hardening.h

Go to the documentation of this file.

/*
 * SPDX-License-Identifier: LGPL-3.0-or-later
 * Copyright (c) 2026 Cryptnox SA
 */

 
#ifndef HARDENING_H
#define HARDENING_H
 
#include <stdint.h>
#include <string.h>
 
#include "eth_addr.h"   /* ETH_ADDR_LEN — the recipient is an ETH address */
 
#ifdef __cplusplus
#include "CW_Utils.h"   /* SDK hardened primitives: constant-time secure_compare */
#endif
 
#ifdef __cplusplus
extern "C" {
#endif
 
/* ── §3.1 Anti-symmetric boolean ──────────────────────────────────── */
typedef uint32_t bool32;
/* Bitwise complements, Hamming distance 32: no small burst of flips can turn
 * FALSE32 into TRUE32. Only TRUE32 reads as true; ANY other pattern is false. */
#define TRUE32       ((bool32)0x5AA55AA5u)
#define FALSE32      ((bool32)0xA55AA55Au)
#define IS_TRUE32(x) ((x) == TRUE32)
 
/* ── §4 payment verdict token (anti-symmetric, never 0/1) ─────────── */
typedef uint32_t pos_verdict_t;
#define POS_VERDICT_APPROVED ((pos_verdict_t)0x33CC33CCu)
#define POS_VERDICT_DECLINED ((pos_verdict_t)0xCC33CC33u)
 
#ifdef __cplusplus
static_assert(TRUE32 == (bool32)~FALSE32,
              "bool32 sentinels must be bitwise complements");
static_assert(POS_VERDICT_APPROVED == (pos_verdict_t)~POS_VERDICT_DECLINED,
              "verdict sentinels must be bitwise complements");
#endif
 
/* ── §3.2 dual-stored business data ───────────────────────────────── */
typedef struct {
    uint64_t amount_minor;      
    uint64_t amount_minor_inv;  
} pos_amount_t;
 
typedef struct {
    uint8_t addr[ETH_ADDR_LEN];       
    uint8_t addr_echo[ETH_ADDR_LEN];  
} pos_addr_t;

static inline void pos_amount_set(pos_amount_t *a, uint64_t v)
{
    a->amount_minor     = v;
    a->amount_minor_inv = ~v;   /* distinct pattern: the two stores can't be
                                   proven redundant, so neither is elided */
}

void pos_handle_anomaly(const char *where);

uint32_t pos_anomaly_count(void);
 
/* ── Pure comparators — no side effects, so the caller decides how to react
 * (and the host self-test needs no NVS/log stubs). ────────────────── */
 
static inline bool32 amount_consistent(const pos_amount_t *a)
{
    return (a->amount_minor == (uint64_t)~a->amount_minor_inv) ? TRUE32 : FALSE32;
}
 
static inline bool32 address_consistent(const pos_addr_t *a)
{
    /* ponytail: C++-only; every consumer is a .cpp. Restore a memcmp #else
     * branch if a C translation unit ever needs this header. */
    return CW_Utils::secure_compare(a->addr, a->addr_echo, ETH_ADDR_LEN) ? TRUE32
                                                                        : FALSE32;
}

static inline bool32 run_payment_decision(const pos_amount_t *amount,
                                          const pos_addr_t   *to,
                                          pos_verdict_t       verdict)
{
    bool32 ok = FALSE32;
 
    if (IS_TRUE32(amount_consistent(amount)) &&
        IS_TRUE32(address_consistent(to))    &&
        (verdict == POS_VERDICT_APPROVED)) {
        ok = TRUE32;
    }
 
    return ok;
}
 
#ifdef __cplusplus
}
#endif
 
#endif /* HARDENING_H */