Component
Proof of Personhood
Priority
P0
Summary
A separate contract, the gateway dispatcher, exists only to prove a Root-origin dispatch to the PoP controller. It was needed because a UUPS implementation running inside its proxy could not ask the revive System precompile about its own caller. The precompile now answers callerIsRoot from the caller of the contract that calls it, so the controller can verify Root from its own proxy frame. Remove the dispatcher and have the controller check Root directly. Part of #214.
Proposal
Do this in order:
- First prove the premise on a revive runtime (Paseo or a revive integration test): a Root-origin call to the controller proxy makes
ISystem(0x0900).callerIsRoot() return true when read from the controller. Do not remove anything until this holds. The dispatcher exists because it did not hold before, so this check is the gate for the rest.
- Change the controller gateway check to require
ISystem(REVIVE_SYSTEM).callerIsRoot() instead of matching msg.sender against the gateway address on the registry.
- Delete the dispatcher contract and its tests.
- Remove the gateway registry key and the deploy step that registered the dispatcher. Coordinate with the gateway pallet owner so the pallet dispatches at the controller proxy address rather than the dispatcher.
- If the pallet sends a normal selector-prefixed call, remove the raw-bytes entrypoint overloads and the internal self-delegatecall that decodes them. If the pallet cannot, keep them and say why in the pull request.
- Rewrite the dispatcher and Root-propagation notes in the README and the controller documentation so they describe the direct check. State present behaviour only, with no reference to the removed contract.
Acceptance criteria
Component
Proof of Personhood
Priority
P0
Summary
A separate contract, the gateway dispatcher, exists only to prove a Root-origin dispatch to the PoP controller. It was needed because a UUPS implementation running inside its proxy could not ask the revive System precompile about its own caller. The precompile now answers
callerIsRootfrom the caller of the contract that calls it, so the controller can verify Root from its own proxy frame. Remove the dispatcher and have the controller check Root directly. Part of #214.Proposal
Do this in order:
ISystem(0x0900).callerIsRoot()return true when read from the controller. Do not remove anything until this holds. The dispatcher exists because it did not hold before, so this check is the gate for the rest.ISystem(REVIVE_SYSTEM).callerIsRoot()instead of matchingmsg.senderagainst the gateway address on the registry.Acceptance criteria