0xMiden / 0xMiden/protocol

N-27: `allow_unauthorized_output_notes` Cannot Authorize Otherwise-Empty Note-Creating Transactions

Abierto
#3,262 1 comentario 0 reacciones 0 asignados Ver en GitHub
standards
Lenguaje dominante
Rust
Estrellas
132
Forks
167
Merge medio
1 d 23 h
PR fusionados (30 d)
110

Descripción

The `auth_tx_acl` procedure in `singlesig_acl.masm` allows an account to be configured to permit output-note creation without a signature through the `allow_unauthorized_output_notes` flag. When no authentication is required, the [no-authentication branch](https://github.com/0xMiden/protocol/blob/2ef8056323df258917d119383a7cdd49b064d88a/crates/miden-standards/asm/account_components/auth/singlesig_acl.masm#L152-L176) increments the account nonce only if the account state changed or the account is new.

An output note that removes assets from the account vault changes the account state, so such a transaction increments the nonce and is accepted. An output note that carries no assets, for example a data-only note, does not change the account state. In that case the branch does not increment the nonce, the account delta is empty, and because no input notes were consumed the transaction is rejected by the kernel epilogue with `ERR_EPILOGUE_EXECUTED_TRANSACTION_IS_EMPTY`. The kernel deliberately does not treat output-note creation as a chain-state change. As a result, `allow_unauthorized_output_notes` does not cover the full range of transactions it appears to authorize: an unsigned transaction whose only effect is the creation of an asset-less note cannot be executed, and consuming an input note to make the transaction non-empty is unavailable when `allow_unauthorized_input_notes` is `false`. The transaction fails closed, so this is a functionality limitation rather than a security issue, and the same limitation applies to any authentication component that increments the nonce conditionally.

Consider including output-note creation in the nonce-increment condition of the no-authentication branch, so that a permitted unsigned transaction that creates one or more output notes increments the nonce and is accepted. To avoid weakening the kernel's rejection of empty transactions, the nonce should be incremented only when output notes were actually created, in addition to the existing account-state-change and new-account conditions, and never for a transaction that creates no notes and changes no state.

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.