fix(protocol): assert reserved account state elements are zero at creation - #3609
Merged
Conversation
mmagician
force-pushed
the
mmagician-claude/fix-l12-reserved-elements-validation
branch
2 times, most recently
from
August 17, 2026 12:40
7671230 to
6ca06ce
Compare
mmagician
marked this pull request as ready for review
August 19, 2026 14:17
zeapoz
reviewed
Aug 19, 2026
mmagician
changed the base branch from
next
to
mmagician-claude/fix-l11-slot-type-validation
August 20, 2026 12:19
mmagician
force-pushed
the
mmagician-claude/fix-l12-reserved-elements-validation
branch
from
August 20, 2026 12:46
413f716 to
58d935d
Compare
…if-guard Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…tches if-guard Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
bobbinth
force-pushed
the
mmagician-claude/fix-l12-reserved-elements-validation
branch
from
August 20, 2026 23:08
58d935d to
9b8bd6a
Compare
bobbinth
approved these changes
Aug 20, 2026
bobbinth
left a comment
bobbinth
left a comment
Contributor
There was a problem hiding this comment.
Looks good! Thank you! I left a comment about a potential issue - though it is from the base PR.
Comment on lines
+1105
to
+1108
| pub proc get_account_reserved | ||
| exec.get_active_account_data_ptr add.ACCT_RESERVED_OFFSET | ||
| mem_load | ||
| end |
Contributor
There was a problem hiding this comment.
This is probably the element that would could use to keep track of the account versions.
…native account Both accessors introduced here resolve through the active account, but their only callers validate a new native account: validate_new_account for the account header word and validate_storage for the slot records. Read them from the native account instead, so neither can be pointed at a foreign account. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…gician-claude/fix-l12-reserved-elements-validation # Conflicts: # crates/miden-protocol/asm/kernels/transaction-core/src/account.masm
mmagician
deleted the
mmagician-claude/fix-l12-reserved-elements-validation
branch
August 21, 2026 13:22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enforces that the account's two reserved elements are zero at account creation, so advice-provider data can no longer inject arbitrary values into the account commitment
Closes #3599