Taiko Shasta — Proposal & Block Data: Complete Verification-Chain Audit

Confidence: High — linchpin bindings (parent-header hash recompute, ancestor-chain anchoring, ring-buffer & R2 checks) read first-hand in raiko2 + L1 contracts.

Every field enumerated in §4–§8 reduces to R1–R7. The verification graph is an acyclic, L1-grounded DAG. This is the headline result and the answer to the audit's central question.

Confidence: High (both contracts read). Repo: taiko-mono.

The currently-live mainnet verifier (MainnetVerifier, 0x7180…) accepts SGX_GETH + SGX_RETH with no ZK proof — the exact combination behind the June-2026 forged-proof incident. Its contract header marks it DEPRECATED. The replacement ZkRequiredVerifier (0x7284…, Proposal-0019 / Unzen) structurally requires ≥1 ZK proof per batch. Because Inbox._proofVerifier is immutable, cutting over requires an Inbox upgrade (the mechanism Proposal-0019 uses).

Note: This concerns the strength of root R7, not the data-verification graph. Until the Unzen inbox is the active one, finalization safety rests on the SGX registry (R6) alone for TEE-only pairs. Recommend confirming the cutover has executed on the target network before relying on the ZK mandate.

Confidence: Medium-High on the structural facts (subagent code read + gaiko2's own in-repo audit docs/audits/); not line-verified first-hand in this pass. Repo: gaiko2.

gaiko2's "native" proving mode uses a hard-coded, publicly-known private key (the same golden-touch key used to sign anchors), with instance id 0xDEADC0DE, and the /prove/shasta* HTTP endpoints are unauthenticated; the aggregate endpoint executes no blocks. If a native/mock instance address is ever registered on-chain in the SgxVerifier, it becomes a proof-forgery oracle for the SGX leg.

Mitigations already in place: mainnet SGX registration is gated by DCAP attestation and an owner allowlist (a mock instance cannot self-register), and — post-Unzen — the ZK mandate (F1) means an SGX forgery alone cannot finalize. Recommend: assert in deploy tooling that no native/mock instance id is ever registered on a production verifier, and require auth on any internet-exposed prove endpoint.

Confidence: High — this lead was verified first-hand in the deep-dive. Repo: gaiko2.

The medium-confidence lead recorded here has been confirmed and elevated to a Critical finding: GethRunner.Execute computes the state root via IntermediateRoot without ever checking db.Error(), so a withheld witness node reads as empty/0 and can finalize a wrong state root, while the sibling paths (l2_state.go, manifest_tx_filter.go) and raiko2's sparse trie all fail closed. Full exploit chain, scope, and fix are in finding D1 (§15).

Confidence: High (constant + driver logic confirmed; raiko2 has the should_bypass_stalled_anchor_linkage analog).

For the first MAINNET_ANCHOR_CHECK_SKIP_PROPOSAL_OFFSET = 7 mainnet proposals, the parent anchor block number is recovered from the parent block's anchorV4/anchorV3 calldata instead of from Anchor._blockState. The calldata is part of an already-authenticated L2 block, so the value stays bound; the exception is bounded to genesis bootstrap. No action required beyond awareness that this special path exists and should not be generalized.

Confidence: High (both provers read).

Derivation.md states the node "enforces" that anchorBlockHash/anchorStateRoot reflect L1 state, which could read as an unproved trust assumption. In fact both provers cryptographically bind these to a contiguous L1 header chain terminating at originBlockHash (∈ R1/R5). Recommend: update the spec wording to say "proved," to avoid a future reader treating it as out-of-protocol trust.

Confidence: High (all three impls read/consistent).

Malformed blob/manifest content does not fail the proof — the source degrades to a single anchor-only block. This is a deliberate censorship-resistance property (a bad source can't invalidate a good forced inclusion) and is identical across driver and both provers. Soundness rests on the default always being the conservative outcome (empty block, inherited metadata). Recommend: keep the differential tests that assert driver/prover agreement on every degrade trigger; a divergence here is the most likely place a real bug would hide.

Confidence: High for proof-age (L1 read); Medium for gaiko2 digest (subagent read).

(a) _proposalAge is computed in Inbox.prove and forwarded to every verifier, but no shipped verifier consumes it — it is a forward hook for "prover-killer" handling. (b) The per-proposal signed digest is domain-separated by VERIFY_PROOF + chainId + verifier but not by the Inbox address; cross-deployment replay separation therefore rests on the verifier address being unique per deployment (it is, and it is bound into the public input). Neither is a vulnerability today; both are worth a comment so a future refactor doesn't weaken them.

Confidence: High (owner setters read first-hand). Repo: taiko-mono. Raised by: automated PR review, confirmed.

The verifier trust root R6 has two layers. Immutable: the verifier contract addresses, taikoChainId, and Inbox._proofVerifier. Governance-mutable: the trusted RISC0 image ids (Risc0Verifier.setImageIdTrusted, onlyOwner), SP1 program keys (SP1Verifier.setProgramTrusted, onlyOwner), and the SGX instance registry + MRENCLAVE/MRSIGNER allowlists (addInstances / deleteInstances / setMrEnclave / setMrSigner / registerInstance). A change to these sets changes which proofs L1 accepts.

This does not create a cycle — the sets are L1 state, written by governance independently of any single proof — but it is a governance trust assumption: the soundness of R6 rests on the owner / DAO controller (and, for SGX, DCAP attestation) admitting only correct programs and enclaves. Recommend: the report, and any downstream threat model, treat R6's allowlists as governance-controlled state rather than fixed constants.

Repo: gaiko2 · internal/prover/replay.go:51-88 (and the Unzen twin processUnzenReplayBlock, :105-212). Class: soundness. Confidence: High — both sides read first-hand.

The bug. The authoritative state-root path builds a state.StateDB over the witness hash-DB, executes, then returns db.IntermediateRoot(...) (line 82) — with no db.Error() or db.Commit() anywhere. go-ethereum swallows a missing trie node into a deferred error and returns a default value (account treated as non-existent; storage slot reads 0); IntermediateRoot never consults that deferred error — only Commit does, and it is never called. ValidateState(block, db, res, true) returns early in stateless mode before its own root/error check.

Exploit. A malicious prover supplies a witness that omits node B (holding victim account X or a gating storage slot) while keeping its parent branch A, which still references hash(B). During execution the descent to X hits the missing B → the read returns empty/0 with the error set-and-ignored. Because X's subtree is only read, A's hash(B) reference is unchanged, so IntermediateRoot recomputes a root that is self-consistent with a crafted header — while execution used fabricated pre-state. Any path where "reads as 0/empty" benefits the attacker (a bypassed replay-protection / nonce / allowance / processed[id] slot, a zeroed oracle/config, a balance-gated payout) mints or steals; the attacker's own mutations are materialized in the root. Prove only checks result.StateRoot == block.Root() against the attacker's own header — nothing catches it.

Why it's a forgotten check, not by design. The two sibling witness-read paths defend against exactly this: l2_state.go:65-69 calls db.Error() right after db.GetState with a comment — "Surface that error explicitly so an incomplete or corrupt witness cannot masquerade as a legitimately empty storage slot" — and manifest_tx_filter.go re-checks it after every transaction. raiko2's sparse trie fails closed (TrieWitnessError) on any unresolved node.

Scope & severity. A rollup soundness break in gaiko2's state-root producer — a release-blocker for gaiko2 as a standalone / SGX-only / SGX+SGX prover. It is mitigated on a composite verifier that mandates a fail-closed ZK co-prover (post-Unzen ZkRequiredVerifier): the ComposeVerifier requires both sub-proofs over the same commitment hash, and raiko2 (fail-closed) will not produce a ZK proof of the forged commitment — so the forgery cannot finalize there. It can finalize wherever a gaiko2 proof stands without such a co-prover.

Fix. Call db.Error() after execution (or compute the root via db.Commit, which checks it) in both GethRunner.Execute and processUnzenReplayBlock, matching manifestWitnessStateError.

Remediation status: already fixed — gaiko2 PR #45 (merged) landed the statedb.Error() replay guard; the dedicated #46 was closed as a duplicate, and #48 refines the zk-gas / witness-error precedence on top. This audit did not open a duplicate.

Repo: taiko-client (Go driver) · driver/chain_syncer/event/derivation/source_fetcher.go:317-332. Class: liveness / consensus. Confidence: High — verified first-hand.

The bug. ComputeTimestampLowerBound computes max(parent.ts + 1, proposal.ts − TIMESTAMP_MAX_OFFSET) — it has no SHASTA_FORK_TIME floor (its own doc comment claims "the maximum of three constraints" but implements two). The spec (Derivation.md:223) and the other three implementations include it: Rust driver validation.rs:141, raiko2 guest derivation.rs:435, gaiko2 guest manifest_validate.go:456.

Scenario. Shasta activates at a non-genesis timestamp T (the normal rollout). Parent (last pre-fork block) ts = T−2; the first Shasta proposal lands at ts = T+20 (Hoodi offset 1536). Go lower bound = max(T−1, T+20−1536) = T−1; the others = max(…, T) = T. A proposer sets the first block's timestamp to T−1: the Go driver accepts and builds it, while the Rust driver and both provers reject it (ts < lowerBound) and collapse the source to the default manifest. Result — Go-driver nodes build a block that Rust-driver nodes reject and that neither prover can prove: a driver/driver partition and an unprovable chain, precisely at fork activation.

Latent, not live. Genesis-activated chains are unaffected (parent.ts + 1 > fork_ts makes the clamp a no-op), which is why it hasn't fired — it triggers the first time Shasta is scheduled at a future timestamp.

Fix. Add the fork-time floor to ComputeTimestampLowerBound and pass it at both call sites.

Remediation status: a fix adding the fork-time floor to the Go driver is being opened as a separate pull request citing this report (the Rust driver and both provers already have it).

Repo: gaiko2 · internal/protocol/manifest_validate.go:521-528. Class: liveness / prover split. Confidence: Medium (hunter-reported; workflow reconciliation pending).

The forced-inclusion anchor branch only checks anchor == parentAnchor and returns true; it never applies the origin-window check (anchor < origin − MAX_ANCHOR_OFFSET) that the drivers and raiko2 apply to every block. Scenario: a catch-up proposal [forced (1 block, user txs), normal (advances anchor)] with a stale parent anchor A where origin − A > MAX_ANCHOR_OFFSET. Drivers + raiko2 default the forced source (drop the user txs → empty block); gaiko2 keeps them (non-empty block), then rejects the canonical empty block on the tx-root check → the proposal is unprovable by gaiko2 while raiko2 proves it (prover/prover and prover/driver split). The spec (Derivation.md:236) only exempts forced inclusions from the strict-advance penalty and is silent on the window — that ambiguity produced the split. Fix: apply the excessive-lag window to forced anchors too (and pin the spec so all four impls agree).

Repos: taiko-client + raiko2 · driver syncer.go:302-308; guest guest-common/src/lib.rs:372-400. Class: liveness (one-time). Confidence: Medium (hunter-reported).

Both drivers recover the parent anchor from the parent block's anchorV4/anchorV3 calldata for mainnet proposals id ≤ MAINNET_ANCHOR_CHECK_SKIP_PROPOSAL_OFFSET (7), because Anchor._blockState.anchorBlockNumber is not yet reliable during bootstrap. raiko2's guest reads the parent anchor only from that storage slot (plus a host cross-check); gaiko2 trusts the host value. So for mainnet id ≤ 7 raiko2's storage-derived anchor can differ from the driver's tx-derived one → the host == verified cross-check fails or yields a wrong anchor → those proposals unprovable by raiko2. A one-time mainnet-launch determinism gap worth confirming against the migration state. Fix: give the guest the same id ≤ 7 tx-based recovery, or guarantee the bootstrap storage matches.

Repo: taiko-mono · Inbox.sol:602-607; unused permissionlessInclusionMultiplier/permissionlessProvingDelay (:121,99); LibForcedInclusion.isOldestForcedInclusionDue (never called). Class: censorship-resistance. Confidence: Medium (hunter-reported).

Forced inclusions are the system's censorship-resistance primitive, but their only consumer — propose — is fully gated by the permissioned _proposerChecker.checkProposer ("Permissionless proposing is temporarily disabled"). The config carries all the scaffolding for a "proposing/proving becomes permissionless once an inclusion is too old" escape hatch (permissionlessInclusionMultiplier, mainnet 160 ≈ 25.6 h), and isOldestForcedInclusionDue exists — but none of it is wired into propose/prove, and checkProposer is never given the inclusion age. If the permissioned set colludes or is unavailable, a due forced inclusion is never processed and its paid fee is locked (no cancel/refund path in saveForcedInclusion) — the guarantee the mechanism exists to provide silently does not hold; it rests on the social expectation of the current whitelist phase. Fix: wire the permissionless escape hatch and add a refund path.

Repos: all impls · raiko2 manifest.rs:179, gaiko2 manifest_validate.go:387, Go utils/compress.go:69. Class: DoS / liveness. Confidence: Medium (hunter-reported).

Every implementation decompresses the manifest to completion (read_to_end / io.ReadAll) before the block-count cap (192/768) is applied; only the compressed slice is bounded (≤ one blob). A source whose payload is DEFLATE of a long zero-run (~1032:1 ceiling) expands ~130 KB → ~130 MB (single blob) or ~800 MB (multi-blob) in a single allocation, OOM-ing the memory-constrained guest. It is consistent across impls (a DoS, not a state divergence) and gated by L1 blob cost — hence Medium. Fix: a bounded reader capped at max_blocks × max_block_rlp_size.