fix(security): minor security bugs

[GHkrishna]

Description

Three low severity findings from the internal audit, grouped together.

Subname paths now have a length limit. isNamePath checked that each dot separated segment was at most 63 octets but never checked the path as a whole, so a caller could build an arbitrarily long parentLabel out of legal segments. setSubnodeOwner stores the resulting full name in the new owner's LabelStore, and that row cannot be deleted, so the text sat there permanently and made every enumeration that reads it back more expensive. The path is now capped at 255 octets, which is the DNS wire format ceiling. A path over that limit reverts with ParentLabelMismatch, same as a malformed one. Nothing live comes close: real parent paths are one or two labels.

CI now enforces the live manifest rule. CONTRIBUTING.md says a code PR must not edit deployments/<network>/<chainId>.json, because those files are records of what is actually deployed and they ship straight into the deployments.json release asset. The CREATE3 parity gates compare deployments/expected.json instead, so nothing was checking the live files. A new job in release-metadata.yml fails a PR that touches one, unless the PR carries the deployment-record label, which is what a real deploy uses.

setOwner now mentions subnames. The comment on setOwner warned that a name sold directly keeps the seller's resolver pointer until the buyer overwrites it. That is true for the node itself but not for anything under it: a subname stores its own owner and isAuthorised returns on that before it looks at the registrar, so the seller keeps write access to every subname they created until the buyer reassigns each one. Someone acting on the old wording would clean up the node and think the name was clear. Added to both the implementation and the interface.

Type

• Bug fix
• Feature
• Breaking change
• Documentation
• Chore
• Refactor
• Security

Scope

• Registration
• Resolver
• Store
• Proof of Personhood
• Deployment scripts
• Tests

Related Issues

Internal security audit, low severity findings.

Fixes

Checklist

Code

• Follows project style
• forge build passes
• forge test passes
• No new compiler warnings

Testing

• New tests added for changed behavior
• Fuzz tests added where applicable
• Invariant tests verified

Security

• No new selfdestruct or delegatecall
• Access control reviewed
• No storage layout conflicts (for upgradeable contracts)

Documentation

• NatSpec updated on changed interfaces
• README updated if needed

Breaking Changes

• No breaking changes
• Breaking changes documented below

How to test

forge test --mt test_accepts_a_path_at_the_ceiling
forge test --mt test_rejects_a_path_one_octet_over_the_ceiling
forge test --mt test_subnode_parent_path_over_the_octet_ceiling_is_rejected

Notes

The length cap makes the injection cheaper to live with, it does not close it. Anyone holding a node can still name someone else as a subnode owner and push an undeletable row into their store. What changed is that the row is now bounded at roughly 320 octets instead of being unbounded, so the cost of reading it back is in the same range as a genuine row. Closing it properly means one of three things( they are design decisions though tbh): require the caller to be the subnode's new owner on the persist branch, give LabelStore an owner callable removal, or bound the scan in DotnsPopLens with a resumable cursor.

The deployment-record label has to exist in the repo before the new CI job is useful, otherwise a legitimate deploy PR has no way through.

The audit also flagged that the release workflows hold deployment keys with no environment gate. That one needs a GitHub environment set up before the workflow change means anything, so it is not inc in this PR.

[github-actions]

CI Summary

Check	Result
4naly3er Analysis	Found 38 issues: 5 medium, 8 low, 13 gas, 12 informational - View Report
Slither Analysis	Found 193 issues: 4 high, 40 medium, 90 low, 59 informational - View Report
Contract Tests (Unit + Fuzz)	All tests passed (683 total) - View Report
Contract Tests (Invariant)	All tests passed (58 total) - View Report
Gas Report	9 contracts analyzed - View Report
Coverage	Failed - Tests failed, cannot compute coverage
Documentation	Passed - 66 pages generated - View Docs
Format & Lint	Passed - Code formatted correctly
File Validation	Passed - All tracked files valid
Deploy Contracts	Reproduces the expected address set; resume verified
PR Title	PR Title Valid
Labels	Unknown
Secret Scan	Passed - No secrets detected

[re-gius]

Implementations looks solid, just a few comments on docs and tests

[re-gius]

LGTM