fix: task replay directed at same operator set

[0xrajath]

Motivation:

Fixing a bug where a random actor could permissionlessly call TaskMailbox::submitResult with an old cert+result combination (as long as the cert is not stale) but for a completely different task directed at the same operator set in the TaskMailbox. This could lead to DoS of the taskCreator.

Modifications:

The messageHash of the cert now is keccak256(abi.encode(taskHash, result)) instead of just keccak256(result). This ensures that the messageHash is applicable only for a specific task and can't be replayed across tasks.

Result:

Fixes SigmaPrime: ELHG-02 finding.

[Copilot]

Pull Request Overview

This PR fixes a security vulnerability where certificates could be replayed across different tasks directed at the same operator set. The fix changes the message hash from being based solely on the result to including both the task hash and result, preventing cross-task certificate replay attacks.

• Updates message hash calculation to include task hash in addition to result data
• Adds new test cases to verify certificate replay attacks are prevented
• Updates all existing test helper functions and test cases to use the new message hash format

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/contracts/avs/task/TaskMailbox.sol	Implements new getMessageHash function and updates certificate verification to use task-specific message hashes
src/contracts/interfaces/ITaskMailbox.sol	Adds interface declaration for the new getMessageHash function
src/test/unit/TaskMailboxUnit.t.sol	Updates test helper functions and adds comprehensive test coverage for certificate replay prevention

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[ypatil12]

One comment