Marvin Jones 7cea255449 feat(lee): add shadow programs ...

Adds a third way for a program to be referenced inside a privacy
preserving transaction: one that has never been deployed anywhere,
public or private, and never will be. AccountId::for_shadow_program
derives its dispatch address purely from its image id - no seed,
authority, or registration event, since none exists.

Unlike the existing Public/Private paths, nothing about a shadow
program's identity is ever committed to, in any form. Its identity is
established fresh, in-circuit, on every single dispatch from its elf
supplied as a private witness: the circuit decodes and hashes it,
derives the address, and feeds the result into the same program_owner
claim-checking mechanism every other program uses. That's a real,
unamortized cost paid every time, with no cheaper path possible
without disclosing the elf - the same cost regime privacy-preserving
transactions already lived in before image-id claims existed at all.

Identical bytecode from different provers intentionally collides on
the same address; this is accepted as natural deduplication rather
than a concern, since shadow programs can only ever operate on
private accounts and normal account authorization already governs
access.

2026-08-23 13:30:49 -04:00

427 KiB

Raw History

View Raw