[audit][C013] Fallback deletion costs credit absent or already deleted data

[QuantumExplorer]

Audit group: C013. Classification: correctness. Provisional severity: low.

The no-cost-info deletion fallback reads committed state, turns absence into a zero value length, then still includes key/prefix bytes in removed-byte accounting. Using committed rather than transaction-visible prestate can also count data already deleted earlier in the transaction. Ordinary Merk deletion supplies explicit costs; this fallback is documented for cleanup/utility use, including auxiliary data outside the authenticated element hierarchy.

Expected contract and correction: Either make fallback removal estimates existence- and transaction-aware, reporting zero for absent data, or explicitly constrain/document their approximate non-credit contract. Preserve supplied-cost paths and historical semantics. This is a correctness follow-up to #616, not a claim that its trusted cleanup boundary is exploitable.

Validation to complete

• Verify absent data receives no actual removal attribution when exact costs are promised.
• Verify prior transaction operations are reflected in exact fallback prestate accounting.
• Keep supplied-cost Merk deletions and intended final-state batch semantics unchanged.

Limits and existing work

• The docs: document non-atomic delete cost computation (TOCTOU) #616 approximation rationale is material counterevidence and must remain in the issue.
• No monetary consumer of fallback auxiliary deletion costs was established.

Related tracking: issue #698 (closed), issue #683 (open), PR #616 (merged), PR #754 (merged).

Scope: saved GroveDB worktree with revision context 2fa0f133877420a0d9c91ba7bc51b1775ab8c783. This report does not establish that current develop or any deployed application is affected. Focused runtime validation remains outstanding.

Audit source and canonical finding identifiers

Source status: snapshot-backed (git_worktree); plain source locations are used because this is not a sealed commit-only scan.

Audited revision context: 2fa0f133877420a0d9c91ba7bc51b1775ab8c783.

The findings were manually reconciled from a preserved scan bundle. The native scan ended before final completion; these are provisional source-review findings, not a completed native scan certification.

Canonical finding ID: csf_a08ac94bdbb01c56bb8469b8

Primary fingerprint: codex-security/v1:sha256:f8c118e8978a99c1a5dd9fe43169a5b5870267cadbd1ee9865f5fd84f9c6c178

Source locations:

• Location (entrypoint): grovedb/src/operations/auxiliary.rs:80-132
• Location (root_control): storage/src/rocksdb_storage/storage.rs:383-462