fix(state): rebuild pocket_to_parent index on load (INTERNAL-2026-04-22-persist)

pocket_to_parent is a derived in-memory reverse index (pocket_addr →
parent_addr) maintained incrementally on CreatePocket / RemovePocket.
It is not persisted to redb — the authoritative data is the
SmartAccountConfig.pockets list (of labels) on each parent.

rebuild_pocket_map() was defined on StateEngine but never called. After
any node restart, pocket_to_parent was empty, which caused:

1. Every pocket unspendable: verify_smart_transfer's parent-fallback
   couldn't resolve pocket → parent.
2. GHSA-9chc-gjfr-6hrq silent regression: check_spending_policy's
   unwrap_or(*from) fell through to the pocket's (empty) config,
   bypassing every limit the user had set on the parent.

Fix: call engine.rebuild_pocket_map() in load_from_redb immediately
after restore_smart_accounts().

Three regression tests in crates/ultradag-coin/tests/pocket_persistence.rs
exercise save → reload round-trip: index is rebuilt, pocket remains
spendable, and the parent's daily_limit continues to apply to
pocket-originated transfers after reload (5/5 assertions).

Found by the second-pass security audit launched after the GHSA-9chc
and INTERNAL-2026-04-22-pocket-keyreg fixes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: UltraDAGcom

crates/ultradag-coin/src/state/db.rs

@@ -558,9 +558,16 @@ pub fn load_from_redb(path: &Path) -> Result<StateEngine, PersistenceError> {
     engine.restore_bridge_state(bridge_attestations, bridge_sigs, bridge_nonce);
     engine.set_bridge_contract_address(bridge_contract_address);
 
-    // Restore SmartAccounts
+    // Restore SmartAccounts. The pocket_to_parent reverse-index is derived
+    // state — it lives in memory only, not in redb — so it must be rebuilt
+    // from each config's pockets list immediately after restore. Without
+    // this, every pocket on the node becomes unspendable after a restart
+    // (verify_smart_transfer's parent-fallback finds no entry) and spending
+    // policies silently stop being enforced (check_spending_policy's
+    // pocket→parent resolution falls through to the pocket's empty config).
     if !smart_accounts_vec.is_empty() {
         engine.restore_smart_accounts(smart_accounts_vec);
+        engine.rebuild_pocket_map();
     }
 
     // Restore Name Registry

crates/ultradag-coin/tests/pocket_persistence.rs

@@ -0,0 +1,143 @@
+//! Regression tests for the pocket_to_parent rebuild-on-load contract.
+//!
+//! `pocket_to_parent` is a derived in-memory reverse index (pocket_addr →
+//! parent_addr). It is NOT persisted to redb — only the owning parent's
+//! `SmartAccountConfig.pockets` list (of labels) is. So after every node
+//! restart, the map must be rebuilt from those labels, or:
+//!
+//! 1. `verify_smart_transfer` for pocket-originated transfers fails at the
+//!    parent-fallback step → every pocket becomes unspendable.
+//! 2. `check_spending_policy` cannot resolve pocket→parent → falls through
+//!    to the pocket's (empty) config → GHSA-9chc-gjfr-6hrq re-emerges.
+//!
+//! These tests save a StateEngine with a funded pocket + active policy to a
+//! redb file, reload into a fresh engine, and assert both properties hold.
+
+use tempfile::NamedTempFile;
+use ultradag_coin::address::{Address, SecretKey, Signature};
+use ultradag_coin::state::{db, StateEngine};
+use ultradag_coin::tx::name_registry::derive_pocket_address;
+use ultradag_coin::tx::smart_account::*;
+
+fn seed_engine_with_pocket() -> (StateEngine, SecretKey, Address) {
+    let alice = SecretKey::from_bytes([0xA1; 32]);
+    let mut engine = StateEngine::new_with_genesis();
+    engine.faucet_credit(&alice.address(), 20_000_000_000).unwrap();
+    engine.ensure_smart_account(&alice.address());
+
+    // Seed parent's Ed25519 key so the parent config has a real authorized
+    // key that can sign pocket transfers after reload.
+    let pubkey = alice.verifying_key().to_bytes();
+    let key_id = AuthorizedKey::compute_key_id(KeyType::Ed25519, &pubkey);
+    let cfg = engine.smart_account_mut_for_test(&alice.address()).unwrap();
+    cfg.authorized_keys.push(AuthorizedKey {
+        key_id, key_type: KeyType::Ed25519, pubkey: pubkey.to_vec(),
+        label: "owner".to_string(), daily_limit: None, daily_spent: (0, 0),
+    });
+
+    // Install a strict parent policy that will be enforced on pocket spends.
+    let mut policy_tx = SetPolicyTx {
+        from: alice.address(),
+        instant_limit: 100_000_000,
+        vault_threshold: 0,
+        vault_delay_rounds: 0,
+        whitelisted_recipients: vec![],
+        daily_limit: Some(100_000_000), // 1 UDAG/day on the parent
+        fee: 0, nonce: 0, // fee 0 keeps the supply invariant simple in-test
+        pub_key: pubkey,
+        signature: Signature([0u8; 64]),
+    };
+    policy_tx.signature = alice.sign(&policy_tx.signable_bytes());
+    engine.apply_set_policy_tx(&policy_tx, 100).unwrap();
+    engine.process_pending_policy_changes(100 + POLICY_CHANGE_DELAY_ROUNDS);
+
+    // Create + fund the pocket.
+    let op = SmartOpTx {
+        from: alice.address(),
+        operation: SmartOpType::CreatePocket { label: "savings".to_string() },
+        fee: 0, nonce: 1, signing_key_id: [0u8; 8],
+        signature: vec![], webauthn: None, p256_pubkey: None,
+    };
+    engine.apply_smart_op_tx(&op, 100).unwrap();
+    let pocket = derive_pocket_address(&alice.address(), "savings");
+    engine.faucet_credit(&pocket, 5_000_000_000).unwrap();
+
+    (engine, alice, pocket)
+}
+
+fn save_and_reload(engine: &StateEngine) -> StateEngine {
+    let tmp = NamedTempFile::new().unwrap();
+    let path = tmp.path().to_path_buf();
+    drop(tmp); // redb wants to own the file
+    db::save_to_redb(engine, &path).unwrap();
+    db::load_from_redb(&path).unwrap()
+}
+
+#[test]
+fn pocket_to_parent_map_rebuilt_on_reload() {
+    let (engine, alice, pocket) = seed_engine_with_pocket();
+    assert_eq!(engine.pocket_parent(&pocket), Some(alice.address()));
+
+    let reloaded = save_and_reload(&engine);
+    assert_eq!(
+        reloaded.pocket_parent(&pocket),
+        Some(alice.address()),
+        "pocket_to_parent must be rebuilt from SmartAccountConfig.pockets after load",
+    );
+}
+
+#[test]
+fn parent_policy_still_enforced_on_pocket_after_reload() {
+    // Before the fix, pocket_to_parent was empty after load, so
+    // check_spending_policy fell through to Ok(None) and the parent's
+    // daily_limit was silently skipped for pocket-originated transfers.
+    let (engine, alice, pocket) = seed_engine_with_pocket();
+    let bob = Address([0xB0; 20]);
+
+    let mut reloaded = save_and_reload(&engine);
+
+    // First 1 UDAG hits the parent's cap exactly.
+    let pubkey = alice.verifying_key().to_bytes();
+    let key_id = AuthorizedKey::compute_key_id(KeyType::Ed25519, &pubkey);
+    let make = |amount: u64, nonce: u64| {
+        let mut tx = SmartTransferTx {
+            from: pocket, to: bob, amount, fee: 0, nonce,
+            signing_key_id: key_id, signature: vec![],
+            memo: None, webauthn: None,
+        };
+        tx.signature = alice.sign(&tx.signable_bytes()).0.to_vec();
+        tx
+    };
+
+    reloaded.apply_smart_transfer_tx(&make(100_000_000, 0)).unwrap();
+
+    // Second tx must hit the PARENT's daily_spent counter and be rejected.
+    let err = reloaded.apply_smart_transfer_tx(&make(1_000_000_000, 1)).unwrap_err();
+    assert!(
+        err.to_string().contains("daily spending limit exceeded"),
+        "parent policy must carry across reload; got: {err}",
+    );
+}
+
+#[test]
+fn pocket_is_spendable_after_reload() {
+    // Before the fix, verify_smart_transfer's pocket→parent fallback failed
+    // because pocket_to_parent was empty, making every pocket unspendable.
+    let (engine, alice, pocket) = seed_engine_with_pocket();
+    let bob = Address([0xB1; 20]);
+    let reloaded = save_and_reload(&engine);
+
+    let pubkey = alice.verifying_key().to_bytes();
+    let key_id = AuthorizedKey::compute_key_id(KeyType::Ed25519, &pubkey);
+    let mut tx = SmartTransferTx {
+        from: pocket, to: bob, amount: 50_000_000, fee: 0, nonce: 0,
+        signing_key_id: key_id, signature: vec![],
+        memo: None, webauthn: None,
+    };
+    tx.signature = alice.sign(&tx.signable_bytes()).0.to_vec();
+
+    assert!(
+        reloaded.verify_smart_transfer(&tx),
+        "pocket-originated transfer must verify against the parent's keys after reload",
+    );
+}

docs/security/advisories/INTERNAL-2026-04-22-pocket-persist.md

@@ -0,0 +1,76 @@
+# INTERNAL-2026-04-22 — Pocket persistence gap re-exposes pocket-policy bypass after restart
+
+**Severity:** Critical
+**Component:** `ultradag-coin` — StateEngine persistence (redb load path)
+**Disclosure:** Internal review (second-pass audit; no bounty payout)
+**Status:** Fixed
+
+## Summary
+
+`pocket_to_parent: HashMap<Address, Address>` is the authoritative reverse
+index that policy enforcement and signature authorization depend on for
+every pocket-originated transfer. It is **derived** state, maintained
+incrementally on `CreatePocket` / `RemovePocket`, and deliberately *not*
+persisted to redb — the authoritative data is the `pockets: Vec<String>`
+list on each parent's `SmartAccountConfig`.
+
+The `rebuild_pocket_map()` helper that reconstructs this index from those
+lists was defined on `StateEngine` (line 376) but was **never called
+anywhere in the codebase**. A source-level comment at the `from_parts`
+constructor even stated the invariant ("Rebuilt via rebuild_pocket_map()
+after loading") — the call simply wasn't wired. After any node restart,
+`pocket_to_parent` was empty.
+
+## Impact
+
+On every node restart:
+
+1. **Every pocket becomes unspendable.** `verify_smart_transfer` checks
+   the pocket's own config first (empty) then falls back to
+   `pocket_to_parent.get(&tx.from)` — which returns `None` with no map
+   loaded. The signature does not verify against either surface and the
+   transfer is rejected. Real user funds are locked on the live pocket
+   address.
+
+2. **The GHSA-9chc-gjfr-6hrq fix silently regresses.** Once
+   `pocket_to_parent` is empty, `check_spending_policy`'s `unwrap_or(*from)`
+   falls through to the pocket's own `SmartAccountConfig`, which has no
+   policy. Every account-level limit (daily, vault threshold, whitelist)
+   that a user had configured on their parent account stops being enforced
+   for any of their pockets.
+
+Combined with INTERNAL-2026-04-22-pocket-keyreg (the key-injection fix
+landed earlier today in commit `826e2a28`), these three together form a
+complete defense for pockets. This bug would have undermined the other
+two on the first restart.
+
+## Root cause
+
+A function that is load-bearing for correctness was defined but never
+called. Runtime mutations to the map stayed correct because `CreatePocket`
+and `RemovePocket` update it incrementally. The gap only opened at startup
+— exactly when no test suite happened to exercise a save/load round-trip
+with an active pocket.
+
+## Fix
+
+One-line: call `engine.rebuild_pocket_map()` in
+`crates/ultradag-coin/src/state/db.rs::load_from_redb` immediately after
+`engine.restore_smart_accounts(smart_accounts_vec)`.
+
+Three regression tests in
+`crates/ultradag-coin/tests/pocket_persistence.rs`:
+
+- `pocket_to_parent_map_rebuilt_on_reload` — direct assertion that the
+  index is non-empty after save/load.
+- `pocket_is_spendable_after_reload` — `verify_smart_transfer` succeeds
+  for a pocket-originated transfer after reload.
+- `parent_policy_still_enforced_on_pocket_after_reload` — the parent's
+  daily_limit continues to apply to pocket-originated transfers after
+  reload; a follow-up transfer past the cap is rejected.
+
+## Credits
+
+Found by the second-pass state-engine audit launched after the first two
+pocket fixes landed (commit `fb6ef59d` for GHSA-9chc-gjfr-6hrq, commit
+`826e2a28` for INTERNAL-2026-04-22-pocket-keyreg).

docs/security/advisories/README.md

@@ -6,6 +6,7 @@ This directory contains published security advisories for vulnerabilities that h
 
 - [GHSA-9chc-gjfr-6hrq](GHSA-9chc-gjfr-6hrq.md) — Critical — Spending-policy bypass via pockets. SmartAccount policies (daily limit, vault threshold, whitelist, per-key limit) were not enforced on transfers originating from pocket sub-addresses. Reported by Sumitshah00, fixed 2026-04-21.
 - [INTERNAL-2026-04-22-pocket-keyreg](INTERNAL-2026-04-22-pocket-keyreg.md) — Critical — Pocket key-injection enables pocket drain. `auto_register_ed25519_key` did not require the pubkey to derive to the target address, so any attacker could plant their key on a victim's pocket and then spend from it. Found by internal review, fixed 2026-04-22.
+- [INTERNAL-2026-04-22-pocket-persist](INTERNAL-2026-04-22-pocket-persist.md) — Critical — Pocket persistence gap. `pocket_to_parent` reverse-index was never rebuilt on node restart; after any restart every pocket became unspendable and the GHSA-9chc policy-bypass silently regressed. Found by second-pass internal review, fixed 2026-04-22.
 
 ## Disclosure Timeline