Repository navigation
refactor(lee)!: derive immutable-mirror AccountId without npk/vpk - #903
Merged
jonesmarvin8 merged 2 commits intoSep 22, 2026
Conversation
8 tasks done
jonesmarvin8
changed the title
This was referenced Sep 19, 2026
added 2 commits
September 22, 2026 05:49
…ivate-PDA reuse
Replace immutable_mirror_account_id/immutable_mirror_vpk and the sentinel
IMMUTABLE_MIRROR_NPK with AccountId::for_immutable_mirror, a proper sibling
to for_shadow_program/for_private_pda. The mirror's address never had a
controlling key pair to begin with, so routing it through
AccountId::for_private_pda with a placeholder npk/vpk was misleading;
it's now its own domain-separated derivation
(SHA256("/LEE/v0.3/AccountId/ImmutMirror/" || header_account_id)).
Adds pinned-value and address-distinctness unit tests, and rebuilds the
privacy_preserving_circuit guest artifact to match.
rustls 0.23.40 is flagged by a newly-published advisory (TLS 1.3 handshake messages accepted across encryption level boundaries); bump to 0.23.45, the fixed version. Also rebuilds all guest artifacts and the prebuilt sequencer db fixture: CI's artifacts check rebuilds every ELF fresh and diffs against what's committed, and all of them (not just the one this branch's own commit touched) were already out of sync with a fresh build in CI's Docker image, inherited from the base branch.
jonesmarvin8
force-pushed
the
marvin/immutable-mirror-address-derivation
branch
from
September 22, 2026 09:50
64de38f to
81e2c21
Compare
jonesmarvin8
merged commit Sep 22, 2026
cf38db5
into
marvin/privacy-and-shadow-executions
10 of 13 checks passed
jonesmarvin8
pushed a commit
that referenced
this pull request
Sep 22, 2026
…programs Renamed ProgramImageWitness/ProgramImageClaim/ProgramKind's Public/Private variants to Disclosed/Undisclosed: both are publicly deployed programs, the distinction is only whether the claim discloses which one, and the old names read as if Private meant not publicly deployed. Asserted program_header.immutable in to_claim()'s Undisclosed arm, where prover-supplied witness data first crosses the trust boundary -- fail-fast defense in depth alongside the real invariant every other caller of immutable_mirror_commitment already enforces. Added account_id/self_account_id fields to FfiDependency and FfiProgramWithDependencies: ffi_kind_account_id derived every account id from kind + bytecode, silently assuming a Disclosed/Undisclosed program's header always lives at its own bijection address. It doesn't -- CreateHeader lets a deployer place a header at any address, and the native ProgramWithDependencies API already takes that address as an explicit parameter, but the FFI had no way to express it. Shadow keeps deriving from the bytecode, since that's definitional and there's no header to consult. Required is_authorized unconditionally for CreateHeader targets in finalize_header, matching UpdateHeader's existing rule. CreateHeader previously let a deployer place a header at any empty account with no authorization check at all; since AccountId::for_shadow_program is a plain forward hash, an attacker could compute a target program's shadow address in advance, deploy an unrelated "honest" header there to collect real public trust and funds, then dispatch a weaker program privately under the same address later to drain them -- no hash needs breaking, since the deployer chooses the target directly. The production wallet facade already always signs for the header's own key, so this closes the gap without touching any real deployment path; genesis bypasses CreateHeader entirely via insert_program, so it's unaffected too. Rebuilt the privacy_preserving_circuit RISC0 artifact, last regenerated at #903, one commit before #905 changed lee_core's circuit-input types -- the checked-in guest binary no longer matched the host's current encoding of PrivacyPreservingCircuitInput, so any shadow-program proof failed in-guest with a Borsh length mismatch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🎯 Purpose
Removes unnecessary
npkandvpkused to generate the commitment for an immutable program.BREAKING CHANGE: Breaking change over PR 824 in how
AccountIds are computed for immutable programs (in the private state); does not affect anything indev.⚙️ Approach
immutable_mirror_account_id,immutable_mirror_vpk, and theIMMUTABLE_MIRROR_NPKsentinel constantAccountId::for_immutable_mirror:SHA256("/LEE/v0.3/AccountId/ImmutMirror/" || header_account_id)immutable_mirror_commitmentto call the new method (signature unchanged; all 5 existing callers unaffected)🧪 How to Test
All previous tests should work; new tests added:
for_immutable_mirror_matches_pinned_valuefor_immutable_mirror_differs_for_different_header🔗 Dependencies
PR 824; should merge after it.
🔜 Future Work
N/A
📋 PR Completion Checklist