0xMiden / 0xMiden/protocol

N-27: `allow_unauthorized_output_notes` Cannot Authorize Otherwise-Empty Note-Creating Transactions

オープン
#3,262 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る
standards
主要言語
Rust
スター
132
フォーク
167
平均マージ
1日 23時間
マージ済み PR(30日)
110

説明

The `auth_tx_acl` procedure in `singlesig_acl.masm` allows an account to be configured to permit output-note creation without a signature through the `allow_unauthorized_output_notes` flag. When no authentication is required, the [no-authentication branch](https://github.com/0xMiden/protocol/blob/2ef8056323df258917d119383a7cdd49b064d88a/crates/miden-standards/asm/account_components/auth/singlesig_acl.masm#L152-L176) increments the account nonce only if the account state changed or the account is new.

An output note that removes assets from the account vault changes the account state, so such a transaction increments the nonce and is accepted. An output note that carries no assets, for example a data-only note, does not change the account state. In that case the branch does not increment the nonce, the account delta is empty, and because no input notes were consumed the transaction is rejected by the kernel epilogue with `ERR_EPILOGUE_EXECUTED_TRANSACTION_IS_EMPTY`. The kernel deliberately does not treat output-note creation as a chain-state change. As a result, `allow_unauthorized_output_notes` does not cover the full range of transactions it appears to authorize: an unsigned transaction whose only effect is the creation of an asset-less note cannot be executed, and consuming an input note to make the transaction non-empty is unavailable when `allow_unauthorized_input_notes` is `false`. The transaction fails closed, so this is a functionality limitation rather than a security issue, and the same limitation applies to any authentication component that increments the nonce conditionally.

Consider including output-note creation in the nonce-increment condition of the no-authentication branch, so that a permitted unsigned transaction that creates one or more output notes increments the nonce and is accepted. To avoid weakening the kernel's rejection of empty transactions, the nonce should be incremented only when output notes were actually created, in addition to the existing account-state-change and new-account conditions, and never for a transaction that creates no notes and changes no state.

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。