{"entry":{"fixtureId":"attack-xchain-missing-domain-separator-v0","appSlug":"attack-xchain-missing-domain-separator","appName":"ATTACK: missing-domain-separator","reportId":"lab_attack-xchain-missing-domain-separator-v0_20260610225855224","generatedAt":"2026-06-10T22:58:55.224Z","status":"pass","jsonPath":"/bundle/server-functions/default/.nocklab/attack-xchain-missing-domain-separator.report.json","markdownPath":"/bundle/server-functions/default/.nocklab/attack-xchain-missing-domain-separator.report.md","reportHash":"sha256:48010f1bf4eb63ae78104b96389421ef1f880bb640d0c39358eac34f0d850da3","snapshotRoot":"9451e8fe636e6d5d","badgeCandidate":{"id":"badge-candidate-attack-xchain-missing-domain-separator","label":"ATTACK: missing-domain-separator Verification Candidate","reportSlug":"attack-xchain-missing-domain-separator","fixtureId":"attack-xchain-missing-domain-separator-v0","status":"watch","evidenceKind":"exploit-prevention","statusReDerived":"pass","statusConsistent":true,"kernelHash":null,"kernelVerified":false,"baseDeploymentHash":null,"baseVerified":false,"signatureStatus":"unsigned","evidence":{"reportHash":"sha256:48010f1bf4eb63ae78104b96389421ef1f880bb640d0c39358eac34f0d850da3","snapshotRoot":"9451e8fe636e6d5d","invariantPacks":[]}},"stepsPassed":1,"stepsTotal":1,"invariantsPassed":0,"invariantsTotal":1,"alertsTriggered":0,"snapshotsCaptured":2,"adapterObservationCount":0,"invariantPackCount":0},"report":{"reportId":"lab_attack-xchain-missing-domain-separator-v0_20260610225855224","fixtureId":"attack-xchain-missing-domain-separator-v0","generatedAt":"2026-06-10T22:58:55.224Z","app":{"name":"ATTACK: missing-domain-separator","slug":"attack-xchain-missing-domain-separator","version":"0.0.1","kernel":"xchain-attack-model"},"environment":{"mode":"mock-fakenet","grpcEndpoint":"n/a","fakenetCommand":"model","notes":["NEGATIVE CONTROL (expectRejected=true): a multi-EVM cross-chain exploit the invariant MUST catch.","Two EVM endpoints share one EIP-712 domain (chainId hardcoded to 1); a Base authorization is accepted on Optimism.","expectRejected inverts a CAUGHT exploit to a green proof-of-prevention."]},"summary":{"status":"pass","stepsPassed":1,"stepsFailed":0,"invariantsPassed":0,"invariantsFailed":1,"alertsClear":0,"alertsTriggered":0,"snapshotsCaptured":2,"durationMs":17,"expectRejected":true,"rawStatus":"fail"},"invariantPacks":[],"steps":[{"id":"observe","type":"bridge","title":"Observe terminal joint multi-EVM state","status":"pass","expectation":"xchain.observed == true","observed":"true","beforeHash":"41d5b2d5bf0eac01","afterHash":"9451e8fe636e6d5d","stateDiffs":[{"path":"xchain.observed","before":"undefined","after":"true"}],"durationMs":19}],"invariants":[{"id":"domain-separator","title":"Distinct, re-derived domain per endpoint","severity":"critical","status":"fail","observed":"DOMAIN: endpoint 8453: domain.chainId 1 != 8453; endpoint 8453: chainId not re-derived at verify (stale on fork); endpoint 10: domain.chainId 1 != 10; endpoint 10: chainId not re-derived at verify (stale on fork); duplicate domain separator across endpoints (cross-chain signature reuse)","expected":"each endpoint has a distinct (chainId,verifyingContract) domain re-derived at verify; authorizations valid only at their bound endpoint, under xchain.domain"}],"alerts":[],"adapterObservations":[],"stateSnapshots":[{"label":"Initial state","stateHash":"41d5b2d5bf0eac01","state":{"xchain":{"domain":{"endpoints":[{"chainId":8453,"verifyingContract":"0xSAME0000000000000000000000000000000000ff","domain":{"name":"NockBridge","version":"1","chainId":1,"verifyingContract":"0xSAME0000000000000000000000000000000000ff"},"derivesChainIdAtVerify":false},{"chainId":10,"verifyingContract":"0xSAME0000000000000000000000000000000000ff","domain":{"name":"NockBridge","version":"1","chainId":1,"verifyingContract":"0xSAME0000000000000000000000000000000000ff"},"derivesChainIdAtVerify":false}],"authorizations":[{"boundDomainHash":"ba5883d1af11e07ae5c6522c80a7692588f04609eeddd74ce285a2ba467d3ee8","usedAtEndpoint":10}]}}}},{"label":"After observe","stateHash":"9451e8fe636e6d5d","state":{"xchain":{"domain":{"endpoints":[{"chainId":8453,"verifyingContract":"0xSAME0000000000000000000000000000000000ff","domain":{"name":"NockBridge","version":"1","chainId":1,"verifyingContract":"0xSAME0000000000000000000000000000000000ff"},"derivesChainIdAtVerify":false},{"chainId":10,"verifyingContract":"0xSAME0000000000000000000000000000000000ff","domain":{"name":"NockBridge","version":"1","chainId":1,"verifyingContract":"0xSAME0000000000000000000000000000000000ff"},"derivesChainIdAtVerify":false}],"authorizations":[{"boundDomainHash":"ba5883d1af11e07ae5c6522c80a7692588f04609eeddd74ce285a2ba467d3ee8","usedAtEndpoint":10}]},"observed":true}},"stepId":"observe"}],"stateDiffs":[{"path":"xchain.observed","before":"undefined","after":"true"}],"nextActions":["Replace mock poke and peek execution with local fakenet adapter calls.","Replace command-backed fakenet metadata probes with stable gRPC-native probes once node surfaces are available.","Persist generated reports under a project workspace.","Add app-specific invariant packs as the NockApp interface stabilizes."]},"markdown":"# ✅ ATTACK: missing-domain-separator Lab Report\n\n> **PASS** — 1/1 steps · 0/1 invariants · 0 alerts · 17ms\n\n| Field | Value |\n| --- | --- |\n| Report | `lab_attack-xchain-missing-domain-separator-v0_20260610225855224` |\n| Fixture | `attack-xchain-missing-domain-separator-v0` |\n| Status | ✅ pass |\n| Steps | 1 passed, 0 failed |\n| Invariants | 0 passed, 1 failed |\n| Alerts | 0 clear, 0 triggered |\n| Snapshots | 2 |\n\n## Steps\n\n- ✅ `observe` — true _(xchain.observed == true)_; 41d5b2d5bf0eac01 -> 9451e8fe636e6d5d\n  - xchain.observed: undefined -> true\n\n## Invariants\n\n- ❌ `domain-separator` — DOMAIN: endpoint 8453: domain.chainId 1 != 8453; endpoint 8453: chainId not re-derived at verify (stale on fork); endpoint 10: domain.chainId 1 != 10; endpoint 10: chainId not re-derived at verify (stale on fork); duplicate domain separator across endpoints (cross-chain signature reuse) _(expected each endpoint has a distinct (chainId,verifyingContract) domain re-derived at verify; authorizations valid only at their bound endpoint, under xchain.domain)_\n\n## Alerts\n\n- No alert policies configured.\n\n## Adapter Observations\n\n- No adapter observations captured.\n\n## State Diffs\n\n- xchain.observed: undefined -> true\n\n## Snapshot Timeline\n\n- Initial state: 41d5b2d5bf0eac01\n- After observe: 9451e8fe636e6d5d\n\n","evidence":{"stateDiffCount":1,"snapshotCount":2,"alertCount":0,"triggeredAlertCount":0,"clearAlertCount":0,"triggeredCriticalAlertCount":0,"triggeredWarningAlertCount":0,"triggeredInfoAlertCount":0,"environmentMode":"mock-fakenet","grpcEndpoint":"n/a","environmentNoteCount":3,"nextActionCount":4,"firstNextAction":"Replace mock poke and peek execution with local fakenet adapter calls.","invariantPackCount":0,"invariantPackIds":[],"invariantPackDomains":[],"firstInvariantPackPath":"","changedPaths":["xchain.observed"],"markdownPreview":"# ✅ ATTACK: missing-domain-separator Lab Report"}}