fix: /pdp/accept task link mismatch by invoking with no nonce - #54
Open
alanshaw wants to merge 1 commit into
Open
fix: /pdp/accept task link mismatch by invoking with no nonce#54alanshaw wants to merge 1 commit into
alanshaw wants to merge 1 commit into
Conversation
…aces: the blob accept handler (for the `AcceptOK.pdp` promise), the aggregation pipeline (to issue the receipt), and the `/pdp/info` handler (to look the receipt up). Each call used the default random nonce, so the three task links never matched — receipts were stored under a link nobody else could derive, the pdp promise never resolved, and `/pdp/info` never found the receipt. Invoke with `invocation.WithNoNonce()` at all three sites so the task is idempotent and its link is deterministically derivable from the blob multihash, matching the PDP protocol spec (and the existing `/blob/accept` pattern).
There was a problem hiding this comment.
Pull request overview
This PR aims to make /pdp/accept task links deterministic (and therefore consistent across the blob accept handler, aggregation receipt issuance, and /pdp/info receipt lookup) by constructing the invocation with invocation.WithNoNonce(), aligning with the PDP protocol requirement that the task be idempotent and derivable from the blob multihash.
Changes:
- Add
invocation.WithNoNonce()when building/pdp/acceptinvocations in the blob accept handler, aggregation receipt generator, and/pdp/infohandler. - Add an explanatory comment in the blob accept handler documenting why the nonce must be omitted for deterministic task links.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| pkg/ucanhandlers/pdp/info.go | Rebuilds /pdp/accept invocation for deterministic receipt lookup. |
| pkg/ucanhandlers/blob/accept.go | Builds the AcceptOK.pdp promise task link deterministically by omitting nonce. |
| pkg/pdp/aggregation/manager/accepter.go | Issues receipts against a deterministically rebuilt /pdp/accept invocation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
80
to
84
| pdpAcceptInv, err := pdp.Accept.Invoke( | ||
| deps.ID, deps.ID.DID(), | ||
| &pdp.AcceptArguments{Blob: args.Blob}, | ||
| invocation.WithNoNonce(), | ||
| ) |
Comment on lines
79
to
+83
| // receipt store indexed under. | ||
| pdpAcceptInv, err := pdp.Accept.Invoke( | ||
| deps.ID, deps.ID.DID(), | ||
| &pdp.AcceptArguments{Blob: args.Blob}, | ||
| invocation.WithNoNonce(), |
Member
|
What are the risks of not using any nonce? What is the worst-case outcome of a replay attack? |
frrist
approved these changes
Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
/pdp/acceptinvocation is constructed independently in three places: the blob accept handler (for theAcceptOK.pdppromise), the aggregation pipeline (to issue the receipt), and the/pdp/infohandler (to look the receipt up). Each call used the default random nonce, so the three task links never matched — receipts were stored under a link nobody else could derive, the pdp promise never resolved, and/pdp/infonever found the receipt.Invoke with
invocation.WithNoNonce()at all three sites so the task is idempotent and its link is deterministically derivable from the blob multihash, matching the PDP protocol spec (and the existing/blob/acceptpattern).