[API-699] feat(polymer): Solana -> EVM proof path - #127
Open
reednaa wants to merge 3 commits into
Open
Conversation
Adds receiveSolanaMessage backed by ICrossL2ProverV2.validateSolLogs so fills and non-fills executed on Solana can be attested on EVM via Polymer. Trust model: the remote-oracle identity is taken from Polymer's authenticated returnedProgramId, never from log content, so attestations self-namespace under the emitting program id (honest orders set output.oracle to the trusted Solana program id). Only the trailing base64 field of the "program: <id>, <blob>" log is decoded; blob layout is application(32) || payload. Requires the paired catalyst-intent-svm change (submit emits source||payload, oracle identified by program id) to be deployed together. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- PolymerOracle: correct stale SVM-envelope comment to base64(source||payload); make Solana constants `internal constant`, prover `internal immutable`; use revert-style errors and ++i in the log loop - MockCrossL2ProverV2: centralize proof offsets into named constants and replace require-strings with custom errors - tests: golden-fixture cases for receiveSolanaMessage (base + mapped) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…gramId
Addresses review findings on the Solana proof path:
- Finding 1 (critical): the oracle discarded each log's `program: <id>` prefix and
keyed attestations solely on `returnedProgramId`, never binding the two. Per
Polymer's Solana proof-validation guidance the returned program id MUST equal the
id embedded in every log. Add an on-chain Base58 encoder and require each log to
begin with exactly `"program: " + base58(returnedProgramId) + ", "`, reverting
SolanaProgramIdMismatch otherwise. Prefix is computed once per proof (invariant),
not per log, so multi-log proofs stay within gas limits.
- Finding 3 (low): reject empty payloads (blob length <= 32) instead of attesting
over keccak256("").
- Finding 2 (tests): mock renders the log prefix in base58 (matching the enforced
check); add negative tests asserting a program-id mismatch reverts in both
directions, an empty-payload revert, and Base58 encoder unit tests (golden vector
+ leading-zero rule). A captured real Polymer proof fixture remains a follow-up.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a Solana → EVM proof path to
PolymerOracle— Linear API-699: Provable Non-Fill Refunds.New
receiveSolanaMessage, backed byICrossL2ProverV2.validateSolLogs, lets fills and non-fills executed on Solana be attested on EVM via Polymer, so the non-fill refund flow (and regular fill finalisation) works for Solana output chains.Trust model
returnedProgramId, never from log content. Attestations self-namespace under the emitting program id; honest orders setoutput.oracleto the trusted Solana program id."program: " + base58(returnedProgramId) + ", ", enforced via a new on-chainBase58encoder; any mismatch revertsSolanaProgramIdMismatch. The prefix is computed once per proof (invariant across logs), so multi-log proofs stay within gas limits."program: <id>, <blob>"log is decoded; blob layout isapplication(32) || payload. Empty payloads (blob ≤ 32 bytes) are rejected rather than attesting overkeccak256("").Deployment coupling
Requires the paired
catalyst-intent-svmchange (submit emitssource || payload, oracle identified by program id) to be deployed together.Testing
Golden-fixture cases for
receiveSolanaMessageon both the base and mapped oracles, program-id-mismatch reverts in both directions, empty-payload revert, Base58 encoder unit tests (golden vectors + leading-zero rule), and an extendedMockCrossL2ProverV2that renders the log prefix in base58 to match the enforced check. A captured real Polymer proof fixture remains a follow-up.Stacked PRs
This is PR 2 of 2, stacked on #126 (
feature/api-699-provable-non-fill-refunds). It will retarget tomainautomatically when #126 merges.🤖 Generated with Claude Code