From 1b149fed081939ee5fcbc2e949cf6356a90cbb9e Mon Sep 17 00:00:00 2001 From: stubbsta Date: Thu, 9 Jul 2026 14:05:10 +0200 Subject: [PATCH] Reject empty merkle proof cache in on-chain generateProof An empty cache passes the existing mod-32 length check and silently produces a witness with no path elements, yielding a proof no validator will accept. Catch the case explicitly so the failure surfaces at the callsite rather than after a wasted publish round-trip. Co-Authored-By: Claude Opus 4.7 --- .../waku/rln/group_manager/on_chain/group_manager.nim | 3 +++ 1 file changed, 3 insertions(+) diff --git a/logos_delivery/waku/rln/group_manager/on_chain/group_manager.nim b/logos_delivery/waku/rln/group_manager/on_chain/group_manager.nim index 80915f6d8..9b9f147e4 100644 --- a/logos_delivery/waku/rln/group_manager/on_chain/group_manager.nim +++ b/logos_delivery/waku/rln/group_manager/on_chain/group_manager.nim @@ -492,6 +492,9 @@ method generateProof*( debug "Generating RLN proof" ?(await g.ensureFreshMerkleProofPath()) + if g.merkleProofCache.len == 0: + return err("merkle proof cache is empty") + if (g.merkleProofCache.len mod 32) != 0: return err("Invalid merkle proof cache length")