0xMiden / 0xMiden/protocol

N-27: `allow_unauthorized_output_notes` Cannot Authorize Otherwise-Empty Note-Creating Transactions

Đang mở
#3,262 1 bình luận 0 reaction 0 người được giao Xem trên GitHub
standards
Ngôn ngữ chính
Rust
Star
132
Fork
167
Merge trung bình
1 ngày 23 giờ
Pull request đã merge (30 ngày)
110

Mô tả

The `auth_tx_acl` procedure in `singlesig_acl.masm` allows an account to be configured to permit output-note creation without a signature through the `allow_unauthorized_output_notes` flag. When no authentication is required, the [no-authentication branch](https://github.com/0xMiden/protocol/blob/2ef8056323df258917d119383a7cdd49b064d88a/crates/miden-standards/asm/account_components/auth/singlesig_acl.masm#L152-L176) increments the account nonce only if the account state changed or the account is new.

An output note that removes assets from the account vault changes the account state, so such a transaction increments the nonce and is accepted. An output note that carries no assets, for example a data-only note, does not change the account state. In that case the branch does not increment the nonce, the account delta is empty, and because no input notes were consumed the transaction is rejected by the kernel epilogue with `ERR_EPILOGUE_EXECUTED_TRANSACTION_IS_EMPTY`. The kernel deliberately does not treat output-note creation as a chain-state change. As a result, `allow_unauthorized_output_notes` does not cover the full range of transactions it appears to authorize: an unsigned transaction whose only effect is the creation of an asset-less note cannot be executed, and consuming an input note to make the transaction non-empty is unavailable when `allow_unauthorized_input_notes` is `false`. The transaction fails closed, so this is a functionality limitation rather than a security issue, and the same limitation applies to any authentication component that increments the nonce conditionally.

Consider including output-note creation in the nonce-increment condition of the no-authentication branch, so that a permitted unsigned transaction that creates one or more output notes increments the nonce and is accepted. To avoid weakening the kernel's rejection of empty transactions, the nonce should be incremented only when output notes were actually created, in addition to the existing account-state-change and new-account conditions, and never for a transaction that creates no notes and changes no state.

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.