From aded63ecc06f2790c9461a286123739cc6b29e05 Mon Sep 17 00:00:00 2001 From: quake Date: Tue, 29 Sep 2026 10:47:34 +0900 Subject: [PATCH 1/2] fix(commitment-lock): reject type script on CKB successor --- contracts/commitment-lock/src/main.rs | 5 ++++ tests/src/tests.rs | 39 ++++++++++++++++++++++++++- 2 files changed, 43 insertions(+), 1 deletion(-) diff --git a/contracts/commitment-lock/src/main.rs b/contracts/commitment-lock/src/main.rs index 0640dce..e8d3aa3 100644 --- a/contracts/commitment-lock/src/main.rs +++ b/contracts/commitment-lock/src/main.rs @@ -550,6 +550,11 @@ fn auth() -> Result<(), Error> { } } None => { + // A CKB successor must not acquire a type script. + if load_cell_type(0, Source::Output)?.is_some() { + return Err(Error::OutputTypeError); + } + // verify the first output cell's capacity is correct let output_capacity = load_cell_capacity(0, Source::Output)? as u128; if output_capacity != new_amount { diff --git a/tests/src/tests.rs b/tests/src/tests.rs index 55605a8..b419dc4 100644 --- a/tests/src/tests.rs +++ b/tests/src/tests.rs @@ -436,7 +436,7 @@ fn test_commitment_lock_no_pending_htlcs() { .build(); let auth_dep = CellDep::new_builder().out_point(auth_out_point).build(); let always_success_dep = CellDep::new_builder() - .out_point(always_success_out_point) + .out_point(always_success_out_point.clone()) .build(); let cell_deps = vec![commitment_lock_dep, auth_dep, always_success_dep].pack(); @@ -595,6 +595,43 @@ fn test_commitment_lock_no_pending_htlcs() { .expect("pass verification"); println!("consume cycles: {}", cycles); + // A CKB successor must not gain an unexpected type script. + let unexpected_type = context + .build_script(&always_success_out_point, Bytes::new()) + .expect("type script"); + let typed_output = outputs[0] + .clone() + .as_builder() + .type_(Some(unexpected_type).pack()) + .build(); + let typed_tx = tx + .as_advanced_builder() + .set_outputs(vec![typed_output]) + .build(); + let typed_signature = local_settlement_key + .0 + .sign_recoverable(&compute_tx_message(&typed_tx).into()) + .unwrap() + .serialize(); + let typed_witness = [ + EMPTY_WITNESS_ARGS.to_vec(), + vec![0x01], + settlement_script.clone(), + vec![0xFF, 0x00], + typed_signature, + ] + .concat(); + let typed_tx = typed_tx + .as_advanced_builder() + .witness(typed_witness.pack()) + .build(); + assert_script_error_code( + &context, + &typed_tx, + 20, + "CKB successor with unexpected type script", + ); + // test with settlement unlock logic (remote settlement key) let input_out_point = context.create_cell(outputs[0].clone(), Bytes::new()); From bd5feee481c58d0f826a3d5d0ce9b1a0936bf2c5 Mon Sep 17 00:00:00 2001 From: quake Date: Tue, 29 Sep 2026 10:54:27 +0900 Subject: [PATCH 2/2] chore: update commitment-lock checksums --- checksums.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/checksums.txt b/checksums.txt index 34febc9..075af14 100644 --- a/checksums.txt +++ b/checksums.txt @@ -1,4 +1,4 @@ -a7762721ef239b15adbdddca8d772db6e1c001d9f81e23ccc74e1392329931d7 build/release/commitment-lock -ecf31c4c024d5f7339f56e19f0e7c2bdce6188b6c069752faefa5313f7ae534d build/release/commitment-lock.debug +cd44265503d53937865cae53a4e8e3ff8800aed667806d630c3f4cb4f65b9772 build/release/commitment-lock +1a962b0db2d899a7d9159305f3b505dc887a8c38a13a1db4bf054a79f6c22fc5 build/release/commitment-lock.debug 831f164aad1509db5483dd50c50bf4ed5cb6601f941600287ffdb5e79a29cf9e build/release/funding-lock 291bdd4a48783ce75012a6e21935090806014d33bf6c52b1b2374e8feeaa91f0 build/release/funding-lock.debug