AggLayer: Validate destination network during CLAIM note processing #2698
Description
Description
The Solidity claimAsset() function validates that the leaf's destinationNetwork matches the chain's own networkID, reverting with DestinationNetworkInvalid() on mismatch. This ensures claims are only processed on the intended destination chain.
The Miden claim procedure computes and verifies the leaf hash, checks the GER, verifies the Merkle proof, and checks the claim nullifier. It extracts the destination_address from the leaf data to build the P2ID note. However, the destination_network field (at leaf data offset DESTINATION_NETWORK_OFFSET = 7, relative to the leaf data start) is included in the leaf hash but never compared against Miden's own network ID. There is currently no storage slot for Miden's network ID.
Impact
A leaf intended for a different AggLayer chain (with a different destinationNetwork) could theoretically be claimed on Miden if it has a valid GER and Merkle proof. In practice, the destination address would need to correspond to a valid Miden account, which limits exploitability. However, this is a defense-in-depth gap that should be closed.
Recommended Action
Store Miden's AggLayer network ID in a bridge storage slot, initialized at bridge creation. In the claim procedure in bridge_in.masm, after loading the leaf data, compare the leaf's destination_network field against the stored network ID and panic on mismatch. This prevents leaves intended for other AggLayer chains from being claimed on Miden.
References
Classification
This validation is part of the base bridge contract (PolygonZkEVMBridgeV2).