N-27: `allow_unauthorized_output_notes` Cannot Authorize Otherwise-Empty Note-Creating Transactions
- Langage dominant
- Rust
- Étoiles
- 132
- Forks
- 167
- Merge moyen
- 1 j 23 h
- PR mergées (30 j)
- 110
Description
The `auth_tx_acl` procedure in `singlesig_acl.masm` allows an account to be configured to permit output-note creation without a signature through the `allow_unauthorized_output_notes` flag. When no authentication is required, the [no-authentication branch](https://github.com/0xMiden/protocol/blob/2ef8056323df258917d119383a7cdd49b064d88a/crates/miden-standards/asm/account_components/auth/singlesig_acl.masm#L152-L176) increments the account nonce only if the account state changed or the account is new.
An output note that removes assets from the account vault changes the account state, so such a transaction increments the nonce and is accepted. An output note that carries no assets, for example a data-only note, does not change the account state. In that case the branch does not increment the nonce, the account delta is empty, and because no input notes were consumed the transaction is rejected by the kernel epilogue with `ERR_EPILOGUE_EXECUTED_TRANSACTION_IS_EMPTY`. The kernel deliberately does not treat output-note creation as a chain-state change. As a result, `allow_unauthorized_output_notes` does not cover the full range of transactions it appears to authorize: an unsigned transaction whose only effect is the creation of an asset-less note cannot be executed, and consuming an input note to make the transaction non-empty is unavailable when `allow_unauthorized_input_notes` is `false`. The transaction fails closed, so this is a functionality limitation rather than a security issue, and the same limitation applies to any authentication component that increments the nonce conditionally.
Consider including output-note creation in the nonce-increment condition of the no-authentication branch, so that a permitted unsigned transaction that creates one or more output notes increments the nonce and is accepted. To avoid weakening the kernel's rejection of empty transactions, the nonce should be incremented only when output notes were actually created, in addition to the existing account-state-change and new-account conditions, and never for a transaction that creates no notes and changes no state.
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.