Fix NewPSMT fabricated register reads via non-inclusion proof payload injection

[zhangchiqing]

NewPSMT conditioned leaf hash computation on pr.Inclusion, which is attacker-controlled. A byzantine EN could supply a ChunkDataPack.Proof with a fabricated payload on a non-inclusion proof (or a duplicate proof for an already-proven path), causing the fabricated value to pass the root check and be served as authentic state by GetSinglePayload/Get.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Bug Fixes

  • Strengthened proof validation to reject fabricated or tampered payloads, including non-inclusion and duplicate-path cases.
  • Ensured invalid proofs fail root-hash verification instead of being treated as authentic state.
  • Preserved validation of legitimate proofs.

• Tests

  • Added comprehensive regression coverage for serialized and decoded proofs across inclusion, non-inclusion, and duplicate-path scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 83b0c5b4-667d-49a4-b77e-3d61bbfd20f0

📥 Commits

Reviewing files that changed from the base of the PR and between dd885b2 and c6bc35d.

📒 Files selected for processing (2)

• ledger/partial/ptrie/partialTrie.go
• ledger/partial/ptrie/partialTrie_test.go

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

NewPSMT now hashes proof payloads unconditionally. New tests confirm valid proofs remain accepted and fabricated payloads are rejected for non-inclusion, duplicate-path, and inclusion cases.

Changes

PSMT payload validation

Layer / File(s)	Summary
Unconditional proof payload hashing ledger/partial/ptrie/partialTrie.go	NewPSMT computes the node hash from every proof payload, including non-inclusion proofs and duplicate-path overwrites.
Proof validation regression coverage ledger/partial/ptrie/partialTrie_test.go	Adds fixtures, cloning helpers, an honest-proof baseline, and rejection tests for fabricated payloads after serialization and decoding.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to c6bc3

The change prevents fabricated proof payloads from being served while preserving valid proofs, with no actionable merge-blocking risk remaining beyond normal checks and review.

Suggested reviewers: alexhentschel, janezpodhostnik

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main security fix in NewPSMT and the non-inclusion proof payload injection vector.
Docstring Coverage	✅ Passed	Docstring coverage is 88.89% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 2 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch leo/fix-ptrie-fabricated-reads

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!