Address 0x-r4bbit's review comments on PR 215: expand the is_authorized
reasoning, explain the AMM account-drop bug and its soundness implication,
tag every not-expressible result with whether it's resolved (PR #621/#625)
or still open, and add an Action items table attributing each open item to
Zones (logos-execution-zone) or Programs (lez-programs).
Address 0x-r4bbit's review comments on PR 215: expand the is_authorized
reasoning, explain the AMM account-drop bug and its soundness implication,
tag every not-expressible result with whether it's resolved (PR #621/#625)
or still open, and add an Action items table attributing each open item to
Zones (logos-execution-zone) or Programs (lez-programs).
privacy-test-matrix.md was the AI-generated working scaffold behind
findings.md; its load-bearing content has been folded into findings.md, so
it's removed rather than left to drift out of sync.
The spel-framework dispatcher filter that drops the clock account is real, but
ValidatedStateDiff::from_public_transaction never checks that a program's output
accounts match the caller-declared message.account_ids, unlike the privacy
circuit's own account_identities.len() == states_iter.len() check. That absence
is why the drop went unnoticed by every pre-existing public AMM test. Update
findings.md's conclusion and add a dated correction to privacy-test-matrix.md
attributing this second, independent gap to logos-execution-zone.
Root cause: advance_clock() left the clock account DEFAULT_PROGRAM_ID-owned, which
spel-framework's guest dispatcher (upstream in logos-co/spel) silently drops from a
program's output as an unclaimed, non-default, default-owned account. That desynced
the privacy circuit's account count from the caller-supplied identities, blocking
every AMM chained-call privacy test with "Invalid account_identities length".
Fix: own the fixture's clock account with a placeholder non-default ProgramId.
Rewrote the 5 previously not-expressible Swap/AddLiquidity/RemoveLiquidity privacy
tests to assert real success (transaction applied, resulting state and private
commitments verified) now that they're unblocked.
Added 5 more tests: Swap to a fresh PrivateUnauthorized/PrivateAuthorizedInit
destination (both confirmed not-expressible, for two distinct reasons — guest ABI
signer requirement vs. destination-must-already-exist), and NewDefinition with a
private PrivateAuthorizedInit/PrivateUnauthorized initial LP holder (expressible for
the former, not for the latter).
Updated docs/findings.md and docs/privacy-test-matrix.md accordingly.
Adds ata_group_owned_owner_signing (Burn's missing GROUP variant) and two NewFungibleDefinition
private-initial-holder tests to Token. Removes two experimental PDA-external-seed Token tests
that had no real coverage purpose. Documents the root cause of the AMM privacy-test blocker
(a spel-framework guest-wrapper filter silently drops the clock account before either
transaction validator sees it) with full findings/matrix writeups, and reconciles table gaps
found while cross-checking each program's privacy tests against docs/findings.md.
Adds private-account tests for AMM's SwapExactInput/SwapExactOutput, AddLiquidity, and
RemoveLiquidity confirming the "Invalid account_identities length" circuit bug also fires
with real private accounts, not just the all-public control case, plus a distinct
RemoveLiquidity finding (destination must already exist). Also deduplicates the
shielded_token_transfer test helper and updates findings/matrix docs accordingly.
Documents the private-account primitives (private PDA vs public PDA, group-shared
accounts) and per-program privacy test results in docs/findings.md. Adds a
stablecoin test confirming WithdrawCollateral can't pay out to a brand-new private
destination, and folds in further ATA/token privacy test refinements.
Add Stablecoin privacy-preserving tests for WithdrawCollateral and RepayDebt
(personal and group-owned variants), plus a regression test confirming
OpenPosition is incompatible with the privacy circuit (chained-call
re-authorization). Close the last planned Token row (MintWithAuthority to a
private holding) and the ATA owner-signer gap for Transfer (personal and
group-owned), plus a defensive Create/group-owner test.
Extract shared privacy-test helpers (identity builders, GroupOwner
seal/unseal handshake) into integration_tests/src/lib.rs and use them
throughout token.rs, collapsing duplicated InputAccountIdentity/account
construction. Update docs/privacy-test-matrix.md with all new findings.
Validates the Q2 privacy features (shield/deshield, private-to-private transfers,
existing-account crediting, group-owned accounts, and private PDAs) against the
token and ata program flows, which previously ran almost entirely in public
context. Adds the key_protocol dependency for GMS-based group-account tests and
introduces a docs/privacy-test-matrix.md tracker mapping each program/instruction/
privacy-dimension combination to pass, fail, or not-expressible, with root-cause
findings for each gap (notably that private PDAs are structurally unsupported by
any program currently deriving addresses via for_public_pda).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Marvin Jones