fix(security): august 2026 audit fixes across runtime, codec, node and system contracts

.github/scripts/verify-built-in-genesis.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
+chainspec="$repo_root/crates/node/src/chainspec.rs"
+key_source="$repo_root/crates/release-verify/src/key.rs"
+expected_fingerprint=0A6D05E5DD98069BA184ED8304A68D620D5208FD
+
+tmp_dir=$(mktemp -d)
+trap 'rm -rf "$tmp_dir"' EXIT
+
+awk '
+  /-----BEGIN PGP PUBLIC KEY BLOCK-----/ {
+    sub(/^.*"-----BEGIN/, "-----BEGIN")
+    print
+    in_key = 1
+    next
+  }
+  in_key {
+    if (/-----END PGP PUBLIC KEY BLOCK-----/) {
+      sub(/";.*/, "")
+      print
+      exit
+    }
+    print
+  }
+' "$key_source" > "$tmp_dir/release-key.asc"
+
+actual_fingerprint=$(
+  gpg --batch --with-colons --import-options show-only --import "$tmp_dir/release-key.asc" 2>/dev/null |
+    awk -F: '$1 == "fpr" { print $10; exit }'
+)
+if [[ "$actual_fingerprint" != "$expected_fingerprint" ]]; then
+  echo "embedded release key fingerprint mismatch: $actual_fingerprint" >&2
+  exit 1
+fi
+
+export GNUPGHOME="$tmp_dir/gnupg"
+mkdir -m 700 "$GNUPGHOME"
+gpg --batch --quiet --import "$tmp_dir/release-key.asc"
+
+assets=(
+  'fluent-devnet|v0.5.7|genesis-v0.5.7.json.gz|91b9a427805d45dd14e46a0cd517bcc85f350fe7dfc38fa96f6ff0ebf5e864da'
+  'fluent-testnet|v0.3.4-dev|genesis-v0.3.4-dev.json.gz|8cd30358c5664375e6739bc48302445e7ee10fd0158bedb788505e5c590983bd'
+  'fluent-mainnet|v1.0.0|genesis-mainnet-v1.0.0.json.gz|72cb4b3b7b15de952bd1094281a1f2430cb711bc473a0520f92aa3e2b1bdb643'
+)
+
+for spec in "${assets[@]}"; do
+  IFS='|' read -r network tag name expected_sha256 <<< "$spec"
+  grep -Fq "$tag" "$chainspec"
+  grep -Fq "$expected_sha256" "$chainspec"
+
+  base_url="https://github.com/fluentlabs-xyz/fluentbase/releases/download/$tag"
+  curl --fail --location --silent --show-error --retry 3 --retry-all-errors \
+    "$base_url/$name" --output "$tmp_dir/$name"
+  curl --fail --location --silent --show-error --retry 3 --retry-all-errors \
+    "$base_url/$name.asc" --output "$tmp_dir/$name.asc"
+
+  actual_sha256=$(sha256sum "$tmp_dir/$name" | awk '{print $1}')
+  if [[ "$actual_sha256" != "$expected_sha256" ]]; then
+    echo "$network: sha256 mismatch: expected $expected_sha256, got $actual_sha256" >&2
+    exit 1
+  fi
+  gpg --batch --verify "$tmp_dir/$name.asc" "$tmp_dir/$name"
+  echo "$network: authenticated $name ($actual_sha256)"
+done

.github/workflows/ci.yml

@@ -27,6 +27,8 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Check release workflow hardening
         run: ./.github/scripts/check-release-supply-chain.sh .github/workflows/release.yml
+      - name: Authenticate built-in genesis assets
+        run: bash ./.github/scripts/verify-built-in-genesis.sh
 
   tests:
     name: Tests (${{ matrix.name }})

.github/workflows/release.yml

@@ -125,7 +125,13 @@ jobs:
           for i in $(seq 1 40); do
             if docker pull "$IMAGE"; then
               echo "Builder image is available"
-              digest="$(docker image inspect "$IMAGE" --format '{{range .RepoDigests}}{{println .}}{{end}}{{.Id}}' | sed '/^$/d' | head -n1)"
+              # Only a registry digest proves where the image came from; the local image ID
+              # does not, and the build refuses to run an image it cannot attribute.
+              digest="$(docker image inspect "$IMAGE" --format '{{range .RepoDigests}}{{println .}}{{end}}' | sed '/^$/d' | head -n1)"
+              if [[ -z "$digest" ]]; then
+                echo "Builder image $IMAGE has no registry digest" >&2
+                exit 1
+              fi
               echo "digest=$digest" >> "$GITHUB_OUTPUT"
               exit 0
             fi
@@ -144,6 +150,8 @@ jobs:
           FLUENTBASE_BUILD_DOCKER_IMAGE: ${{ steps.build_image.outputs.image }}
           FLUENTBASE_BUILD_DOCKER_TAG: ${{ steps.build_image.outputs.tag }}
           FLUENTBASE_BUILD_DOCKER_DIGEST: ${{ steps.build_image.outputs.digest }}
+          # A dry run builds the image locally, so it has no digest to verify.
+          FLUENTBASE_BUILD_ALLOW_UNVERIFIED_IMAGE: ${{ github.event.inputs.dry_run == 'true' }}
         run: |
           cargo build --release --locked
           sha256sum \

.gitignore

@@ -37,3 +37,4 @@ genesis-*.json
 node_modules
 evm-e2e/tests/
 datadir
+graphify-out/