[Bug]: register retry replays an unauthenticated plaintext transferDestination from the retry cache

Component

Other

Priority

P2

What happened?

The registration retry cache (~/.dotns/registrations/<env>__<addr>__<label>.json) protects only the commit secret. owner, maxPrice, reserved and transferDestination are plaintext with no integrity check, and register retry replays them as-is. transferDestination in particular is executed after mint: the freshly registered name is auto-transferred to whatever address the file says.

Reproduced with 0.9.0: interrupted a registration after the commit, edited transferDestination in the cache file to a foreign address, ran register retry — it loaded the tampered record without complaint, decrypted the secret, and proceeded toward mint-then-transfer (aborted before the reveal tx). register list shows no tamper warning either.

Precondition is local write access to the cache dir (mode 700/600 helps), so this needs a compromised or shared machine — but the outcome is losing the name to the attacker while signing with your own key.

Expected behavior

Bind the whole record (or at least owner/transferDestination/maxPrice) into the AEAD instead of only the secret, and refuse records that fail authentication. owner is already protected indirectly by the commitment hash; the transfer destination is not.

Trace the registration retry cache implementation for ~/.dotns/registrations/.json and the register retry and register list entry points. Start by examining how the AEAD currently protects the commit secret and how cached fields are loaded. Done means tampered authenticated fields are rejected rather than replayed, with the relevant retry behavior covered by tests if the project has them.