Add Scribe's extended proof of possession

.env.example

@@ -15,9 +15,17 @@ export INITIAL_AUTHED=
 # Management Configurations
 export VALIDATOR_REGISTRY=
 ## IValidatorRegistry::lift single
-export VALIDATOR=
+export VALIDATOR_PUBLIC_KEY_X=
+export VALIDATOR_PUBLIC_KEY_Y=
+export VALIDATOR_SIG_V=
+export VALIDATOR_SIG_R=
+export VALIDATOR_SIG_S=
 ## IValidatorRegistry::lift multiple
-export VALIDATORS="[]"
+export VALIDATOR_PUBLIC_KEY_XS="[]"
+export VALIDATOR_PUBLIC_KEY_YS="[]"
+export VALIDATOR_SIG_VS="[]"
+export VALIDATOR_SIG_RS="[]"
+export VALIDATOR_SIG_SS="[]"
 ## IValidatorRegistry::drop single
 export VALIDATOR_ID=
 ## IValidatorRegistry::drop multiple

.github/workflows/ci.yml

@@ -0,0 +1,45 @@
+name: "CI"
+
+on:
+  push:
+    branches:
+      - "main"
+  pull_request:
+
+jobs:
+  lint:
+    runs-on: "ubuntu-latest"
+    steps:
+      - name: "Check out repo"
+        uses: "actions/checkout@v3"
+        with:
+          submodules: "recursive"
+
+      - name: "Install Foundry"
+        uses: "foundry-rs/foundry-toolchain@v1"
+        with:
+          version: "nightly"
+
+      - name: "Check formatting"
+        run: "forge fmt --check"
+
+  test:
+    runs-on: "ubuntu-latest"
+    steps:
+      - name: "Check out repo"
+        uses: "actions/checkout@v3"
+        with:
+          submodules: "recursive"
+
+      - name: "Install Foundry"
+        uses: "foundry-rs/foundry-toolchain@v1"
+        with:
+          version: "nightly"
+
+      - name: "Run Forge build"
+        run: "forge build"
+        id: "build"
+
+      - name: "Run Forge test"
+        run: "FOUNDRY_PROFILE=ci forge test -vvv"
+        id: "test"

.gitmodules

@@ -6,3 +6,7 @@
 	path = lib/chronicle-std
 	url = https://github.com/chronicleprotocol/chronicle-std
 	branch = v2
+[submodule "lib/scribe"]
+	path = lib/scribe
+	url = https://github.com/chronicleprotocol/scribe
+    branch = v2

README.md

@@ -1,4 +1,4 @@
-# ValidatorRegistry • [![Unit Tests](https://github.com/chronicleprotocol/validator-registry/actions/workflows/unit-tests.yml/badge.svg)](https://github.com/chronicleprotocol/validator-registry/actions/workflows/unit-tests.yml) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+# ValidatorRegistry • [![CI](https://github.com/chronicleprotocol/validator-registry/actions/workflows/ci.yml/badge.svg)](https://github.com/chronicleprotocol/validator-registry/actions/workflows/ci.yml) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
 This contract provides an onchain registry for _Chronicle Protocol_ validators via 1-byte validators ids.
 
@@ -8,12 +8,16 @@ Due to validator ids being 1 byte, the maximum number of feeds supported is 256.
 
 Note that a set of lifted validators can be encoded in a single uint. The code refers to it as `uint bloom`.
 
+> [!IMPORTANT]
+> Due to a vulnerability in Scribe this registry also implements a proof of possession to defend against rogue key attacks.
+> The proof of possession is an ECDSA signature signing a message derived from the validator's public key, the Chronicle Validator Registration Message V2.
+
 ## Installation
 
 Install module via Foundry:
 
 ```bash
-$ forge install chronicleprotocol/validator-registry@v1
+$ forge install chronicleprotocol/validator-registry@v2
 ```
 
 ## Contributing
@@ -42,12 +46,7 @@ Lint:
 $ forge fmt [--check]
 ```
 
-Update gas snapshots:
-
-```bash
-$ forge snapshot --nmt "Fuzz" [--check]
-```
-
 ## Dependencies
 
 - [chronicleprotocol/chronicle-std@v2](https://github.com/chronicleprotocol/chronicle-std/tree/v2)
+- [chronicleprotocol/scribe@v2](https://github.com/chronicleprotocol/scribe/tree/v2)

docs/Management.md

@@ -39,7 +39,11 @@ $ env | grep -e "RPC_URL" -e "KEYSTORE" -e "KEYSTORE_PASSWORD" -e "VALIDATOR_REG
 
 Set the following environment variables:
 
-- `VALIDATOR`: The validator's address
+- `VALIDATOR_PUBLIC_KEY_X`: The validator's public key's x coordinate
+- `VALIDATOR_PUBLIC_KEY_Y`: The validator's public key's y coordinate
+- `VALIDATOR_SIG_V`: The validator's registration signature's v value
+- `VALIDATOR_SIG_R`: The validator's registration signature's r value
+- `VALIDATOR_SIG_S`: The validator's registration signature's s value
 
 Run:
 
@@ -49,7 +53,7 @@ $ forge script \
     --password "$KEYSTORE_PASSWORD" \
     --broadcast \
     --rpc-url $RPC_URL \
-    --sig $(cast calldata "lift(address,address)" "$VALIDATOR_REGISTRY" "$VALIDATOR")\
+    --sig $(cast calldata "lift(address,uint,uint,uint8,bytes32,bytes32)" "$VALIDATOR_REGISTRY" "$VALIDATOR_PUBLIC_KEY_X" "$VALIDATOR_PUBLIC_KEY_Y" "$VALIDATOR_SIG_V" "$VALIDATOR_SIG_R" "$VALIDATOR_SIG_S")\
     -vvv \
     script/ValidatorRegistry.s.sol:ValidatorRegistryScript
 ```
@@ -58,7 +62,15 @@ $ forge script \
 
 Set the following environment variables:
 
-- `VALIDATORS`: The validators' addresses
+- `VALIDATOR_PUBLIC_KEY_XS`: The validators' public key's x coordinate
+    - Note to use the following format: `"[<elem>,<elem>]"`
+- `VALIDATOR_PUBLIC_KEY_YS`: The validators' public key's y coordinate
+    - Note to use the following format: `"[<elem>,<elem>]"`
+- `VALIDATOR_SIG_VS`: The validators' registration signature's v value
+    - Note to use the following format: `"[<elem>,<elem>]"`
+- `VALIDATOR_SIG_RS`: The validators' registration signature's r value
+    - Note to use the following format: `"[<elem>,<elem>]"`
+- `VALIDATOR_SIG_SS`: The validators' registration signature's s value
     - Note to use the following format: `"[<elem>,<elem>]"`
 
 Run:
@@ -69,7 +81,7 @@ $ forge script \
     --password "$KEYSTORE_PASSWORD" \
     --broadcast \
     --rpc-url $RPC_URL \
-    --sig $(cast calldata "lift(address,address[])" "$VALIDATOR_REGISTRY" "$VALIDATORS")\
+    --sig $(cast calldata "lift(address,uint[],uint[],uint8[],bytes32[],bytes32[])" "$VALIDATOR_REGISTRY" "$VALIDATOR_PUBLIC_KEY_XS" "$VALIDATOR_PUBLIC_KEY_YS" "$VALIDATOR_SIG_VS" "$VALIDATOR_SIG_RS" "$VALIDATOR_SIG_SS")\
     -vvv \
     script/ValidatorRegistry.s.sol:ValidatorRegistryScript
 ```

remappings.txt

@@ -3,3 +3,5 @@ forge-std/=lib/forge-std/src/
 
 chronicle-std/=lib/chronicle-std/src/
 @script/chronicle-std/=lib/chronicle-std/script/
+
+scribe/=lib/scribe/src/