Authentication Does Not Bind Runtime-Computed Fee or Enforce Max Fee

The transaction kernel calculates fees dynamically based on the number of executed VM
cycles and a base fee parameter. The compute_fee procedure determines the cost by
measuring the current clock cycle, adding a fixed estimate for post-fee work, and applying a
logarithmic scaling factor. This design intends to charge users proportionally for the
computational resources consumed during transaction execution.

However, the finalize_transaction procedure authenticates the transaction before the
final fee is computed or deducted. The standard authentication scheme signs a transaction
summary derived from state commitments (inputs, outputs, account delta) but omits the
transaction script root or a maximum fee limit. Consequently, a relayer or prover can modify the
executed program by substituting a computationally expensive transaction script root that
preserves the same state commitments, to artificially inflate the cycle count. Since the fee is
derived from the clock cycle at the end of execution, this manipulation increases the cost
without invalidating the user's signature, exposing signers to fee griefing or forced failures if the
account vault cannot cover the inflated amount.

Consider introducing a signer-controlled fee bound, such as a maximum fee or maximum
cycles parameter, that is included in the signed transaction summary and enforced by the
kernel before fee deduction. Additionally, consider implementing a syscall that exposes the
current fee to the user context.

_From the tx kernel audit_

We can't expose the current fee to the user context as the final fee is only known until after the auth procedure has completed.

The best way to prevent griefing would be to commit to the tx script root as part of authentication in order to prevent someone else from swapping the tx script for a more expensive one.

Related: Something similar was proposed in https://github.com/0xMiden/protocol/discussions/2551 to commit to the fee script and/or its fee args. Eventually, the tx summary may have to commit to both tx script root and the fee script root/args. FYI @partylikeits1983.