C-01: Hardcoded Global Hasher Type Creates Governance and Upgrade Risks

Summary

The codebase hardcodes Blake3 as the global hasher via pub type HasherType = Blake3Hash.

Vulnerability details

1
/// The global hasher type
2
pub type HasherType = Blake3Hash;
3

4
pub struct Sha256Hash(sha2::Sha256);
5

6
pub struct Blake3Hash(blake3::Hasher);
7
impl Hasher for Blake3Hash {
8
    fn new() -> Self {
9
        Self(blake3::Hasher::new())
10
    }

Impact

That design couples consensus-relevant hashing behavior to a compile-time type alias. Any future algorithm migration would require broad code changes and tightly coordinated rollout, which raises governance and upgrade risk.

Recommendation

Move hashing behind configuration-driven selection or an abstraction layer that can support protocol transitions explicitly.