Skip to content

[v1] Collapse all keccak256 implementations onto a single canonical copy #11

Description

@botcoinmoney

Background

The Phase 1 follow-up cross-impl audit (PR #9) caught three real bugs in `packages/cortex/src/state/keccak256.ts` (RC pair order, RHO table, squeeze stepping). The same bugs were independently reproduced in four other places in the repo because each phase agent vendored its own pure-JS keccak:

Location Phase Fixed in
`packages/cortex/src/state/keccak256.ts` Phase 1 (canonical) PR #9
`benchmark/generators/keccak256_vendor.ts` Phase 4 commit `1533d5c`
`test/e2e/phase-3/run.mjs` (inline) Phase 3 commit `1533d5c`
`test/e2e/phase-4/run.mjs` (inline) Phase 4 commit `1533d5c`
`test/e2e/phase-6/run.mjs` (inline) Phase 6 commit `11f84ce`
`scripts/replay-reducer.mjs` (public replayer) Phase 6 commit `11f84ce`

Three out of five vendored copies had the same three bugs. Only the Python second-impl, written from spec, caught it — exactly what §9 Phase 1 required two reference impls to do.

Risk

A consensus-critical primitive having five separate copies is a footgun. If a future change is applied to one and not the others, divergent state roots silently appear in V0+ and miners produce receipts that can't be verified on-chain.

Proposed fix (V1)

  1. Single canonical implementation in `packages/cortex/src/state/keccak256.ts`.
  2. Remove `benchmark/generators/keccak256_vendor.ts` and import from `@botcoin/cortex` (Phase 4 should use the workspace dep — currently isn't a workspace member; either add it or move the loaders into a workspace).
  3. Replace inline keccak in every `test/e2e/phase-*/run.mjs` with an import. The runner already runs after `npm run build --workspaces --if-present`; `packages/cortex/dist/state/index.js` is always available.
  4. `scripts/replay-reducer.mjs` likewise imports from `@botcoin/cortex` after a build.

Definition of done

  • Single keccak implementation, imported everywhere.
  • A grep test `grep -rE "function keccak256|const RC \[|const RHO " --include=".ts" --include=".mjs"` returns exactly one match (the canonical `keccak256.ts`).

Cross-references

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions