0xMiden / 0xMiden/protocol

L-33: Standard Components Sharing a Procedure Root Are Misreported as Custom

Open
#3,822 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
132
Forks
167
Avg merge
1d 23h
Merged PRs (30d)
110

Description

Account interface inference collects the exported procedure roots of an account into a mutable set and passes that set through a fixed sequence of standard component checks in `from_procedures`. Each check in `extract_component` matches when every root of the candidate component is present in the set, and then unconditionally removes those roots from it. Roots that survive the sequence are reported as `Custom`. Because a match claims its roots permanently, a root exported by two standard components is consumed by whichever component appears first in `extract_standard_components`, and the second component can no longer satisfy the all-roots-present condition.

The fungible faucet component and the code inspection component are a concrete instance, since both re-export `has_procedure` from `code_inspection.masm`, and `add_procedure` stores a root shared across components only once. An account that installs both components is therefore reported as a fungible faucet alone, with the three roots unique to the code inspection component placed in the `Custom` bucket. Reordering the sequence does not resolve the collision, because neither root set is a subset of the other, so checking code inspection first would suppress fungible faucet detection instead. The consequence is an incorrect component list returned by a public off-chain helper, which can mislead tooling and capability checks built on `AccountInterface`. The shipped faucet constructors do not install the code inspection component, so reaching the condition requires a hand-composed account, and the same collision would apply to the non-fungible faucet component once it is added to the standard component enumeration.

Consider matching each standard component against an unmutated copy of the exported root set and deriving the `Custom` bucket only after the full component set has been determined, or tracking each root with a reference count so that a shared root can satisfy more than one standard component.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.