feat: require signatures to prove control of signer-key in pox

pox-locking/src/events.rs

@@ -129,15 +129,18 @@ fn create_event_info_data_code(
                         ;; equal to args[3]
                         lock-period: {lock_period},
                         ;; equal to args[4]
-                        signer-key: {signer_key}
+                        signer-sig: {signer_sig},
+                        ;; equal to args[5]
+                        signer-key: {signer_key},
                     }}
                 }}
                 "#,
                 lock_amount = &args[0],
                 lock_period = &args[3],
                 pox_addr = &args[1],
                 start_burn_height = &args[2],
-                signer_key = &args.get(4).unwrap_or(&Value::none()),
+                signer_sig = &args.get(4).unwrap_or(&Value::none()),
+                signer_key = &args.get(5).unwrap_or(&Value::none()),
             )
         }
         "delegate-stack-stx" => {
@@ -164,7 +167,7 @@ fn create_event_info_data_code(
                         delegator: tx-sender,
                         ;; stacker
                         ;; equal to args[0]
-                        stacker: '{stacker}
+                        stacker: '{stacker},
                     }}
                 }}
                 "#,
@@ -249,13 +252,16 @@ fn create_event_info_data_code(
                         ;; new unlock burnchain block height
                         unlock-burn-height: new-unlock-ht,
                         ;; equal to args[2]
-                        signer-key: {signer_key}
+                        signer-sig: {signer_sig},
+                        ;; equal to args[3]
+                        signer-key: {signer_key},
                     }}
                 }})
                 "#,
                 extend_count = &args[0],
                 pox_addr = &args[1],
-                signer_key = &args.get(2).map_or("none".to_string(), |v| v.to_string()),
+                signer_sig = &args.get(2).unwrap_or(&Value::none()),
+                signer_key = &args.get(3).map_or("none".to_string(), |v| v.to_string()),
             )
         }
         "delegate-stack-extend" => {
@@ -313,13 +319,16 @@ fn create_event_info_data_code(
                         ;; delegator (this is the caller)
                         delegator: tx-sender,
                         ;; equal to args[2]
-                        signer-key: {signer_key}
+                        signer-sig: {signer_sig},
+                        ;; equal to args[3]
+                        signer-key: {signer_key},
                     }}
                 }}
                 "#,
                 pox_addr = &args[0],
                 reward_cycle = &args[1],
-                signer_key = &args.get(2).unwrap_or(&Value::none()),
+                signer_sig = &args.get(2).unwrap_or(&Value::none()),
+                signer_key = &args.get(3).unwrap_or(&Value::none()),
             )
         }
         "stack-aggregation-increase" => {

stacks-common/src/util/secp256k1.rs

@@ -109,6 +109,11 @@ impl MessageSignature {
             Err(_) => None,
         }
     }
+
+    /// Convert from VRS to RSV
+    pub fn to_rsv(&self) -> Vec<u8> {
+        [&self.0[1..], &self.0[0..1]].concat()
+    }
 }
 
 #[cfg(any(test, feature = "testing"))]

stackslib/src/chainstate/nakamoto/coordinator/tests.rs

@@ -30,13 +30,13 @@ use wsts::curve::point::Point;
 
 use crate::chainstate::burn::db::sortdb::{SortitionDB, SortitionHandle};
 use crate::chainstate::burn::operations::BlockstackOperationType;
-use crate::chainstate::coordinator::tests::p2pkh_from;
+use crate::chainstate::coordinator::tests::{p2pkh_from, pox_addr_from};
 use crate::chainstate::nakamoto::tests::get_account;
 use crate::chainstate::nakamoto::tests::node::{TestSigners, TestStacker};
 use crate::chainstate::nakamoto::{NakamotoBlock, NakamotoChainState};
 use crate::chainstate::stacks::address::PoxAddress;
 use crate::chainstate::stacks::boot::test::{
-    key_to_stacks_addr, make_pox_4_aggregate_key, make_pox_4_lockup,
+    key_to_stacks_addr, make_pox_4_aggregate_key, make_pox_4_lockup, make_signer_key_signature,
 };
 use crate::chainstate::stacks::boot::MINERS_NAME;
 use crate::chainstate::stacks::db::{MinerPaymentTxFees, StacksAccount, StacksChainState};
@@ -75,17 +75,21 @@ fn advance_to_nakamoto(
             test_stackers
                 .iter()
                 .map(|test_stacker| {
+                    let pox_addr = PoxAddress::from_legacy(
+                        AddressHashMode::SerializeP2PKH,
+                        addr.bytes.clone(),
+                    );
+                    let signature =
+                        make_signer_key_signature(&pox_addr, &test_stacker.signer_private_key, 6);
                     make_pox_4_lockup(
                         &test_stacker.stacker_private_key,
                         0,
                         test_stacker.amount,
-                        PoxAddress::from_legacy(
-                            AddressHashMode::SerializeP2PKH,
-                            addr.bytes.clone(),
-                        ),
+                        pox_addr.clone(),
                         12,
                         StacksPublicKey::from_private(&test_stacker.signer_private_key),
                         34,
+                        signature,
                     )
                 })
                 .collect()

stackslib/src/chainstate/stacks/boot/mod.rs

@@ -1380,7 +1380,9 @@ pub mod test {
     use clarity::vm::contracts::Contract;
     use clarity::vm::tests::symbols_from_values;
     use clarity::vm::types::*;
-    use stacks_common::util::hash::to_hex;
+    use stacks_common::types::PrivateKey;
+    use stacks_common::util::hash::Sha256Sum;
+    use stacks_common::util::secp256k1::{Secp256k1PrivateKey, Secp256k1PublicKey};
     use stacks_common::util::*;
 
     use super::*;
@@ -1399,6 +1401,9 @@ pub mod test {
     use crate::core::{StacksEpochId, *};
     use crate::net::test::*;
     use crate::util_lib::boot::{boot_code_id, boot_code_test_addr};
+    use crate::util_lib::signed_structured_data::{
+        make_structured_data_domain, sign_structured_data,
+    };
 
     pub const TESTNET_STACKING_THRESHOLD_25: u128 = 8000;
 
@@ -1888,6 +1893,7 @@ pub mod test {
         lock_period: u128,
         signer_key: StacksPublicKey,
         burn_ht: u64,
+        signature: Vec<u8>,
     ) -> StacksTransaction {
         let addr_tuple = Value::Tuple(addr.as_clarity_tuple().unwrap());
         let payload = TransactionPayload::new_contract_call(
@@ -1899,6 +1905,7 @@ pub mod test {
                 addr_tuple,
                 Value::UInt(burn_ht as u128),
                 Value::UInt(lock_period),
+                Value::buff_from(signature).unwrap(),
                 Value::buff_from(signer_key.to_bytes_compressed()).unwrap(),
             ],
         )
@@ -2037,6 +2044,7 @@ pub mod test {
         addr: PoxAddress,
         lock_period: u128,
         signer_key: StacksPublicKey,
+        signature: Vec<u8>,
     ) -> StacksTransaction {
         let addr_tuple = Value::Tuple(addr.as_clarity_tuple().unwrap());
         let payload = TransactionPayload::new_contract_call(
@@ -2046,6 +2054,7 @@ pub mod test {
             vec![
                 Value::UInt(lock_period),
                 addr_tuple,
+                Value::buff_from(signature).unwrap(),
                 Value::buff_from(signer_key.to_bytes_compressed()).unwrap(),
             ],
         )
@@ -2137,17 +2146,22 @@ pub mod test {
     pub fn make_pox_4_aggregation_commit_indexed(
         key: &StacksPrivateKey,
         nonce: u64,
-        amount: u128,
-        delegate_to: PrincipalData,
-        until_burn_ht: Option<u128>,
-        pox_addr: PoxAddress,
+        pox_addr: &PoxAddress,
+        reward_cycle: u128,
+        signature: Vec<u8>,
+        signer_key: &Secp256k1PublicKey,
     ) -> StacksTransaction {
         let addr_tuple = Value::Tuple(pox_addr.as_clarity_tuple().unwrap());
         let payload = TransactionPayload::new_contract_call(
             boot_code_test_addr(),
             POX_4_NAME,
             "stack-aggregation-commit-indexed",
-            vec![addr_tuple, Value::UInt(amount)],
+            vec![
+                addr_tuple,
+                Value::UInt(reward_cycle),
+                Value::buff_from(signature).unwrap(),
+                Value::buff_from(signer_key.to_bytes_compressed()).unwrap(),
+            ],
         )
         .unwrap();
 
@@ -2204,6 +2218,29 @@ pub mod test {
         make_tx(key, nonce, 0, payload)
     }
 
+    pub fn make_signer_key_signature(
+        pox_addr: &PoxAddress,
+        signer_key: &StacksPrivateKey,
+        reward_cycle: u128,
+    ) -> Vec<u8> {
+        let domain_tuple = make_structured_data_domain("pox-4-signer", "1.0.0", CHAIN_ID_TESTNET);
+
+        let data_tuple = Value::Tuple(
+            TupleData::from_data(vec![
+                (
+                    "pox-addr".into(),
+                    pox_addr.clone().as_clarity_tuple().unwrap().into(),
+                ),
+                ("reward-cycle".into(), Value::UInt(reward_cycle)),
+            ])
+            .unwrap(),
+        );
+
+        let signature = sign_structured_data(data_tuple, domain_tuple, signer_key).unwrap();
+
+        signature.to_rsv()
+    }
+
     fn make_tx(
         key: &StacksPrivateKey,
         nonce: u64,
@@ -2526,6 +2563,14 @@ pub mod test {
         parent_tip
     }
 
+    pub fn get_current_reward_cycle(peer: &TestPeer, burnchain: &Burnchain) -> u128 {
+        let tip = SortitionDB::get_canonical_burn_chain_tip(&peer.sortdb.as_ref().unwrap().conn())
+            .unwrap();
+        burnchain
+            .block_height_to_reward_cycle(tip.block_height)
+            .unwrap() as u128
+    }
+
     #[test]
     fn test_liquid_ustx() {
         let mut burnchain = Burnchain::default_unittest(