ChainedCall.pre_states: Vec<AccountWithMetadata> becomes
pre_state_refs: Vec<AccountId>. A calling program no longer supplies
the concrete account value (or an is_authorized claim) for an account
it hands to a chained call — it only names which account, and the
protocol (sequencer for public transactions, host driver for
privacy-preserving ones) resolves the real, currently-tracked value
itself before invoking the callee.
This removes two things simultaneously: the burden on guest programs
to predict another call's outcome before it happens (the calling
program previously had no reliable way to know it), and the ability
to supply a stale or entirely fabricated account value at all. The
malicious_injector/malicious_launderer guest programs and
malicious_authorization_changer, which existed specifically to
demonstrate that forgery, are deleted — the attack they showed is now
a compile-time impossibility rather than something caught after the
fact by a runtime check.
The privacy circuit itself (execution_state.rs) needed no logic
changes: it never trusted a caller-supplied pre-state in the first
place, only the callee's own proven echo against its internally
tracked state. The public path already had the tracking map it
needed (state_diff); the privacy host driver gained one
(materialized_state), plus first-sighting position tracking so a
chained call's private-PDA authorization can be verified the same
way the circuit derives it internally.
Regenerates all lee_core/lez guest artifacts and the prebuilt
sequencer db fixture via `just build-artifacts`, required since
ChainedCall's shape is part of the proven wire format.
Resolves needless_pass_by_value (take AccountWithMetadata/Account by
reference where only borrowed), unnecessary_wraps (drop Result<Data,
Infallible> from passthrough update_from_diff implementations),
missing_const_for_fn, useless_let_if_seq, arbitrary_source_item_ordering,
too_many_arguments, redundant_clone, and useless_conversion across the
guest programs and lee core touched by the incremental-updates rebase.
marvin/incremental-updates-2 was not cargo +nightly fmt --check clean;
these files had drifted since the last fmt pass (mostly unwrapped
long import lists). No functional changes.
Rebasing onto marvin/incremental-updates-1's AccountDiff.diff_data:
Option<Data> change (was Option<Vec<u8>>) needed real fixes, not just a
mechanical rebase: every program's update_from_diff and every
diff_data-constructing call site was still written against the old
Vec<u8> shape. Several sites were doing a pointless Data -> Vec<u8> ->
Data round trip to satisfy the old field type; those now just pass the
Data value straight through. The host-side
execute_update_from_diff/prove_update_from_diff/write_update_from_diff_inputs
in lee/state_machine move to Data too, matching what now flows from
lee_core.
Programs now report AccountDiff/AccountDiffOutput instead of full
post-states; balance changes are applied via apply_balance_diff's
checked arithmetic at the protocol level rather than checked in-guest,
and data changes are materialized through a new update_from_diff
guest entrypoint (trusted execution for public transactions, proven
via a recursive receipt for the privacy-preserving circuit). All 15
production programs and test/example guest programs are converted;
attack-surface guest programs that are now structurally impossible
(nonce/program_owner mutation) or redundant (manual balance-sufficiency
bypass) are moved to a dormant/ directory rather than deleted outright.
BREAKING CHANGE: WrappedTokenConfig and ReceiverConfig gain a governance field and CrossZoneConfig gains source_governance, so the config layouts change and every program image id moves.
Marvin Jones