Fix compilation:

cosmwasm/enclaves/shared/contract-engine/src/db.rs

@@ -104,11 +104,10 @@ pub fn create_encrypted_key(
 
     debug!(
         "Removed scrambled field name: {:?} and created new key with magic: {:?}",
-        scrambled_field_name
-        encrypted_key_with_header
+        scrambled_field_name, encrypted_key_with_header
     );
 
-    Ok((encrypted_key_with_header, gas_used_remove, db_data))
+    Ok((encrypted_key_with_header, gas_used_remove, encrypted_value))
 }
 
 pub fn read_from_encrypted_state(
@@ -429,20 +428,3 @@ fn encrypt_key_new(
             WasmEngineError::EncryptionError
     })
 }
-
-// This function is needed for when we migrate from the 2nd to the 3rd seed
-fn decrypt_key_new(
-    encrypted_state_key: &[u8],
-    contract_key: &ContractKey,
-) -> Result<Vec<u8>, WasmEngineError> {
-    let decryption_key = get_symmetrical_key_new(contract_key);
-
-    decryption_key.decrypt_siv(encrypted_state_key, Some(&[])).map_err(|err| {
-        warn!(
-            "read_db() got an error while trying to decrypt_key_new the key {:?}, stopping wasm: {:?}",
-            encrypted_state_key,
-            err
-        );
-        WasmEngineError::DecryptionError
-    })
-}

cosmwasm/enclaves/shared/contract-engine/src/wasm/contract.rs

@@ -16,9 +16,9 @@ use enclave_crypto::{sha_256, Ed25519PublicKey, WasmApiCryptoError};
 use enclave_utils::kv_cache::KvCache;
 
 use crate::contract_validation::ContractKey;
-use crate::db::{encrypt_key, read_encrypted_key};
+use crate::db::{create_encrypted_key, read_from_encrypted_state};
 // #[cfg(not(feature = "query-only"))]
-use crate::db::{remove_encrypted_key, /* write_encrypted_key, */ write_multiple_keys};
+use crate::db::{remove_from_encrypted_state, /* write_encrypted_key, */ write_multiple_keys};
 use crate::errors::WasmEngineError;
 use crate::gas::{WasmCosts, OCALL_BASE_GAS};
 use crate::query_chain::encrypt_and_query_chain;
@@ -345,12 +345,11 @@ impl WasmiApi for ContractInstance {
             &state_key_name,
             &self.context,
             &self.contract_key,
-            &mut self.kv_cache,
-        )?;
-        let (value, gas_used_by_storage) = read_from_encrypted_state(
-            &state_key_name,
-            &self.context,
-            &self.contract_key,
+            match self.operation {
+                ContractOperation::Init => true,
+                ContractOperation::Handle => true,
+                ContractOperation::Query => false,
+            },
             &mut self.kv_cache,
         )?;
         self.use_gas_externally(gas_used_by_storage)?;
@@ -509,7 +508,7 @@ impl WasmiApi for ContractInstance {
             .into_iter()
             .map(|(k, v)| {
                 let (enc_key, _, enc_v) =
-                    encrypt_key(&k, &v, &self.context, &self.contract_key).unwrap();
+                    create_encrypted_key(&k, &v, &self.context, &self.contract_key).unwrap();
 
                 (enc_key.to_vec(), enc_v)
             })

cosmwasm/enclaves/shared/contract-engine/src/wasm3/mod.rs

@@ -14,13 +14,11 @@ use enclave_crypto::{sha_256, Ed25519PublicKey, WasmApiCryptoError};
 use enclave_ffi_types::{Ctx, EnclaveError};
 
 use crate::contract_validation::ContractKey;
-#[cfg(not(feature = "query-only"))]
-use crate::db::write_to_encrypted_state;
 
 use crate::cosmwasm_config::ContractOperation;
-use crate::db::read_encrypted_key;
+use crate::db::read_from_encrypted_state;
 #[cfg(not(feature = "query-only"))]
-use crate::db::{remove_encrypted_key, write_multiple_keys};
+use crate::db::{remove_from_encrypted_state, write_multiple_keys};
 use crate::errors::{ToEnclaveError, ToEnclaveResult, WasmEngineError, WasmEngineResult};
 use crate::gas::{WasmCosts, READ_BASE_GAS, WRITE_BASE_GAS};
 use crate::query_chain::encrypt_and_query_chain;
@@ -530,14 +528,17 @@ impl Engine {
 
     #[cfg(not(feature = "query-only"))]
     pub fn flush_cache(&mut self) -> Result<(), EnclaveError> {
+        use crate::db::create_encrypted_key;
+
         let keys: Vec<(Vec<u8>, Vec<u8>)> = self
             .context
             .kv_cache
             .flush()
             .into_iter()
             .map(|(k, v)| {
                 let (enc_key, _, enc_v) =
-                    encrypt_key(&k, &v, &self.context.context, &self.context.contract_key).unwrap();
+                    create_encrypted_key(&k, &v, &self.context.context, &self.context.contract_key)
+                        .unwrap();
 
                 (enc_key.to_vec(), enc_v)
             })
@@ -822,10 +823,15 @@ fn host_read_db(
     }
 
     debug!("Missed value in cache");
-    let (value, used_gas) = read_encrypted_key(
+    let (value, used_gas) = read_from_encrypted_state(
         &state_key_name,
         &context.context,
         &context.contract_key,
+        match context.operation {
+            ContractOperation::Init => true,
+            ContractOperation::Handle => true,
+            ContractOperation::Query => false,
+        },
         &mut context.kv_cache,
     )
     .map_err(debug_err!("db_read failed to read key from storage"))?;
@@ -864,7 +870,8 @@ fn host_remove_db(
 
     debug!("db_remove removing key {}", show_bytes(&state_key_name));
 
-    let used_gas = remove_encrypted_key(&state_key_name, &context.context, &context.contract_key)?;
+    let used_gas =
+        remove_from_encrypted_state(&state_key_name, &context.context, &context.contract_key)?;
     context.use_gas_externally(used_gas);
 
     Ok(())

cosmwasm/enclaves/shared/crypto/src/key_manager.rs

@@ -209,11 +209,20 @@ impl Keychain {
     /// since we want to try and delete it either way
     pub fn delete_consensus_seed(&mut self) -> bool {
         debug!(
-            "Removing consensus seed in {}",
-            *CONSENSUS_SEED_SEALING_PATH
+            "Removing genesis consensus seed in {}",
+            *GENESIS_CONSENSUS_SEED_SEALING_PATH
+        );
+        if let Err(_e) = std::sgxfs::remove(GENESIS_CONSENSUS_SEED_SEALING_PATH.as_str()) {
+            debug!("Error removing genesis consensus_seed");
+            return false;
+        }
+
+        debug!(
+            "Removing current consensus seed in {}",
+            *CURRENT_CONSENSUS_SEED_SEALING_PATH
         );
-        if let Err(_e) = std::sgxfs::remove(CONSENSUS_SEED_SEALING_PATH.as_str()) {
-            debug!("Error removing consensus_seed");
+        if let Err(_e) = std::sgxfs::remove(CURRENT_CONSENSUS_SEED_SEALING_PATH.as_str()) {
+            debug!("Error removing genesis consensus_seed");
             return false;
         }
         self.consensus_seed = None;