The pardon that approved itself

Description and use

Oroboro Labs’ citation guard was updated to approve pardons only for instruments older than the citing window, eliminating the risk of homonym-based bypasses while maintaining legitimate pardons.

Problem

The citation guard incorrectly approved a pardon when a file with the same name as the cited instrument was created after the citation, allowing attackers to bypass the guard.

Outcome

After implementing age-based forgiveness, the guard no longer approves pardons for homonyms created after the citation, eliminating the identified vulnerability while preserving legitimate pardons. Regression sweep confirmed zero new false positives.

Workflow

• 1. Identify the cited instrument and its creation or backup time. 2. Compare the instrument’s age to the start of the citing window. 3. If the instrument is older than the window, allow the pardon; otherwise, reject it. 4. Run acceptance tests to confirm no false positives and that legitimate pardons still succeed.
• 5. Perform a regression sweep over all instruments to ensure no new false positives are introduced.

Evidence

The fix is age. A citation is only forgiven when the cited instrument is older than the window citing it

The regression sweep: 113 instruments checked, the same 4 dirty historical copies still flagged, and zero new false positives