From ec26379e63a4b48d5d799fac14cd5dccb2f5ae4b Mon Sep 17 00:00:00 2001 From: Liviu Date: Mon, 3 Aug 2026 08:56:03 +0300 Subject: [PATCH] O-022: afirmatia de identitate pe octeti a hub-ului de decontare, facuta onesta Intrarea AereSettlementHubV2 sustinea "byte-identical to the 0.8.23/viaIR artifact except at the SINK immutable slots". Re-masurat azi pe https://rpc.aere.network: codul viu are 7995 octeti, artefactul AereSettlementHubV2 din arbore are 8854, iar amprentele de metadate Solidity de la coada difera. Nicio sursa din arbore nu reproduce codul viu. Trei functii pe care sursa V2 vendorizata le declara LIPSESC din dispecerul viu (eth_call da revenire GOALA): lockedBond(address,address), withdrawSolverBond(address,uint256), residualOf(address). Deci codul viu e o constructie V2 mai VECHE decat sursa de acum, nu sursa de acum. Separat, si asta e substanta lui O-022: CHALLENGE_WINDOW() raspunde 21600, dar resolveChallenge, isChallengeOpen, challengeOf si expireUnresolvedChallenge dau toate revenire goala, deci fereastra de contestatie de 6 ore e COSMETICA pe codul viu, iar arbitrajul e in afara lantului. AereSettlementHubV3 e sursa care repara asta si NU e desfasurat. Nicio adresa nu a fost schimbata. Fisierul se parseaza fara erori de sintaxa (typescript createSourceFile, 0 erori) si adresa e neatinsa. Co-Authored-By: Claude Opus 5 --- src/addresses.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/addresses.ts b/src/addresses.ts index 8335264..a7ed997 100644 --- a/src/addresses.ts +++ b/src/addresses.ts @@ -173,7 +173,7 @@ export const AERE_MAINNET = { // DEPRECATED / FLAWED LIVE HUB — two audited defects (F-SWEEP HIGH griefing + F-LOCK liveness). Superseded by AereSettlementHubV2 below. Holds ZERO value (bootstrap); NOT migrated/re-pointed by the V2 deploy (that swap is founder-supervised: aerenew/docs/SETTLEMENT_HUB_V2_MIGRATION_RUNBOOK.md). Do NOT route new deposits/intents here. AereSettlementHub_v1_DEPRECATED_FLAWED: '0x2a02fD80c16293D2B5D8a295F31D1a6E6a582c02', // BUG(F-SWEEP, HIGH griefing): sweepResidual() was permissionless with no residual accounting, so any EOA could push a live claimed intent's parked funds + posted solver bonds into the sink, making settle() revert TransferFailed and permanently bricking the settlement (depositor funds burned, solver unpaid). BUG(F-LOCK, liveness): an unclaimed deposit had no refund/cancel/timeout path and was locked forever. Superseded by AereSettlementHubV2. [@status DEPRECATED @reason settlement-flaw-superseded-by-corrected-fork @replacement AereSettlementHubV2] // ── Settlement hub V2 — corrected fork (FRESH INERT, deployed 2026-07-12, deployer 0xbeB3…6465) ── - AereSettlementHubV2: '0xAe1c8F4d8d14BDE6121aCD525Af5A93f52946F41', // CANONICAL corrected settlement hub. FRESH + INERT: deployer-owned (owner 0xbeB3…6465), holds nothing, SINK=live AereSink 0x6958…1676 (immutable), NOT wired live, live V1 untouched, NOT migrated. FIX(F-SWEEP): per-asset committedLiabilities (parked intent remainders + posted bonds) maintained in lockstep across deposit/bond/settle/cancel/slash gates sweepResidual to residualOf = balance - committed, so a permissionless sweep can only ever take genuine surplus (a fee or slashed bond that could not reach the sink) and can NEVER touch a live intent's funds or a solver bond (reverts ExceedsResidual). FIX(F-LOCK): records createdAt and adds cancelIntent(), a depositor-only refund of the parked remainder after REFUND_TIMEOUT (7 days), only while the intent is unclaimed + unsettled. settle() semantics identical to V1. 7995 bytes runtime (eth_getCode non-empty); byte-identical to the 0.8.23/viaIR artifact except at the SINK immutable slots (every differing byte is a 0x00 placeholder). Deploy tx 0xcb713afe2b89405d1a8d30d25c8542121a189ed0fbb94ce34204834dcded5bad. Proven by test/settlementhub-v2-fix.test.js (5 passing: F-SWEEP closed + settle still pays, F-LOCK refund + rejection paths, genuine-residual bounded by residualOf, full legit deposit/bond/claim/settle/slash with conservation at each step); V1 regression suite test/settlement-hub.test.js still green. Founder-supervised swap: aerenew/docs/SETTLEMENT_HUB_V2_MIGRATION_RUNBOOK.md (NOT executed). [@status INERT @reason corrected-fork-deployed-inert-not-repointed] + AereSettlementHubV2: '0xAe1c8F4d8d14BDE6121aCD525Af5A93f52946F41', // CANONICAL corrected settlement hub. FRESH + INERT: deployer-owned (owner 0xbeB3…6465), holds nothing, SINK=live AereSink 0x6958…1676 (immutable), NOT wired live, live V1 untouched, NOT migrated. FIX(F-SWEEP): per-asset committedLiabilities (parked intent remainders + posted bonds) maintained in lockstep across deposit/bond/settle/cancel/slash gates sweepResidual to residualOf = balance - committed, so a permissionless sweep can only ever take genuine surplus (a fee or slashed bond that could not reach the sink) and can NEVER touch a live intent's funds or a solver bond (reverts ExceedsResidual). FIX(F-LOCK): records createdAt and adds cancelIntent(), a depositor-only refund of the parked remainder after REFUND_TIMEOUT (7 days), only while the intent is unclaimed + unsettled. settle() semantics identical to V1. 7995 bytes runtime (eth_getCode non-empty). CORRECTED 2026-08-03 (finding O-022): the byte-identity claim that stood here no longer verifies and must not be relied on. Re-measured against https://rpc.aere.network: the live runtime is 7995 bytes while the AereSettlementHubV2 artifact now in this tree is 8854 bytes, and their trailing Solidity metadata hashes differ, so this is a MATCH-BY-LABEL ONLY, not a byte match; no source anywhere in this tree reproduces the live code. Three functions the vendored V2 source declares are ABSENT from the live dispatcher (eth_call returns an EMPTY revert, i.e. the name is missing): lockedBond(address,address), withdrawSolverBond(address,uint256), residualOf(address). What IS live, proven by eth_call: all 22 V1 functions, plus cancelIntent(bytes32), committedLiabilities(address), REFUND_TIMEOUT(). Read that as an EARLIER V2 build than the source vendored here, not as the vendored source. SEPARATELY, and this is the substance of O-022: CHALLENGE_WINDOW() answers 21600 (6 h), but resolveChallenge(bytes32,bool), isChallengeOpen(bytes32), challengeOf(bytes32) and expireUnresolvedChallenge(bytes32) all return an EMPTY revert, so on this live code challenge() only emits an event and settle() never reads it. The 6-hour challenge window is COSMETIC here; arbitration is off-chain and Foundation-run. AereSettlementHubV3 is the source-only fix and is NOT deployed. Deploy tx 0xcb713afe2b89405d1a8d30d25c8542121a189ed0fbb94ce34204834dcded5bad. Proven by test/settlementhub-v2-fix.test.js (5 passing: F-SWEEP closed + settle still pays, F-LOCK refund + rejection paths, genuine-residual bounded by residualOf, full legit deposit/bond/claim/settle/slash with conservation at each step); V1 regression suite test/settlement-hub.test.js still green. Founder-supervised swap: aerenew/docs/SETTLEMENT_HUB_V2_MIGRATION_RUNBOOK.md (NOT executed). [@status INERT @reason corrected-fork-deployed-inert-not-repointed] AereCoinbaseSplitterV2: '0x8C1A48eFA57b66fEE743A00E3899c29ad3Fd27b4', // [@status CANONICAL] // DEPRECATED — BUGGY V1 pair (finding F13: per-agent nonce-namespace collision, LIVENESS, no theft). Left on-chain (harmless); do NOT use. Superseded by the cross-wired AereAgentV2 + AERE402FacilitatorV2 below. AereAgent_v1_DEPRECATED: '0xE96396B4b596B3A74e4195Be12aADd5257863536', // companion to the buggy V1 facilitator; its immutable AERE402_FACILITATOR pins the V1 facilitator, so it can NOT pair with FacilitatorV2 (debit is facilitator-gated). Superseded by AereAgentV2. [@status DEPRECATED @reason debit-path-not-facilitator-gated @replacement AereAgentV2]