fix: restrict indexed input note asset removal (#3451)

* fix: restrict indexed input note asset removal

* refactor: share indexed input note removal guard

* test: make malicious input note theft regression explicit

* fix: require native account context for indexed input note asset removal

The account-origin check resolves the caller against the *active* account,
so the gate alone was bypassable: a malicious note script could route the
indexed removal through an attacker-controlled foreign account via FPI,
where that foreign account is active and vouches for its own procedures.
The full #3445 drain still worked end to end against a standard wallet.

Add exec.memory::assert_native_account to the guard, which closes that
path while leaving the one legitimate by-index caller intact (the fee
manager collects sponsorship note assets from the native account's auth
procedure).

Tests: a note-script-via-FPI regression test, and an explicit test that
transaction scripts are rejected too - the latter pins a behavior change
that was previously only implied by a deleted test.

---------

Co-authored-by: Claude (Opus) <noreply@anthropic.com>
Co-authored-by: Bobbin Threadbare <43513081+bobbinth@users.noreply.github.com>

Author: 3 people

CHANGELOG.md

@@ -54,6 +54,7 @@ Added a new `INPUT_NOTE_INDEX_LOOKUP_EVENT` that lets transaction hosts provide
 
 ### Fixes
 
+- Restricted indexed input-note asset removal to the native account's context while preserving active-note self-removal. As a consequence, note scripts and transaction scripts can no longer remove input-note assets by index directly, and neither can foreign accounts invoked through FPI; indexed removal must go through a procedure of the native account ([#3445](https://github.com/0xMiden/protocol/issues/3445)).
 - Fixed `faucet::mint` and `faucet::burn` failing when the asset's witness in the input vault had not already been loaded, which happened when minting into a faucet whose vault held other assets, or when burning an asset the transaction had not otherwise accessed; both procedures now request the witness from the host before updating the input vault ([#3409](https://github.com/0xMiden/protocol/pull/3409)).
 - Enforced the canonical encoding of `Authority` role map values on read: `Authority::try_from_storage` now rejects a procedure-role value word whose reserved felts (`value[1..=3]`) are non-zero, matching the value-slot check and completing the fix started in [#3209](https://github.com/0xMiden/protocol/pull/3209) ([#3415](https://github.com/0xMiden/protocol/pull/3415)).
 

crates/miden-protocol/asm/kernels/transaction/lib/api.masm

@@ -1119,7 +1119,9 @@ end
 #!
 #! Panics if:
 #! - the note index is greater or equal to the total number of input notes.
-#! - is_active_note is 1 and no input note is being processed (attempted to access note assets
+#! - is_active_note is false and the active account is not the native account.
+#! - is_active_note is false and the invocation does not originate from the account context.
+#! - is_active_note is true and no input note is being processed (attempted to access note assets
 #!   from incorrect context).
 #! - the asset's composition is Custom (not yet supported).
 #! - the asset is not present in the note.
@@ -1132,6 +1134,9 @@ pub proc input_note_remove_asset
     movup.9 swap
     # => [is_active_note, note_index, ASSET_ID, ASSET_VALUE, pad(6)]
 
+    exec.authenticate_indexed_input_note_asset_removal
+    # => [is_active_note, note_index, ASSET_ID, ASSET_VALUE, pad(6)]
+
     # get the input note pointer depending on whether the requested note is the active one or if it
     # was requested by index.
     exec.get_requested_note_ptr
@@ -1175,11 +1180,16 @@ end
 #!
 #! Panics if:
 #! - the note index is greater or equal to the total number of input notes.
-#! - is_active_note is 1 and no input note is being processed (attempted to access note assets
+#! - is_active_note is false and the active account is not the native account.
+#! - is_active_note is false and the invocation does not originate from the account context.
+#! - is_active_note is true and no input note is being processed (attempted to access note assets
 #!   from incorrect context).
 #!
 #! Invocation: dynexec
 pub proc input_note_remove_all_assets
+    exec.authenticate_indexed_input_note_asset_removal
+    # => [is_active_note, note_index, pad(14)]
+
     # get the input note pointer depending on whether the requested note is the active one or if it
     # was requested by index.
     exec.get_requested_note_ptr
@@ -2074,6 +2084,30 @@ end
 # HELPER PROCEDURES
 # =================================================================================================
 
+#! Authenticates indexed input-note asset removal while allowing active-note self-removal.
+#!
+#! The native account check is required in addition to the account-origin check: the latter
+#! resolves the caller against the active account, so without it a foreign account reached through
+#! FPI could authorize the removal with its own procedures.
+#!
+#! Inputs:  [is_active_note]
+#! Outputs: [is_active_note]
+#!
+#! Where:
+#! - is_active_note is the boolean flag indicating whether the assets are removed from the active
+#!   note or from the note with the specified index.
+#!
+#! Panics if:
+#! - is_active_note is false and the active account is not the native account.
+#! - is_active_note is false and the invocation does not originate from the account context.
+proc authenticate_indexed_input_note_asset_removal
+    dup eq.0
+    if.true
+        exec.memory::assert_native_account
+        exec.authenticate_account_origin
+    end
+end
+
 #! Returns the memory pointer to the input note, depending on whether the requested note is current
 #! or it was requested by index.
 #!

crates/miden-protocol/asm/protocol/src/input_note.masm

@@ -265,6 +265,7 @@ end
 #!   the EMPTY_WORD if the entire asset was removed.
 #!
 #! Panics if:
+#! - the invocation does not originate from the native account's account context.
 #! - the note index is greater or equal to the total number of input notes.
 #! - the asset's composition is Custom (not yet supported).
 #! - the asset is not present in the note.
@@ -348,6 +349,7 @@ end
 #! - num_assets is the number of assets removed by this procedure.
 #!
 #! Panics if:
+#! - the invocation does not originate from the native account's account context.
 #! - the note index is greater or equal to the total number of input notes.
 #!
 #! Invocation: exec