Security review: fix critical bridge bugs, add withdrawal path, remove ethers/ring

.cargo/audit.toml

@@ -3,17 +3,9 @@
 
 [advisories]
 
-# RUSTSEC-2025-0009 / RUSTSEC-2025-0010: ring < 0.17.12 AES panic + unmaintained
-# Transitive dependency via: ethers-providers 2.0.14 → jsonwebtoken 8.x → ring 0.16
-# ethers-providers v2 hard-pins jsonwebtoken 8, which in turn hard-pins ring 0.16.
-# We cannot upgrade ethers without a full SDK migration. The panic is only
-# triggered with Rust debug overflow checks enabled (not in --release builds).
-# Tracked: https://github.com/MeridianAlgo/Interlink/issues/1
-# Mitigation: AES code path is only used for JWS parsing in provider WebSocket
-# authentication, which is never exercised in our relayer architecture.
-ignore = [
-  "RUSTSEC-2025-0009",
-  "RUSTSEC-2025-0010",
+# RUSTSEC-2025-0009 / -0010 (ring 0.16) no longer apply: ethers-rs was removed,
+# so ring is no longer in the dependency tree.
+ignore = [
   # RUSTSEC-2025-0055: tracing-subscriber 0.2.25 ANSI escape injection in log output.
   # Transitive via: ark-relations 0.4.0 → ark-groth16 0.4.0 → relayer.
   # ark-relations pins tracing-subscriber 0.2.x; upgrading requires a full arkworks

.env.example

@@ -1,22 +1,44 @@
-# InterLink Relayer Configuration
-
-# EVM source chain ID (1=Ethereum, 42161=Arbitrum, 10=Optimism, 8453=Base)
-CHAIN_ID=
-
-# WebSocket endpoint for EVM event subscription (ws:// or wss://)
-EVM_WS_RPC_URL=
-
-# HTTP endpoint for EVM finality polling (http:// or https://)
-EVM_HTTP_RPC_URL=
-
-# Solana RPC endpoint
-SOLANA_RPC_URL=https://api.devnet.solana.com
-
-# Deployed InterlinkGateway contract address (0x...)
-GATEWAY_ADDRESS=
-
-# Deployed Solana Hub program ID (base58)
-HUB_PROGRAM_ID=
-
-# Path to the relayer's Solana keypair JSON file
-KEYPAIR_PATH=~/.config/solana/id.json
+# InterLink Relayer Configuration
+
+# ── Source EVM chain ──────────────────────────────────────────────────────────
+# EIP-155 chain ID (1=Ethereum, 42161=Arbitrum, 10=Optimism, 8453=Base).
+# Checked against the RPC at startup; it is part of every payload hash.
+CHAIN_ID=
+
+# HTTP JSON-RPC endpoint (event polling, finality, and withdrawal delivery).
+# Must support the "finalized" block tag.
+EVM_HTTP_RPC_URL=
+
+# Deployed InterlinkGateway contract address (0x...)
+GATEWAY_ADDRESS=
+
+# Optional: block to start scanning from (default: current head).
+START_BLOCK=
+POLL_INTERVAL_SECS=4
+MAX_BLOCK_RANGE=2000
+
+# ── Solana hub ────────────────────────────────────────────────────────────────
+SOLANA_RPC_URL=https://api.devnet.solana.com
+HUB_PROGRAM_ID=
+# Relayer's Solana keypair (must hold an ILINK stake on the hub).
+KEYPAIR_PATH=~/.config/solana/id.json
+
+# ── Prover ────────────────────────────────────────────────────────────────────
+# Groth16 proving key; the on-chain VK must come from this file (cargo run --bin export-vk).
+PROVING_KEY_PATH=keys/interlink_pk.bin
+# Allow generating a local (single-party, dev-only) key if the file is missing.
+ALLOW_DEV_SETUP=false
+
+# ── Hub → EVM withdrawals (optional) ──────────────────────────────────────────
+# Key that sends releaseTokens transactions. Prefer a file over the raw variable.
+EVM_PRIVATE_KEY_FILE=
+# EVM_PRIVATE_KEY=
+# Process hub signatures after this one on startup (default: only new ones).
+HUB_START_SIGNATURE=
+HUB_POLL_INTERVAL_SECS=5
+
+# ── HTTP API ──────────────────────────────────────────────────────────────────
+# Binds to localhost by default; the Docker image sets 0.0.0.0:8080.
+API_ADDR=127.0.0.1:8080
+# Required to enable the webhook endpoints (sent as "Authorization: Bearer <token>").
+API_TOKEN=

.gitignore

@@ -10,9 +10,14 @@
 .env
 *.log
 
+# Groth16 proving keys (generated by `cargo run --bin export-vk`)
+keys/
+
 # Foundry build artifacts
 contracts/evm/out/
 contracts/evm/cache/
 
 # Node dependencies
-node_modules/
+node_modules/
+# Test coverage output
+coverage/