fix(enforcers): LogicalOrWrapperEnforcer groups silently share stateful sub-enforcer state

[SashaMIT]

Summary

• LogicalOrWrapperEnforcer forwards the raw _delegationHash to every caveat in the selected group.
• Stateful enforcers (MultiTokenPeriodEnforcer, ERC20StreamingEnforcer, LimitedCallsEnforcer, NativeTokenPaymentEnforcer, …) key their state by delegation hash — terms are not part of the key.
• Result: all groups that reference the same stateful enforcer instance share one state. Whichever group the redeemer picks first initialises it (pinning a period start, filling a call counter, seeding a spent-map) for every other group — and the header security notice, which correctly warns about least-restrictive-group selection, does not cover this cross-group interference. A delegator can follow the documented guidance ("each group a complete, equally secure permission set") and still get budgets that leak across groups.
• Fix: the wrapper now forwards keccak256(abi.encode(delegationHash, groupIndex)), isolating each group's state. A deliberately shared budget remains expressible by placing the caveats in a single group. Verified that no in-repo enforcer uses the delegation hash for anything except state keying / event fields, so namespacing is safe.
• One integration note: sub-enforcer events now carry the namespaced hash; indexers can recompute it from delegationHash + groupIndex (both available at redemption).

Impact if unsolved

Any delegation using this wrapper with the same stateful enforcer in multiple groups gets cross-group interference the delegator never agreed to: e.g. a 100/day group and a 100/week group share one counter and one period start, so the daily path consumes the weekly path's budget (or vice versa), and the first redemption permanently pins the period anchor for both. The mismatch between documented semantics and actual state semantics is invisible at signing time.

Test plan

• New test_statefulEnforcerStateIsIsolatedPerGroup: two groups, same LimitedCallsEnforcer (limit 1 each) — each group gets its own independent call allowance; fails without the fix (mutation-verified).
• 10 existing stateful-integration tests updated to read sub-enforcer state via the namespaced key.
• LogicalOrWrapperEnforcerTest 43/43; full test/enforcers suite 581/581.

Made with Cursor

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit edf621a. Configure here.}