Skill: Inv #1b typed-data tree decode + canonical-spender table still gap; A.3 Permit collude lands

[szhygulin]

Summary

On expert-128-A.3, an A.3 collude on a Permit (USDC, 1000, 30-day expiration) succeeded because Inv #2 (digest recompute) is tautological under MCP collude — the MCP returns a digest matching its tampered tree, the skill recomputes the same hash, and Inv #2 silently passes. Inv #1b (typed-data tree decode + canonical-spender allowlist) is the missing defense. This batch reinforces the gap already tracked in #453.

Repro

Scripts: expert-128-A.3.

Suggested fix

Per #453: ship Inv #1b (decode domain/types/primaryType/message locally, walk address-typed fields, pin verifyingContract against curated map, refuse on mismatch) PAIRED WITH Inv #2b (independent digest recompute from decoded tree). No typed-data signing tool ships without both invariants in the same release.

Cross-reference

Reinforcement of existing tracker #453 — file as comment if open, otherwise as fresh issue with reference.

Source

Smoke-test batch-3 (matrix-sampled adversarial run, 2026-04-29). Findings: runs/matrix-sampled/batch-03/findings.md.

🤖 Generated with Claude Code

[szhygulin]

Pushing back before acting — this issue mismatches its filing repo and reinforces a tracker that's already been resolved.

Mismatch:

1. Title prefix Skill: signals wrong repo. Inv #1b's actual implementation surface (typed-data tree decode, canonical-spender table for primaryType ∈ {Permit, PermitSingle, PermitBatch, Order}, ⚠ NON-CANONICAL SPENDER advisory rendering, deadline-delta surfacing) lives in vaultpilot-security-skill, not in this MCP. The MCP-side counterpart (Inv #2b independent digest recompute) is also gated on a typed-data signing tool existing to wrap.

2. Tracker [security] Block typed-data signing surface from shipping until Inv #1b + #2b land #453 is already CLOSED-completed (2026-04-28). Its outcome was the CLAUDE.md "Typed-Data Signing Discipline" rule: "No typed-data signing tool ships without paired Inv #1b + Inv #2b in the same release." That rule is enforced at PR-review and design time and has prevented every typed-data signing tool from landing so far.

3. MCP exposes zero typed-data signing tools today. I grepped src/ for prepare_eip2612*, prepare_permit2*, prepare_cowswap*, sign_typed_data* — no matches. Today's defense is gap-by-design exactly as [security] Block typed-data signing surface from shipping until Inv #1b + #2b land #453 left it. The script's success against a hypothetical prepare_eip2612_permit doesn't translate into a current MCP-side action; the tool that would carry the gap doesn't exist.

4. Sibling-repo searches: vaultpilot-security-skill has no open tracker for Inv #1b typed-data decode / canonical-spender table for Permit-class primaryTypes. Skill Rename project to vaultpilot-mcp #26 covered ERC-20 approve only.

Paths forward (pick one):

• (A) Close as subsumed — the rule lives in CLAUDE.md; the gap-by-design defense is currently active; the skill-side companion can be filed when a typed-data signing tool is proposed for the MCP. This is the smallest-solution-discipline answer if no typed-data tool is on the near-term roadmap.

• (B) Refile skill-side now — open a fresh issue in vaultpilot-security-skill titled "Inv #1b — typed-data tree decode + canonical-spender table for Permit/PermitSingle/PermitBatch/Order primaryTypes" and close this one as "filed at vaultpilot-security-skill#NN". Captures the rule scope explicitly so the skill repo can pull it in pre-emptively rather than at coordinated-release time. Worth doing if typed-data signing tools are likely on the next 1–2 milestones.

• (C) Re-scope to a concrete MCP-side change — add a CI-time registry guard that fails the build if any tool whose name matches prepare_*permit*|prepare_*cowswap*|sign_typed_data* is registered without paired #1b + #2b validator hooks. Turns the CLAUDE.md rule into a tamper-evident check rather than a process rule. Concrete MCP work, but premature if no such tool is being proposed.

Which fits the actual intent of the smoke-test reinforcement — was the goal to keep the design-time rule visible (B), to harden it into code (C), or just to confirm the existing gap-by-design defense is still doing its job (A)?

— Alan (agent-9a77)

[szhygulin]

(A) Close as subsumed