fix(soroban): bind attestation digest to the host network (FIND-001)

[alex-predicate]

Audit finding FIND-001 — Attestation digest is not bound to the host chain or registry instance (Low).

The problem

compute_hash took the domain separator as a parameter:

pub fn compute_hash(e: &Env, statement: &Statement, network: &String) -> BytesN<32> {
    payload.append(&network.clone().to_xdr(e));   // caller-supplied
    payload.append(&statement.clone().to_xdr(e));
    ...

Whoever called hash_statement / validate_attestation chose the domain the attester's signature was verified against. The digest was not bound to the chain executing the contract, so one valid signature could pass in domains the attester never bound. This does not let anyone forge signatures — a registered attester's signature and caller.require_auth() are still required.

The EVM registry has never had this hole: hashStatementWithExpiry and hashStatementSafe both mix in block.chainid (src/PredicateRegistry.sol:187,213). This brings Soroban to parity.

The fix

Read the domain from the host:

sha256( XDR(ScVal::Bytes(ledger.network_id)) ++ XDR(statement) )

network_id is sha256(network_passphrase). It is no longer a parameter, so there is nothing for a caller to choose. (e.ledger().network_passphrase() does not exist in soroban-sdk 23.5.3, as the audit notes — network_id() at ledger.rs:102 is the available primitive.)

Two deliberate deviations from the recommended remediation

1. No version tag. The audit suggested adding "PredicateRegistry:v1". XDR already makes layouts unconfusable, so a tag would only restate what the encoding guarantees:

	first 4 bytes
old preimage	0000000e	ScVal::String (passphrase)
new preimage	0000000d	ScVal::Bytes (network_id)

Nothing signed for the old layout validates under the new one, or vice versa, without a tag saying so. The same holds for future changes: a statement is an ScVal::Map (00000011) and an address an ScVal::Address (00000012), so appending or reordering fields cannot yield a byte string valid under two layouts. Cross-chain replay against Solana's ed25519 digests would require a hash collision, not domain separation — Solana's own tag earns its place because its digest is raw byte concatenation with no type information, which XDR is not. Set against zero security benefit, a tag is one more constant that two codebases must keep byte-identical forever.

2. No registry address. Also recommended, also omitted:

• Cross-instance replay is already constrained. validate substitutes the caller for statement.target, so exploiting it needs one integrating contract wired to two registries of the same preimage layout.
• It would push a new requirement onto every attester. The API builds this digest locally from the chain id alone (predicate-avs → stmapiv2/internal/domain/types.go, stellarDigestBytes); Task carries no registry field. Adding the address means new config plumbing to protect a configuration we do not run.
• No other chain binds it. EVM includes no address(this) and no EIP-712 domain separator; Solana's digest binds neither program id nor chain id.
• Only one registry per network is deployed, and v1 is deprecated.

compute_hash documents both decisions and the trigger to revisit the address.

Breaking changes

The redundant network parameter is gone throughout:

• hash_statement(statement) — was (statement, network)
• validate_attestation(statement, attestation, caller) — was (statement, attestation, network, caller)
• predicate_client::authorize_transaction drops network
• example-compliant-token: the network constructor arg and its NETWORK instance-storage entry are removed (dead once the registry derives the network itself)
• deploy-compliant-token.sh: drops the constructor's network argument

Rollout — requires coordination

1. The registry upgrade and the API signing change must ship together. There is no version negotiation; attestations signed under the old layout stop validating the moment the registry is upgraded.
2. API change in stellarDigestBytes — one line. Replace the passphrase ScVal with the network id; nothing is prepended:

   netID := sha256.Sum256([]byte(networkPassphrase))
   netIDXDR, err := stellarBytesScVal(netID[:]).MarshalBinary()
   // payload = netIDXDR ++ statementXDR

   stellarStatementScVal and its map ordering are untouched — the golden-vector test just needs its expected digest regenerated.
3. The example tokens must be redeployed, not re-pointed — REGISTRY is constructor-only with no setter, and the constructor signature changed. That is also the moment nothing references the deprecated v1 registry anymore.

Tests

46 pass; cargo fmt --check clean; cargo doc warning-free; both wasm32-unknown-unknown and wasm32v1-none build.

Two new cases pin the network binding — the digest changes under set_network_id, and an attestation signed on one network is rejected on another. Both were verified to fail when the network_id line is removed, so they are not vacuous.

Signature-rejection tests now assert on Error(Crypto, InvalidInput) instead of a bare #[should_panic]. A bare one also swallows assertion failures — the first draft of these tests passed against the unfixed code for exactly that reason.

🤖 Generated with Claude Code

[douglasmakey]

The new test looks good, and with that, at least we have an extra precaution. Can we make CI run Clippy and enforce it? That would be nice.