Address 0x-r4bbit's review comments on PR 215: expand the is_authorized
reasoning, explain the AMM account-drop bug and its soundness implication,
tag every not-expressible result with whether it's resolved (PR #621/#625)
or still open, and add an Action items table attributing each open item to
Zones (logos-execution-zone) or Programs (lez-programs).
The spel-framework dispatcher filter that drops the clock account is real, but
ValidatedStateDiff::from_public_transaction never checks that a program's output
accounts match the caller-declared message.account_ids, unlike the privacy
circuit's own account_identities.len() == states_iter.len() check. That absence
is why the drop went unnoticed by every pre-existing public AMM test. Update
findings.md's conclusion and add a dated correction to privacy-test-matrix.md
attributing this second, independent gap to logos-execution-zone.
Root cause: advance_clock() left the clock account DEFAULT_PROGRAM_ID-owned, which
spel-framework's guest dispatcher (upstream in logos-co/spel) silently drops from a
program's output as an unclaimed, non-default, default-owned account. That desynced
the privacy circuit's account count from the caller-supplied identities, blocking
every AMM chained-call privacy test with "Invalid account_identities length".
Fix: own the fixture's clock account with a placeholder non-default ProgramId.
Rewrote the 5 previously not-expressible Swap/AddLiquidity/RemoveLiquidity privacy
tests to assert real success (transaction applied, resulting state and private
commitments verified) now that they're unblocked.
Added 5 more tests: Swap to a fresh PrivateUnauthorized/PrivateAuthorizedInit
destination (both confirmed not-expressible, for two distinct reasons — guest ABI
signer requirement vs. destination-must-already-exist), and NewDefinition with a
private PrivateAuthorizedInit/PrivateUnauthorized initial LP holder (expressible for
the former, not for the latter).
Updated docs/findings.md and docs/privacy-test-matrix.md accordingly.
Adds ata_group_owned_owner_signing (Burn's missing GROUP variant) and two NewFungibleDefinition
private-initial-holder tests to Token. Removes two experimental PDA-external-seed Token tests
that had no real coverage purpose. Documents the root cause of the AMM privacy-test blocker
(a spel-framework guest-wrapper filter silently drops the clock account before either
transaction validator sees it) with full findings/matrix writeups, and reconciles table gaps
found while cross-checking each program's privacy tests against docs/findings.md.
Adds private-account tests for AMM's SwapExactInput/SwapExactOutput, AddLiquidity, and
RemoveLiquidity confirming the "Invalid account_identities length" circuit bug also fires
with real private accounts, not just the all-public control case, plus a distinct
RemoveLiquidity finding (destination must already exist). Also deduplicates the
shielded_token_transfer test helper and updates findings/matrix docs accordingly.
Documents the private-account primitives (private PDA vs public PDA, group-shared
accounts) and per-program privacy test results in docs/findings.md. Adds a
stablecoin test confirming WithdrawCollateral can't pay out to a brand-new private
destination, and folds in further ATA/token privacy test refinements.
Marvin Jones