From 84b5d66346674067f7fcd8d8245c4ba1f47db4bc Mon Sep 17 00:00:00 2001
From: Artem Gureev <artguril@proton.me>
Date: Mon, 6 Jul 2026 10:41:15 +0000
Subject: [PATCH] fix(wallet): encapsulate dummy note epk in wallet

---
 .../privacy_preserving_circuit.bin            | Bin 641136 -> 641136 bytes
 lee/privacy_preserving_circuit/src/output.rs  |   8 ++++++++
 lez/wallet/src/account_manager.rs             |  11 ++++++-----
 3 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/artifacts/lee/privacy_preserving_circuit/privacy_preserving_circuit.bin b/artifacts/lee/privacy_preserving_circuit/privacy_preserving_circuit.bin
index ee1d76a652df7a0cb39f364b53ab851247e8105f..0b8a49106b22b08bca1e9355784c3063af8a5b48 100644
GIT binary patch
delta 779
zcmew`LH)x7^@bM47N!>FEi49410@(47`PZ17~XtTVbB56l0d!;5?=wx*FxeO1NqWO
zd{;E}9@872vbZz)x1W5<0>rF9%(ngHQ+B;f5la(OOG6V=6C-nDGh+jDBQs+QhUxNh
z>}pabdO0~|xq4U>Oy3yCp}xJypQA%h7@M@CEKu5{jzgabxAD{GHgK@xk-pc!!GT9w
zp%IU6btzMvZr@(h$T6J_kIB9rcrEV7D=lS))8gqDu5(CDXYJ(pi_>!T>9$=Q>{x@e
z@E3>hba_V(h3Q>g90}NzZ2#NE;md?gW~x1Vs3dN8@iDR|Na2)*BnD|C{0h{kukFJV
dA!^g#^>J`ubK7)ZHxBi7gMN<f2K}54mH@(Dx2XUC

delta 779
zcmew`LH)x7^@bM47N!>FEi4941H~8_7`PZ17~XtTVbB56;y}I(5?=zy*FxfJ1NqWO
zd|Nd24$~W-vbZz4x1W5<0>rF9%(ngHQ+B;f5o0qGGZRxYQ*%=z0~2E-Qxjt|hUxNh
z>}pabdO0~|xq4U>Oy3yCp}xJypQA%h7@M@CEKu5{jzgabxAD{GHgK@xk-pc!!GT9w
zp%IU6btzMvZr@(h$T6J_kIB9rcrEV7D=lS))8gqDu5(CDXYJ(pi_>!T>9$=Q>{x@e
z@E3>hba_V(h3Q>g90}NzZ2#NE;md?gW~x1Vs3dN8@iDR|Na2)*BnD|C{0h{kukFJV
dA!^g#^>J`ubK7)ZHxBi7gMN<f2K}54mH=)lw$%Ut

diff --git a/lee/privacy_preserving_circuit/src/output.rs b/lee/privacy_preserving_circuit/src/output.rs
index 1576e80e..9ae530b2 100644
--- a/lee/privacy_preserving_circuit/src/output.rs
+++ b/lee/privacy_preserving_circuit/src/output.rs
@@ -271,12 +271,20 @@ pub fn compute_circuit_output(
 }
 
 fn emit_dummy_output(output: &mut PrivacyPreservingCircuitOutput, dummy: DummyInput) {
+    // Note: the nullifiers and commitments are generated from seeds.
+    // The prover is responsible for their randomness.
     let nullifier = Nullifier::for_dummy(&dummy.nullifier_seed);
     let commitment = Commitment::for_dummy(&nullifier, &dummy.commitment_seed);
     output
         .new_nullifiers
         .push((nullifier, dummy.commitment_root));
     output.new_commitments.push(commitment);
+    // Note: the encrypted post states are pushed as fed into the circuit.
+    // That means that the prover is responsible for managing the randomness
+    // so as to not reveal the padding.
+    //
+    // In particular, it is recommended to generate the ML KEM ciphertext
+    // explicitly as these are not uniformly random.
     output.encrypted_private_post_states.push(dummy.note);
 }
 
diff --git a/lez/wallet/src/account_manager.rs b/lez/wallet/src/account_manager.rs
index 2a819191..f156a1ef 100644
--- a/lez/wallet/src/account_manager.rs
+++ b/lez/wallet/src/account_manager.rs
@@ -8,8 +8,7 @@ use lee_core::{
     MembershipProof, NullifierPublicKey, NullifierSecretKey, PrivateAccountKind, SharedSecretKey,
     account::{Account, AccountWithMetadata, Nonce},
     encryption::{
-        Ciphertext, EncryptedAccountData, EphemeralPublicKey, ML_KEM_768_CIPHERTEXT_LEN, ViewTag,
-        ViewingPublicKey,
+        Ciphertext, EncryptedAccountData, MlKem768EncapsulationKey, ViewTag, ViewingPublicKey,
     },
 };
 use rand::{RngCore as _, rngs::OsRng};
@@ -651,16 +650,18 @@ fn random_vec(len: usize) -> Vec<u8> {
     bytes
 }
 
-/// Generates a dummy note: random bytes sized to a default-account ciphertext, a
-/// random epk, and a random view tag. Not decryptable — it only pads the journal.
+/// Generates a dummy note: random bytes sized to a default-account ciphertext, a real
+/// ML-KEM ciphertext epk toward a throwaway key, and a random view tag.
 fn random_dummy_note() -> EncryptedAccountData {
     // Sized to a default-account ciphertext; matching real data sizes is a separate issue.
     let ciphertext_len = PrivateAccountKind::HEADER_LEN
         .checked_add(Account::default().to_bytes().len())
         .expect("dummy ciphertext length fits in usize");
+    let throwaway_ek = MlKem768EncapsulationKey::from_seed(&random_bytes(), &random_bytes());
+    let (_, epk) = SharedSecretKey::encapsulate(&throwaway_ek);
     EncryptedAccountData {
         ciphertext: Ciphertext::from_inner(random_vec(ciphertext_len)),
-        epk: EphemeralPublicKey(random_vec(ML_KEM_768_CIPHERTEXT_LEN)),
+        epk,
         view_tag: random_view_tag(),
     }
 }