Security MEDIUM: NameRegistry reverse-lookup poisoning

[philpof102-svg]

Severity: MEDIUM — identity confusion / phishing surface

NameRegistry.register() and update() write the didToName reverse mapping without checking whether the DID is already mapped. Attacker registers a different name with victim's DID → poisons reverseLookup(victimDID) to return attacker-chosen name → social engineering on any UI displaying agent names.

The forward mapping (name → did) is fine. The reverse direction is the only impacted surface, but it IS the canonical display direction for agent UIs.

Full PoC + fix in BUG_REPORT_name_reverse_lookup_poison.md.

Reporter @philpof102-svg — 4th PR in this audit run. Related : #5, #6, #7.

[philpof102-svg]

Upgraded with merge-ready fix (src/GitlawbNameRegistry.sol, +25/-6) plus regression tests.

Attack walkthrough

1. Alice : register('alice', 'did:gitlawb:alice') → didToName[hash]=alice
2. Attacker : register('alice-pay', 'did:gitlawb:alice') — name 'alice-pay' is free, no NameTaken
3. didToName[hash] overwritten to 'alice-pay' — consumers using reverseLookup(did) are now poisoned

Fix

// register()
bytes32 didHash = keccak256(bytes(did));
if (bytes(didToName[didHash]).length != 0) revert DIDAlreadyClaimed(didHash);

// update() — allow same-DID self-refresh
if (newDidHash != oldDidHash && bytes(didToName[newDidHash]).length != 0) {
    revert DIDAlreadyClaimed(newDidHash);
}

Also: both functions now reject empty-string DIDs (EmptyDID()) — separate edge case that lets attackers spam the '' reverse slot.

Regression tests (Foundry)

function test_DIDPoisoning_Reverts() public {
    registry.register('alice', 'did:gitlawb:alice');
    vm.prank(attacker);
    vm.expectRevert(abi.encodeWithSelector(
        GitlawbNameRegistry.DIDAlreadyClaimed.selector,
        keccak256(bytes('did:gitlawb:alice'))
    ));
    registry.register('alice-pay', 'did:gitlawb:alice');
}

function test_SameOwner_SameDID_UpdateIsNoOp() public {
    registry.register('alice', 'did:gitlawb:alice');
    registry.update('alice', 'did:gitlawb:alice');
    assertEq(registry.reverseLookup('did:gitlawb:alice'), 'alice');
}