_at_check_tx fails, because Core is asked for the transaction twice.

Runs, on this branch rebased on 5.0.0-rc.2:

cargo test -p drive-abci --lib -- check_tx asset_lock identity_create: 496 passed. 1 ignored: verify_check_tx_on_data_contract_create, which is already ignored on v5.0-dev.
RUST_MIN_STACK=4194304 cargo test -p drive-abci --test strategy_tests -- identit top_up: 37 passed.
cargo clippy -p drive-abci --all-targets --all-features --locked -- --no-deps -D warnings: clean.
cargo fmt --all -- --check: clean.

Breaking Changes

From protocol version 14, a block refuses without a fee an IdentityCreate whose identity id is not the one its asset lock derives, or whose key proof of possession fails. Before, it charged the asset lock. Consensus at protocol versions 1–13 is unchanged.
At every protocol version, check_tx now refuses such a transition, and also one with a key structure failure. Before, it admitted them.

Checklist:

I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have added or updated relevant unit/integration/functional/e2e tests
I have added "!" to the title and described breaking changes in the corresponding section if my code contains any
I have made corresponding changes to the documentation if needed
If I added or changed GroveDB structure, I described it in the area's structure.rs, regenerated grovedb-structure.json, and checked the structure viewer link posted on this pull request

For repository code-owners and collaborators only

I have assigned this pull request to a milestone

🤖 Generated with Claude Code

Summary by CodeRabbit

New Features
- Identity creation is checked during transaction submission at every protocol version, including verifying that the identity ID matches the asset-lock outpoint. Identity creation from addresses is also checked at submission.
Bug Fixes
- Blocks containing identity-creation transitions with invalid identity IDs or failed key proofs are rejected. From protocol version 14, these failures are unpaid and leave the asset lock unchanged; earlier versions retain paid-failure behavior. Key-structure failures remain charged.

PR Hygiene · `e897147`

Bots — coderabbitai not yet · thepastaclaw not yet — /skip-bots proceeds without the ones not yet reported
Self-review — post /self-reviewed
Build running
Approvals — you own every area touched; none needed

When every merge requirement is met, the PR Hygiene check passes. Reviewer limits do not block merging; other required GitHub checks and protections still apply.

…lures unpaid (PV14) An IdentityCreate's asset lock signature covers the transition's signable bytes, which leave out the identity id and every key's proof-of-possession signature. identity_create advanced_structure v0 nonetheless charged the asset lock a penalty (a PartiallyUseAssetLockAction recording the signable bytes as used) for an identity id the asset lock does not derive and for a failed proof of possession, so a transition carrying a wrong value in one of those fields consumed part of the lock and left the correctly signed transition a replay. identity_create advanced_structure v1, selected only by DRIVE_ABCI_VALIDATION_VERSIONS_V10 (protocol version 14), refuses both failures unpaid: no action, no penalty, no used tag, the asset lock is left as it was. A proof-of-possession failure includes a signature on a hash-type key. Key structure failures stay paid, since the asset lock signature covers the keys. Protocol versions 1-13 keep v0, so their history replays unchanged. Protocol version 14 is neither in a stable release nor activated on testnet or mainnet, so its table is amended in place; no shipped generation is edited. The check_tx test identity_can_create_with_semi_used_outpoint built its paid partial use from an empty master key signature, which is now unpaid at the latest version; it now uses an identity without a master key (a key structure failure, still paid) and replays those same signed bytes. Tests would have caught this in CI (red with PV14's table on advanced_structure v0, green with v1): - should_refuse_unpaid_an_identity_create_whose_identity_id_does_not_match_its_asset_lock ✖ → ✔ - should_refuse_unpaid_an_identity_create_with_an_invalid_key_proof_of_possession ✖ → ✔ - should_refuse_unpaid_an_identity_create_with_a_signature_on_a_hash_key ✖ → ✔ - strategy should_reject_a_proposal_holding_an_identity_create_whose_identity_id_does_not_match_its_asset_lock ✖ (Accept) → ✔ (Reject); its control, the same proposal with the derived identity id, is accepted Guards, green before and after by design: - should_charge_the_asset_lock_for_an_identity_id_or_key_proof_fault_before_protocol_version_14 (PV1, PV13) - should_charge_the_asset_lock_for_an_identity_create_with_an_invalid_key_structure (latest) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ures at check_tx An IdentityCreate's identity id and each key's proof-of-possession signature are left out of the signable bytes the asset lock key signs, so a transition whose only fault is in one of them must not enter the mempool. check_tx did not run IdentityCreate's advanced structure validation, so it admitted such a transition. check_tx now: - checks, right after basic structure and before the asset lock proof is verified, that the identity id is the one the asset lock's outpoint derives. The id is also the transition's mempool sender, so a transition can only take the sender of the identity its own asset lock creates. A wrong id is refused in about 6 µs, where it used to be admitted after the ~0.6 ms instant lock check. - runs IdentityCreate's advanced structure validation (identity id, key structure, every key's proof of possession), as it already does for IdentityCreateFromAddresses and MasternodeVote. - keeps the action it built for advanced structure validation when it does not validate state, instead of transforming the transition a second time. That second transform verified an asset lock proof twice (the instant lock signature, or Core's copy of a chain-locked transaction) and counted its operations twice in the fee estimate. Batch and IdentityCreateFromAddresses, already on the list, were transformed twice too and now are not. Admission is not consensus, so every protocol version gets this; block execution is unchanged. Measured New check_tx cost (release build, instant lock verification included): a valid transition with one ECDSA key 0.68 -> 0.74 ms; the worst case, six BLS keys, about 4.6 ms, which matches what IdentityCreateFromAddresses already costs at check_tx. Recheck is unchanged at about 7 µs. Tests would have caught this in CI (red with this commit's check_tx and predicate changes reverted, where check_tx admitted the faulty transition at protocol version 1; green with them): - should_refuse_at_check_tx_an_identity_create_whose_identity_id_does_not_match_its_asset_lock ✖ → ✔ - should_refuse_at_check_tx_an_identity_create_with_an_invalid_key_proof_of_possession ✖ → ✔ - should_refuse_at_check_tx_an_identity_create_with_a_signature_on_a_hash_key ✖ → ✔ - should_refuse_at_check_tx_an_identity_create_with_an_invalid_key_structure ✖ → ✔ - requires_advanced_structure_validation_with_state_on_check_tx::should_return_true_only_for_batch_identity_creates_and_masternode_vote ✖ → ✔ - should_verify_the_asset_lock_once_at_check_tx ✖ → ✔ (with the action dropped again, Core is asked for the chain-locked transaction twice) With only the early identity id check reverted, the identity id test still fails: once the asset lock is spent, check_tx reports IdentityAssetLockTransactionOutPointAlreadyConsumedError instead of the identity id. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

coderabbitai · 2026-10-14T10:54:42Z

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: dashpay/platform/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: b5667910-099b-445f-b9c8-279d0da1797d

📥 Commits

Reviewing files that changed from the base of the PR and between afb322c and e897147.

📒 Files selected for processing: 5

packages/rs-drive-abci/src/execution/validation/state_transition/check_tx_verification/v0/mod.rs
packages/rs-drive-abci/src/execution/validation/state_transition/processor/traits/advanced_structure_with_state.rs
packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create/advanced_structure/v1/mod.rs
packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create/mod.rs
packages/rs-platform-version/src/version/v14.rs

+--------------------------------------------+
| Let's git serious about your code quality. |
+--------------------------------------------+
  \
   \     /)/)
        ( '')
        /  |
      o(___)

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: dashpay/platform/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: e271a277-681e-45f7-9a53-7cbf7918e1fa

📥 Commits

Reviewing files that changed from the base of the PR and between bcbf05c and afb322c.

📒 Files selected for processing: 11

book/src/state-transitions/validation-pipeline.md
packages/rs-drive-abci/src/execution/check_tx/v0/mod.rs
packages/rs-drive-abci/src/execution/validation/state_transition/check_tx_verification/v0/mod.rs
packages/rs-drive-abci/src/execution/validation/state_transition/processor/traits/advanced_structure_with_state.rs
packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create/advanced_structure/mod.rs
packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create/advanced_structure/v1/mod.rs
packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create/mod.rs
packages/rs-drive-abci/tests/strategy_tests/test_cases/identity_create_proposal_tests.rs
packages/rs-drive-abci/tests/strategy_tests/test_cases/mod.rs
packages/rs-platform-version/src/version/drive_abci_versions/drive_abci_validation_versions/v10.rs
packages/rs-platform-version/src/version/v14.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

IdentityCreate validation now checks the asset-lock-derived identity ID, key structure, and signatures. CheckTx runs advanced-structure validation for these transitions. Tests cover protocol-version differences in failure charges, asset-lock use, replay, and proposal acceptance.

Changes: IdentityCreate validation

Layer / File(s)	Summary
Versioned advanced-structure validation `packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create/...`, `packages/rs-platform-version/src/version/...`	Version 1 checks the identity ID derived from the asset-lock proof, validates key structure, and checks signatures. The validation version changes to 1, and version notes describe unpaid identity-ID and proof-of-possession failures while key-structure failures remain charged.
CheckTx admission and validation wiring `packages/rs-drive-abci/src/execution/validation/state_transition/check_tx_verification/v0/mod.rs`, `packages/rs-drive-abci/src/execution/validation/state_transition/processor/traits/advanced_structure_with_state.rs`, `book/src/state-transitions/validation-pipeline.md`	CheckTx checks the derived identity ID before asset-lock proof verification and runs advanced-structure validation for IdentityCreate. When state validation is skipped, it preserves the action already built. The documentation describes these checks and their stated outcomes.
Validation and proposal tests `packages/rs-drive-abci/src/execution/validation/state_transition/state_transitions/identity_create/mod.rs`, `packages/rs-drive-abci/src/execution/check_tx/v0/mod.rs`, `packages/rs-drive-abci/tests/strategy_tests/test_cases/*`	Tests cover CheckTx rejection, unpaid failures and unchanged asset locks at the latest version, paid failures at versions 1 and 13, replay behavior, and proposal acceptance or rejection based on the identity ID.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Suggested reviewers: quantumexplorer

Merge Risk: ⚪ Minimal · up to afb32

At protocol version 14, IdentityCreate now refuses identity ID mismatches and failed key proofs without charging the asset lock. Mempool admission checks these failures earlier at every protocol version. Behavior before version 14 is unchanged. The review found no concrete defect, and the changes appear ready to merge.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 72.97% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 37 functions across 10 files. (1 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: refusing IdentityCreate identity ID and key proof failures before asset-lock consumption.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 72.97% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 37 functions across 10 files. (1 skipped: 1 unsupported.)

Fix all pre-merge checks with AI

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

thepastaclaw · 2026-10-14T10:57:48Z

🕓 Review not started yet because the new head is waiting for the 30-minute push debounce.

Request normal review — click when the PR is ready for review.
Request priority review — click to move this review to the front of the queue.

Commit e897147. Normal review starts when eligible; priority review starts as soon as a slot is available.

thepastaclaw

Final validation — Phase 1 + Phase 2

No actionable in-scope issues were found. The new validator confines unpaid identity-ID and proof-of-possession failures to protocol version 14 while preserving historical paid failures; check_tx hardening remains admission-only, and regression tests cover asset-lock preservation, legacy behavior, single-transform reuse, and proposal rejection. Verification was static only: no builds or tests were run locally, and the supplied CI snapshot still showed build/test prerequisites queued or pending.

Review provenance

Source: reviewer 1: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 2: gpt-6.1-sol (agent: phase2-reviewer, role: architecture-layering); reviewer 3: gpt-6.1-sol (agent: phase2-reviewer, role: platform-versioning); reviewer 4: gpt-6.1-sol (agent: phase2-reviewer, role: rust-quality); reviewer 5: gpt-6.1-sol (agent: phase2-reviewer, role: security-auditor); reviewer 6: muse-spark-1.3-contributor (agent: phase1-reviewer, role: general); reviewer 7: muse-spark-1.3-contributor (agent: phase1-reviewer, role: rust-quality); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

Triage: critical by gpt-6.1-sol (effort low) — This is a large, intricate diff that changes consensus validation, asset-lock fee consumption, identity authorization, and proof-of-possession signature handling in the IdentityCreate advanced-structure validation and check_tx pipeline.
Phase 1 reviewers: muse-spark-1.3-contributor — general (completed, effort xhigh); agent phase1-reviewer, muse-spark-1.3-contributor — rust-quality (completed, effort xhigh); agent phase1-reviewer
Phase 1 model: muse-spark-1.3-contributor — not quota-gated; passed over gemini-3.8-flash-high (antigravity below 15% reserve: weekly 14% left, 5h 100% left), glm-5.3-flash (not used above high effort; tier asks max)
Single stage: Phase 1 and Phase 2 reviewed this head side by side, with no blocker gate between them (triage tier)
Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
Phase 2 reviewers: gpt-6.1-sol — general (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — architecture-layering (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — platform-versioning (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — rust-quality (completed, effort xhigh); agent phase2-reviewer, gpt-6.1-sol — security-auditor (completed, effort xhigh); agent phase2-reviewer

github-actions · 2026-10-14T11:56:30Z

📖 Book Preview built successfully.

Download the preview from the workflow artifacts.
To view locally: download the artifact, unzip, and open index.html.

Updated at 2026-10-15T10:01:08.418Z

github-actions · 2026-10-14T11:58:59Z

Bots are done — your move: post /self-reviewed.
Full checklist in the description.

check_tx kept the action it built for advanced structure validation for every transition whose state it does not validate, instead of transforming the transition a second time. That avoided verifying an IdentityCreate's asset lock twice, but it also changed check_tx for Batch: at protocol versions 12 to 14 its fee estimate no longer counted the transform's operations twice, so check_tx admitted some unsponsored batches it refused before. Only an IdentityCreate keeps its action now; every other transition is transformed at check_tx exactly as before this change set. check_tx decides mempool admission only, so this is inert for consensus at every protocol version; the comment at the edit says so. The comments on the identity id check, on the list of transitions check_tx validates the advanced structure of, and on identity create advanced structure v1 now state the rule and why it holds. Tests: should_verify_the_asset_lock_once_at_check_tx still pins that an IdentityCreate's asset lock is verified once. No test is added for Batch: this restores the code path the suite already ran before this change set, and a test of the old fee estimate would pin a double count rather than an intended behaviour. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The comment on the protocol versions the IdentityCreate check_tx tests run at claimed versions 1 to 13 validate an identity create the same way; protocol version 11 raises its minimum asset lock balance and 14 also changes its state validation. The v14.rs summary claimed that, without the ranked or time-range grammar, everything but four fixes matched protocol version 13; the table changes listed below it, identity creation's among them, apply regardless. Comment-only change, no behaviour change, so no test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…reate advanced structure v1 The v1 doc said every failure it refuses unpaid is in a field the asset lock signature does not cover. A key whose data does not parse also fails its proof of possession check and is refused unpaid like any other proof failure, although its data is signed: only the holder of the asset lock key can sign such data, and check_tx refuses it. The doc now says so. Comment-only change, no behaviour change, so no test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions · 2026-10-15T10:01:10Z

Waiting for bot review — coderabbitai not yet · thepastaclaw not yet. Wait for the missing reviews, or a writer can post /skip-bots to proceed without them; blocking findings still need addressing.
Full checklist in the description.

shumkov and others added 2 commits October 14, 2026 17:53

shumkov added this to the v5.0.0 milestone Oct 14, 2026

thepastaclaw approved these changes Oct 14, 2026

View reviewed changes

github-actions Bot added the waiting-self-review Waiting for the author to post /self-reviewed label Oct 14, 2026

shumkov and others added 3 commits October 15, 2026 15:45

github-actions Bot added waiting-bots Waiting for the review bots to report on this head and removed waiting-self-review Waiting for the author to post /self-reviewed labels Oct 15, 2026

shumkov merged commit dece503 into v5.0-dev Oct 15, 2026
22 of 24 checks passed

shumkov deleted the fix/identity-create-refuse-unsigned-field-failures-unpaid branch October 15, 2026 10:05

shumkov mentioned this pull request Oct 15, 2026

chore(drive-abci): IdentityCreate validation follow-ups from #5431 #5442

Open

Navigation Menu

Repository navigation

fix(drive-abci)!: refuse IdentityCreate identity id and key proof failures before they consume the asset lock - #5431

fix(drive-abci)!: refuse IdentityCreate identity id and key proof failures before they consume the asset lock#5431
shumkov merged 5 commits into
v5.0-devfrom
fix/identity-create-refuse-unsigned-field-failures-unpaid

shumkov commented Oct 14, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 14, 2026 •

edited

Loading

Uh oh!

thepastaclaw commented Oct 14, 2026 •

edited

Loading

Uh oh!

thepastaclaw left a comment

Uh oh!

github-actions Bot commented Oct 14, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 14, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

shumkov commented Oct 14, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue being fixed or feature implemented

What was done?

check_tx cost

In-place changes to shipped generations

How Has This Been Tested?

Breaking Changes

Checklist:

Summary by CodeRabbit

PR Hygiene · e897147

Uh oh!

coderabbitai Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thepastaclaw commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thepastaclaw left a comment

Choose a reason for hiding this comment

Final validation — Phase 1 + Phase 2

Uh oh!

github-actions Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

shumkov commented Oct 14, 2026 •

edited by coderabbitai Bot

Loading

PR Hygiene · `e897147`

coderabbitai Bot commented Oct 14, 2026 •

edited

Loading

thepastaclaw commented Oct 14, 2026 •

edited

Loading

github-actions Bot commented Oct 14, 2026 •

edited

Loading

github-actions Bot commented Oct 14, 2026 •

edited

Loading

github-actions Bot commented Oct 15, 2026 •

edited

Loading