feat: drop `PolicyProvider` by 0xrusowsky · Pull Request #701 · tempoxyz/zones

0xrusowsky · 2026-07-17T14:29:15Z

stacked on top of #698

fully drops the PolicyProvider

# Conflicts: # crates/l1/src/state/cache.rs # crates/l1/src/subscriber.rs # crates/l1/src/tests.rs # crates/node/README.md # crates/node/src/node.rs

klkvr · 2026-07-17T16:17:05Z

-                                amount = %d.amount,
-                                "Encrypted deposit recipient unauthorized; queuing deposit bounce-back"
-                            );
-                            queued.rejected = true;


do we now never reject deposits? is it safe to just remove this logic?

they are rejected at execution when the 403 logic runs

basically it would be this code which calls mint() on the zone's TIP20:

regular deposit:

zones/specs/ref-impls/src/zone/ZoneInbox.sol

Lines 236 to 245 in 95366b0

try IZoneToken(d.token).mint(d.to, d.amount) {

emit DepositProcessed(

currentHash, d.sender, d.to, d.token, d.amount, d.memo

);

} catch {

_enqueueDepositBounceBack(d.token, d.amount, d.bouncebackRecipient);

emit DepositFailed(

currentHash, d.sender, d.to, d.token, d.amount, d.bouncebackRecipient

);

}

encrypted deposit:

zones/specs/ref-impls/src/zone/ZoneInbox.sol

Lines 320 to 325 in 95366b0

try IZoneToken(ed.token).mint(decryptedTo, ed.amount) {

emit EncryptedDepositProcessed(

currentHash, ed.sender, decryptedTo, ed.token, ed.amount, decryptedMemo

);

} catch {

_failEncryptedDeposit(currentHash, ed);

Yes since this is rejected at execution time, should be safe to remove here.

0xrusowsky · 2026-07-17T17:15:16Z

cyclops audit note="focus only on ensuring that the changes in this PR are sound. the base branch is being audited in parallel"

github-actions · 2026-07-17T17:15:28Z

cc @0xrusowsky

Cyclops audit event published. View workflow run

Config: config: default, iterations: default, hours: default, note: focus only on ensuring that the changes in this PR are sound. the base branch is being audited in parallel

tempoxyz-bot · 2026-07-17T17:15:46Z

👁️ Cyclops Security Review

95366b0

🧭 Verifying · mode=normal · workers 3/3 done (0 left) · verify pending 1 · ending soon

Worker	Engine	Latest Status	Status
`pr-701-w1`	claude-opus-4-8	🚨 Iteration 3 · Verify	Done
`pr-701-w2`	gpt-5.5	✅ Iteration 3 · Audit	Done
`pr-701-w3`	gpt-5.6-sol	✅ Iteration 3 · Audit	Done

Findings

#	Finding	Severity	Status
1	Encrypted-deposit mint-recipient authorization deferred to a never-invalidated anchored L1 cache	`Medium`	Iteration 1 · Audit
2	Stale anchored L1 policy reads propagate beyond encrypted deposits	`High`	Iteration 1 · Verify
3	Cyclops Invariant Audit — PR #701	`Unknown`	Iteration 1 · Verify
4	Rejected/policy-failing encrypted deposits leak (to, memo) via unconditionally published ECDH sharedSecret in advanceTempo calldata	`medium`	Iteration 2 · Verify
5	Bridging a policy-restricted TIP-20 permanently halts the zone via advanceTempo revert	`high`	Iteration 3 · Verify

⚙️ Controls

🚀 Keep only 1 remaining iteration per worker after the current work finishes.
👀 Keep only 2 remaining iterations per worker after the current work finishes.
❤️ Let only worker 1 continue; other workers skip queued iterations.
😄 Let only worker 2 continue; other workers skip queued iterations.
🎉 End faster by skipping queued iterations and moving toward consolidation.
😕 Stop active workers/verifiers now and start consolidation immediately.

📜 34 events

🔍 pr-701-w1 iter 1/3 [audit-general.md]
🔍 pr-701-w2 iter 1/3 [audit-ripple.md]
🔍 pr-701-w3 iter 1/3 [audit-invariants.md]
🛡️ pr-701-w1 iter 1 — defense-in-depth
🚨 Finding: Encrypted-deposit mint-recipient authorization deferred to a never-invalidated anchored L1 cache (Medium)
🔍 pr-701-w1 iter 2/3 [audit-invariants.md]
🚨 pr-701-w2 iter 1 — finding
🚨 Finding: Stale anchored L1 policy reads propagate beyond encrypted deposits (High)
🔍 pr-701-w2 iter 2/3 [audit-ripple.md]
🔬 Verifying: Stale anchored L1 policy reads propagate beyond encrypted deposits
🚨 pr-701-w3 iter 1 — finding
🚨 Finding: Cyclops Invariant Audit — PR #701 (Unknown)
🔍 pr-701-w3 iter 2/3 [audit-ripple.md]
🔬 Verifying: Cyclops Invariant Audit — PR #701
📋 Verify: Stale anchored L1 policy reads propagate beyond encrypted deposits → ✅ Verified
🚨 pr-701-w1 iter 2 — finding
🚨 Finding: Rejected/policy-failing encrypted deposits leak (to, memo) via unconditionally published ECDH sharedSecret in advanceTempo calldata (medium)
🔍 pr-701-w1 iter 3/3 [audit-invariants.md]
🔬 Verifying: Rejected/policy-failing encrypted deposits leak (to, memo) via unconditionally published ECDH sharedSecret in advanceTempo calldata
📋 Verify: Rejected/policy-failing encrypted deposits leak (to, memo) via unconditionally published ECDH sharedSecret in advanceTempo calldata → ✅ Verified
📋 Verify: Cyclops Invariant Audit — PR #701 → ✅ Verified
✅ pr-701-w2 iter 2 — clear
🔍 pr-701-w2 iter 3/3 [audit-invariants.md]
🚨 pr-701-w1 iter 3 — finding
🚨 Finding: Bridging a policy-restricted TIP-20 permanently halts the zone via advanceTempo revert (high)
🔬 Verifying: Bridging a policy-restricted TIP-20 permanently halts the zone via advanceTempo revert
📋 Verify: Bridging a policy-restricted TIP-20 permanently halts the zone via advanceTempo revert → ✅ Verified
🏁 pr-701-w1 done
✅ pr-701-w3 iter 2 — clear
🔍 pr-701-w3 iter 3/3 [audit-ripple.md]
✅ pr-701-w2 iter 3 — clear
🏁 pr-701-w2 done
✅ pr-701-w3 iter 3 — clear
🏁 pr-701-w3 done

0xKitsune · 2026-07-17T21:03:23Z

-    /// The resulting [`PreparedL1Block`] is ready to be passed through payload
-    /// attributes to the builder.
+    /// Decrypts encrypted deposits and ABI-encodes into the types the `advanceTempo` call expects.
+    /// Mint-recipient policy is enforced by upstream TIP-20 after the L1 state is anchored.


Flagging that this now depends on the raw-cache invalidation issue from #698. Once this precheck is removed, encrypted deposits rely on that cache for authorization, so a stale hit can mint where a cold node would bounce.

0xKitsune · 2026-07-17T21:03:24Z

 3. **Tempo TIP-20 and TIP-403 precompiles** — execute the upstream business
-   logic against that composed storage view, replacing the zone's duplicated
-   policy dispatch. Missing or invalid anchored state fails closed, and zone
+   logic against that composed storage view, without a separate zone policy


Can we clean up the remaining PolicyProvider docs here too? The diagram and note still describe PolicyCache/PolicyResolutionTask, and the payload attrs still say policy checks happen in the engine.

0xrusowsky added 6 commits July 17, 2026 15:04

feat: defer encrypted deposit policy checks

e9cd5c4

feat: simplify L1 policy tracking

22087ed

feat: remove policy cache test wiring

327d1a3

feat: fully drop PolicyProvider

956e66a

fix: handle pre-deployment portal anchors

9f06478

Merge branch 'rus/l1-aware-db' into rus/drop-policy-provider

95366b0

# Conflicts: # crates/l1/src/state/cache.rs # crates/l1/src/subscriber.rs # crates/l1/src/tests.rs # crates/node/README.md # crates/node/src/node.rs

0xrusowsky marked this pull request as ready for review July 17, 2026 15:54

0xrusowsky requested review from 0xKitsune and mattsse as code owners July 17, 2026 15:54

0xrusowsky requested a review from klkvr July 17, 2026 15:54

0xrusowsky mentioned this pull request Jul 17, 2026

feat(l1+evm+precompiles): add L1-backed zone db #698

Open

klkvr reviewed Jul 17, 2026

View reviewed changes

0xKitsune reviewed Jul 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: drop `PolicyProvider`#701

feat: drop `PolicyProvider`#701
0xrusowsky wants to merge 6 commits into
rus/l1-aware-dbfrom
rus/drop-policy-provider

0xrusowsky commented Jul 17, 2026 •

edited

Loading

Uh oh!

klkvr Jul 17, 2026

Uh oh!

0xrusowsky Jul 17, 2026

Uh oh!

0xrusowsky Jul 17, 2026

Uh oh!

0xKitsune Jul 17, 2026

Uh oh!

0xrusowsky commented Jul 17, 2026

Uh oh!

github-actions Bot commented Jul 17, 2026 •

edited

Loading

Uh oh!

tempoxyz-bot commented Jul 17, 2026 •

edited

Loading

Uh oh!

0xKitsune Jul 17, 2026

Uh oh!

0xKitsune Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	try IZoneToken(d.token).mint(d.to, d.amount) {
	emit DepositProcessed(
	currentHash, d.sender, d.to, d.token, d.amount, d.memo
	);
	} catch {
	_enqueueDepositBounceBack(d.token, d.amount, d.bouncebackRecipient);
	emit DepositFailed(
	currentHash, d.sender, d.to, d.token, d.amount, d.bouncebackRecipient
	);
	}

	try IZoneToken(ed.token).mint(decryptedTo, ed.amount) {
	emit EncryptedDepositProcessed(
	currentHash, ed.sender, decryptedTo, ed.token, ed.amount, decryptedMemo
	);
	} catch {
	_failEncryptedDeposit(currentHash, ed);

Uh oh!

Conversation

0xrusowsky commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

klkvr Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

0xrusowsky Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

0xrusowsky Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

0xKitsune Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

0xrusowsky commented Jul 17, 2026

Uh oh!

github-actions Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tempoxyz-bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

👁️ Cyclops Security Review

Findings

Uh oh!

0xKitsune Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

0xKitsune Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

0xrusowsky commented Jul 17, 2026 •

edited

Loading

github-actions Bot commented Jul 17, 2026 •

edited

Loading

tempoxyz-bot commented Jul 17, 2026 •

edited

Loading