ChainedCall.pre_states: Vec<AccountWithMetadata> becomes
pre_state_refs: Vec<AccountId>. A calling program no longer supplies
the concrete account value (or an is_authorized claim) for an account
it hands to a chained call — it only names which account, and the
protocol (sequencer for public transactions, host driver for
privacy-preserving ones) resolves the real, currently-tracked value
itself before invoking the callee.
This removes two things simultaneously: the burden on guest programs
to predict another call's outcome before it happens (the calling
program previously had no reliable way to know it), and the ability
to supply a stale or entirely fabricated account value at all. The
malicious_injector/malicious_launderer guest programs and
malicious_authorization_changer, which existed specifically to
demonstrate that forgery, are deleted — the attack they showed is now
a compile-time impossibility rather than something caught after the
fact by a runtime check.
The privacy circuit itself (execution_state.rs) needed no logic
changes: it never trusted a caller-supplied pre-state in the first
place, only the callee's own proven echo against its internally
tracked state. The public path already had the tracking map it
needed (state_diff); the privacy host driver gained one
(materialized_state), plus first-sighting position tracking so a
chained call's private-PDA authorization can be verified the same
way the circuit derives it internally.
Regenerates all lee_core/lez guest artifacts and the prebuilt
sequencer db fixture via `just build-artifacts`, required since
ChainedCall's shape is part of the proven wire format.
Resolves needless_pass_by_value (take AccountWithMetadata/Account by
reference where only borrowed), unnecessary_wraps (drop Result<Data,
Infallible> from passthrough update_from_diff implementations),
missing_const_for_fn, useless_let_if_seq, arbitrary_source_item_ordering,
too_many_arguments, redundant_clone, and useless_conversion across the
guest programs and lee core touched by the incremental-updates rebase.
marvin/incremental-updates-2 was not cargo +nightly fmt --check clean;
these files had drifted since the last fmt pass (mostly unwrapped
long import lists). No functional changes.
Programs now report AccountDiff/AccountDiffOutput instead of full
post-states; balance changes are applied via apply_balance_diff's
checked arithmetic at the protocol level rather than checked in-guest,
and data changes are materialized through a new update_from_diff
guest entrypoint (trusted execution for public transactions, proven
via a recursive receipt for the privacy-preserving circuit). All 15
production programs and test/example guest programs are converted;
attack-surface guest programs that are now structurally impossible
(nonce/program_owner mutation) or redundant (manual balance-sufficiency
bypass) are moved to a dormant/ directory rather than deleted outright.
BREAKING!
Before: Providing `nsk` was the same as authorizing a regular private
account.
After: A separate `ask` is required, making unauthorized private
updates possible.
BREAKING CHANGE: LEZ crates have been moved from top-level directories into
a dedicated `lez/` subdirectory. The following crates were relocated:
common → lez/common
indexer → lez/indexer
explorer_service→ lez/explorer_service
keycard_wallet → lez/keycard_wallet
mempool → lez/mempool
sequencer → lez/sequencer
storage → lez/storage
testnet_initial_state → lez/testnet_initial_state
wallet → lez/wallet
wallet-ffi → lez/wallet-ffi
Any external tooling, scripts, or paths referencing these crates at their
previous top-level locations must be updated.
BREAKING CHANGE:
- Crate `nssa` renamed to `lee`; update `Cargo.toml` dependencies from `nssa = { workspace = true }` to `lee = { workspace = true }`.
- Crate `nssa_core` renamed to `lee_core`; update similarly.
- Crate `key_protocol` moved under `lee`; update `Cargo.toml` dependencies from `key_protocol = { workspace = true }` to `lee_key_protocol = { workspace = true }`.
- Type `NSSATransaction` (in `common`) renamed to `LeeTransaction`.
- Error type `nssa::error::NssaError` renamed to `lee::error::LeeError`.
- Error type `nssa_core::error::NssaCoreError` renamed to `lee_core::error::LeeCoreError`.
- All `use nssa::` and `use nssa_core::` import paths must be updated to `use lee::` and `use lee_core::` respectively.
- Guest programs must replace `write_nssa_outputs` with `write_lee_outputs`.
- The sequencer RocksDB column family for the chain state was renamed. Existing databases are incompatible and must be wiped before running the new version.
- Domain separators updated: `"NSSA_seed"` → `"LEE_seed"` (key derivation), `"NSSA/v0.2/KDF-SHA256/"` → `"LEE/v0.2/KDF-SHA256/"` (encryption KDF), `"/NSSA/v0.2/AccountId/PDA/"` →
`"/LEE/v0.2/AccountId/PDA/"` (public PDA address derivation). All previously derived keys, encrypted outputs, and public PDA addresses are invalidated.
Addresses the following review comment:
- "I think this should be a constructor `AccountId::for_private_pda`.
Consider also removing the existing `impl From<(ProgramId, Seed)> for
AccountId` for public pdas in favor of a `AccountId::for_public_pda`
to have a unified way of constructing pdas"
I replaced `impl From<(&ProgramId, &PdaSeed)> for AccountId` with
`AccountId::for_public_pda(program_id: &ProgramId, seed: &PdaSeed) ->
Self` and replaced the free function `private_pda_account_id(...)`
with `AccountId::for_private_pda(program_id: &ProgramId, seed:
&PdaSeed, npk: &NullifierPublicKey) -> Self`. Both live in an inherent
`impl AccountId` block in nssa/core/src/program.rs next to the PDA
derivation logic. Migrated all call sites across nssa/core,
nssa/src/state.rs, nssa/src/validated_state_diff.rs,
program_methods/guest/src/bin/privacy_preserving_circuit.rs,
programs/amm/core, programs/associated_token_account/core, the example
tail-call binary, and the ATA tutorial doc. Test function names that
referenced the old free function were also renamed
(private_pda_account_id_* to for_private_pda_*).
Following the work done in
https://github.com/logos-blockchain/lssa/pull/292 and the comment on
extending the work
https://github.com/logos-blockchain/lssa/pull/292#pullrequestreview-3672282664,
this commit introduces a new `--label` option to the `wallet account
new` sub command.
**Usage**:
```
wallet account new public --label "Public test account"
wallet account new private --label "Private test account"
```
Labels have to be unique across all accounts in the wallet storage.
The commit also adds tests, which make use of the `WalletSubCommand`
trait functions (hence the change to make it a `pub trait`).
Marvin Jones