Fix warm-key verification across height-sync acknowledgement and repair paths #1769

Open @anatoly-kuz-mntn opened 2026-09-15 01:58 UTC 0 comments Updated 2026-09-15 01:58 UTC

Description

Height-sync messages are signed with the host process signer, which is normally a warm key for joined participants. Several verification paths compare the recovered signer only with the cold validator address.

Consequently, valid height-sync acknowledgements and repair messages from joined hosts are rejected. Genesis hosts are unaffected because their process signer and validator account use the same key.

This issue covers heightsync-correctness-1.

Affected code

• checkL2 verifies acknowledgements against SlotKeys
• SlotKeys contains validator addresses
• Hosts sign acknowledgements with the process signer
• Repair requests are verified against the cold validator address
• Repair responses are verified against the cold validator address
• Courtesy acknowledgements have the same cold-key-only check

Expected behavior

Height-sync signatures should be accepted when they belong either to the validator’s cold key or to an authorized warm key for the corresponding slot.

Acceptance criteria

• Warm-key-signed MsgHeightAck passes L2 validation.
• Warm-key-signed repair requests and responses are accepted.
• Courtesy acknowledgements support authorized warm keys.
• Unauthorized warm keys remain rejected.
• Cold-key signing remains supported.

---

🔄 Auto-synced from Issue #1769 every hour.