[heifner]

Summary

Closes the open items of WIRE-413 (CertiK WNS-63). The finding, audited at 697c35a986, is already fixed on master:

• ef4bc92048 (WIRE-352: sweep linked rewards into dclaim #594, WIRE-352): createlink and recordlink send sysio.dclaim::linkswept with the native address (EVM: the last 20 bytes of keccak256 of the recovered key; SVM: the 32-byte key). createlink refuses to link until sysio.dclaim is deployed and privileged.
• f3a887e0dd (WIRE-339/WIRE-353: keep all four claim ledgers claimable indefinitely #639, WIRE-339/353): DClaim balances never expire; flushexpired is gone.
• 9e7bb2e0b2 (Retire reward and reserve creation carriers #670): onreward is retired, so importseed is the only writer of unmapped.

The code grant CertiK recommends is not needed: sysio.authex deploys privileged through setsyscode, and privileged contracts skip inline authorization.

This PR closes the gaps those changes left:

• The SVM createlink sweep had no unit test; only EVM createlink and SVM recordlink did.
• A link sweeps once, and createlink does not check that the DClaim import is sealed. docs/contract-upgrade-order.md now orders the fresh-deployment import before the first link: fund sysio.dclaim, push every importseed batch, reconcile the unmapped rows against the export, then importdone. The cluster bootstrap's LCO import runs these steps; wire-tools-ts#151 adds the reconcile before the seal.
• linkswept moves the unmapped row matching the supplied chain and address without consulting the link, so recovering a credit imported after its key was linked is governance's, through sysio.msig as sysio.authex@active. The link row keeps only the public key, so governance derives the native address from it (SVM: the raw ED key; EVM: the 20-byte address of the EM key) and checks the link and the exact unmapped row before proposing linkswept or replaying recordlink. The recordlink table row and the authex comments now say governance too.
• contracts/sysio.dclaim/tools/convert_import.py is removed. It emitted CHAIN_KIND_ETHEREUM / CHAIN_KIND_SOLANA, which the DClaim ABI rejects (it takes CHAIN_KIND_EVM / CHAIN_KIND_SVM), scaled Solana pretokens as 9-decimal (they are 8), and produced an empty import from the current Solana export. The LCO import in wire-tools-ts replaced it.

Letting an identical createlink re-send the sweep is not needed: importdone seals the only writer of unmapped, so no credit can arrive behind a link once the bootstrap import is done.

Tests

• createlink_svm_sweeps_prelink_dclaim_rewards: imports a credit for the linking ED key and one for an address with the same first 8 bytes, links, and checks that only the first moves to pclaims. It fails against the audited sysio.authex.wasm, whose createlink sends no sweep.

contracts_unit_test -- --sys-vm passes 922/922 with master merged in. Import, link and claim run end to end in flow-lco-import (wire-tools-ts#151).

[huangminghuang]

High — make this prerequisite executable and fail closed. The numbered rollout below skips funding, importing, reconciliation, and sealing and proceeds directly from DClaim deployment to AuthX deployment and link smoke tests. The only converter shipped in this repository cannot safely fill that gap: it emits CHAIN_KIND_ETHEREUM / CHAIN_KIND_SOLANA while the DClaim ABI accepts CHAIN_KIND_EVM / CHAIN_KIND_SVM, and it treats absent purchasers / stakers arrays as an empty import. Running it against the current Solana frozen-export shape used by Wire-Network/wire-tools-ts#151 exits successfully with [] and zero credits. If importdone then seals that result, later importseed calls revert and the omitted credits remain stranded absent a migration. Please update and fixture-test the converter and add explicit fund/import/reconcile/seal steps before links, or explicitly block rollout on a landed and current-head-validated wire-tools-ts#151.

[heifner]

Agreed on the converter — removed in bb79c42. It emitted CHAIN_KIND_ETHEREUM/CHAIN_KIND_SOLANA, scaled Solana pretokens as 9-decimal, and returned an empty import for the current Solana export. The numbered WIRE-352 steps are the upgrade procedure for a chain already running pre-#594 contracts; launch is a fresh deployment, which the paragraph now covers: fund → importseed → reconcile → importdone before the first link. The cluster bootstrap's LCO import performs it, and launch depends on wire-tools-ts#151: its new reconcile-lco-claims step (74436eb2) checks sysio.dclaim::unmapped against the plan and stops before importdone on any missing, extra or wrong row.

[huangminghuang]

Medium/security — reserve this recovery for governance. sysio.dclaim::linkswept requires sysio.authex authorization but does not verify that the supplied Wire account matches the AuthX link; it moves the full matching unmapped balance to the supplied account. An ordinary operator cannot authorize this action, while delegating sysio.authex@active would let that delegate redirect parked credits. For a trusted recordlink, use the identical replay path already documented above. For other stragglers, please state that governance / sysio.msig submits linkswept as sysio.authex@active, with the tuple derived and reconciled against the existing AuthX link.

[heifner]

Agreed — reworded in bb79c42: governance submits linkswept as sysio.authex@active through sysio.msig, with the account, chain and address of the existing link; a node-owner link can instead replay its identical recordlink. The recordlink table row and the authex comments now say governance too.

[huangminghuang]

[P2] Derive and verify the address before recovery

The links row cannot supply this address: links_s stores only username, chain_kind, and pub_key. Since dclaim::linkswept looks up the caller-supplied (chain, address) and credits the caller-supplied account without consulting AuthX, a proposal built with the wrong 20/32 bytes can move a parked credit belonging to another holder into this account. Please spell out reconstruction from the stored key (SVM: raw ED bytes; EVM: the canonical 20-byte address derived from the stored EM key) and require governance to verify the link tuple and exact target unmapped row before proposing linkswept or replaying recordlink; the link row does not retain the original native address.

[heifner]

Agreed — the link row keeps only the public key. Reworded in 2a36e12: governance derives the address from the stored key (SVM: the raw 32-byte ED key; EVM: the canonical 20-byte address of the stored EM key, the last 20 bytes of keccak256 of its uncompressed form) and checks the link and the exact target unmapped row before proposing linkswept or replaying recordlink.

[huangminghuang]

[P2] Exclude the SEC1 prefix from the EVM hash

In this tree an uncompressed EM key is the 65-byte SEC1 serialization 0x04 || X || Y, but both evm_address_from_uncompressed_key and fc::crypto::ethereum::to_address deliberately hash only the 64-byte X || Y payload. Following “keccak256 of its uncompressed form” literally and hashing all 65 bytes yields a different address, so this recovery will not find the intended unmapped row. Please specify “the trailing 20 bytes of keccak256(X || Y), excluding the leading SEC1 0x04,” or require a standard EVM-address helper.

[heifner]

Agreed — fixed in 2944e90: the doc now specifies the trailing 20 bytes of keccak256(X || Y) over the 64-byte coordinates, without the leading SEC1 0x04, and names opp::evm_address_from_uncompressed_key.

[huangminghuang]

Re-reviewed current head 2944e90. All prior findings are resolved, including the fail-closed import sequence, governance-only recovery, native-address reconstruction, and explicit EVM keccak256(X || Y) derivation excluding the SEC1 prefix. The full diff and current-master merge are clean; retained local Clang/JIT validation and the companion current-head LCO E2E are applicable. No actionable findings.