Marvin Jones 172c58324e feat(lee): construct chained-call pre-states from protocol state (incremental update PR4) ...

ChainedCall.pre_states: Vec<AccountWithMetadata> becomes
pre_state_refs: Vec<AccountId>. A calling program no longer supplies
the concrete account value (or an is_authorized claim) for an account
it hands to a chained call — it only names which account, and the
protocol (sequencer for public transactions, host driver for
privacy-preserving ones) resolves the real, currently-tracked value
itself before invoking the callee.

This removes two things simultaneously: the burden on guest programs
to predict another call's outcome before it happens (the calling
program previously had no reliable way to know it), and the ability
to supply a stale or entirely fabricated account value at all. The
malicious_injector/malicious_launderer guest programs and
malicious_authorization_changer, which existed specifically to
demonstrate that forgery, are deleted — the attack they showed is now
a compile-time impossibility rather than something caught after the
fact by a runtime check.

The privacy circuit itself (execution_state.rs) needed no logic
changes: it never trusted a caller-supplied pre-state in the first
place, only the callee's own proven echo against its internally
tracked state. The public path already had the tracking map it
needed (state_diff); the privacy host driver gained one
(materialized_state), plus first-sighting position tracking so a
chained call's private-PDA authorization can be verified the same
way the circuit derives it internally.

Regenerates all lee_core/lez guest artifacts and the prebuilt
sequencer db fixture via `just build-artifacts`, required since
ChainedCall's shape is part of the proven wire format.

2026-08-22 15:19:55 -04:00

385 KiB

Raw History

View Raw