deregistration race condition

Layr-Labs · Oct 13, 2023 · c568910 · c568910
1 parent 94cf0f6
commit c568910
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 31 deletions.
diff --git a/src/contracts/middleware/BLSRegistryCoordinatorWithIndices.sol b/src/contracts/middleware/BLSRegistryCoordinatorWithIndices.sol
@@ -524,31 +524,35 @@ contract BLSRegistryCoordinatorWithIndices is EIP712, Initializable, IBLSRegistr
         bytes32 operatorId = _operators[operator].operatorId;
         require(operatorId == pubkey.hashG1Point(), "BLSRegistryCoordinatorWithIndices._deregisterOperatorWithCoordinator: operatorId does not match pubkey hash");
 
-        // get the quorumNumbers of the operator
+        // get the bitmap of quorums to remove the operator from
         uint256 quorumsToRemoveBitmap = BitmapUtils.orderedBytesArrayToBitmap(quorumNumbers);
-        require(quorumsToRemoveBitmap <= MAX_QUORUM_BITMAP, "BLSRegistryCoordinatorWithIndices._deregisterOperatorWithCoordinator: quorumsToRemoveBitmap exceeds of max bitmap size");
+
+        // get the quorum bitmap before the update
         uint256 operatorQuorumBitmapHistoryLengthMinusOne = _operatorIdToQuorumBitmapHistory[operatorId].length - 1;
         uint192 quorumBitmapBeforeUpdate = _operatorIdToQuorumBitmapHistory[operatorId][operatorQuorumBitmapHistoryLengthMinusOne].quorumBitmap;
-        // check that the quorumNumbers of the operator matches the quorumNumbers passed in
-        require(
-            quorumBitmapBeforeUpdate & quorumsToRemoveBitmap == quorumsToRemoveBitmap,
-            "BLSRegistryCoordinatorWithIndices._deregisterOperatorWithCoordinator: cannot deregister operator for quorums that it is not a part of"
-        );
+
+        // and out quorums that the operator is not a part of 
+        quorumsToRemoveBitmap = quorumBitmapBeforeUpdate & quorumsToRemoveBitmap;
+        bytes memory quorumNumbersToRemove = BitmapUtils.bitmapToBytesArray(quorumsToRemoveBitmap);
+
+        // make sure the operator is registered for at least one of the provided quorums
+        require(quorumNumbersToRemove.length != 0, "BLSRegistryCoordinatorWithIndices._deregisterOperatorWithCoordinator: operator is not registered for any of the provided quorums");
+
         // check if the operator is completely deregistering
         bool completeDeregistration = quorumBitmapBeforeUpdate == quorumsToRemoveBitmap;
 
-        _beforeDeregisterOperator(operator, quorumNumbers);
+        _beforeDeregisterOperator(operator, quorumNumbersToRemove);
 
         // deregister the operator from the BLSPubkeyRegistry
-        blsPubkeyRegistry.deregisterOperator(operator, quorumNumbers, pubkey);
+        blsPubkeyRegistry.deregisterOperator(operator, quorumNumbersToRemove, pubkey);
 
         // deregister the operator from the StakeRegistry
-        stakeRegistry.deregisterOperator(operatorId, quorumNumbers);
+        stakeRegistry.deregisterOperator(operatorId, quorumNumbersToRemove);
 
         // deregister the operator from the IndexRegistry
-        indexRegistry.deregisterOperator(operatorId, quorumNumbers, operatorIdsToSwap);
+        indexRegistry.deregisterOperator(operatorId, quorumNumbersToRemove, operatorIdsToSwap);
 
-        _afterDeregisterOperator(operator, quorumNumbers);
+        _afterDeregisterOperator(operator, quorumNumbersToRemove);
 
         // set the toBlockNumber of the operator's quorum bitmap update
         _operatorIdToQuorumBitmapHistory[operatorId][operatorQuorumBitmapHistoryLengthMinusOne].nextUpdateBlockNumber = uint32(block.number);

diff --git a/src/test/unit/BLSRegistryCoordinatorWithIndicesUnit.t.sol b/src/test/unit/BLSRegistryCoordinatorWithIndicesUnit.t.sol
@@ -375,22 +375,6 @@ contract BLSRegistryCoordinatorWithIndicesUnit is MockAVSDeployer {
         registryCoordinator.deregisterOperatorWithCoordinator(quorumNumbers, incorrectPubKey, new bytes32[](0));
     }
 
-    function testDeregisterOperatorWithCoordinator_InvalidQuorums_Reverts() public {
-        bytes memory quorumNumbers = new bytes(1);
-        quorumNumbers[0] = bytes1(defaultQuorumNumber);
-        uint256 quorumBitmap = BitmapUtils.orderedBytesArrayToBitmap(quorumNumbers);
-
-        _registerOperatorWithCoordinator(defaultOperator, quorumBitmap, defaultPubKey);
-
-        quorumNumbers = new bytes(2);
-        quorumNumbers[0] = bytes1(defaultQuorumNumber);
-        quorumNumbers[1] = bytes1(uint8(192));
-
-        cheats.expectRevert("BLSRegistryCoordinatorWithIndices._deregisterOperatorWithCoordinator: quorumsToRemoveBitmap exceeds of max bitmap size");
-        cheats.prank(defaultOperator);
-        registryCoordinator.deregisterOperatorWithCoordinator(quorumNumbers, defaultPubKey, new bytes32[](0));
-    }
-
     function testDeregisterOperatorWithCoordinator_IncorrectQuorums_Reverts() public {
         bytes memory quorumNumbers = new bytes(1);
         quorumNumbers[0] = bytes1(defaultQuorumNumber);
@@ -399,10 +383,10 @@ contract BLSRegistryCoordinatorWithIndicesUnit is MockAVSDeployer {
         _registerOperatorWithCoordinator(defaultOperator, quorumBitmap, defaultPubKey);
 
         quorumNumbers = new bytes(2);
-        quorumNumbers[0] = bytes1(defaultQuorumNumber);
-        quorumNumbers[1] = bytes1(defaultQuorumNumber + 1);
+        quorumNumbers[0] = bytes1(defaultQuorumNumber + 1);
+        quorumNumbers[1] = bytes1(defaultQuorumNumber + 2);
 
-        cheats.expectRevert("BLSRegistryCoordinatorWithIndices._deregisterOperatorWithCoordinator: cannot deregister operator for quorums that it is not a part of");
+        cheats.expectRevert("BLSRegistryCoordinatorWithIndices._deregisterOperatorWithCoordinator: operator is not registered for any of the provided quorums");
         cheats.prank(defaultOperator);
         registryCoordinator.deregisterOperatorWithCoordinator(quorumNumbers, defaultPubKey, new bytes32[](0));
     }