feat: allow root-allowlisted tx scripts on network accounts (#3028)

feat: allow root-allowlisted tx scripts on network accounts (#3028)

AuthNetworkAccount previously banned every transaction script outright. This generalizes that ban into a tx-script-root allowlist that mirrors the existing note-script allowlist: a transaction that runs no tx script is allowed, and any tx script that does run must have its MAST root in an allowlist fixed at account creation. This lets network accounts run owner-approved scripts (e.g. setting the expiration delta, needed by the ntx-builder) while preserving the invariant that only root-pinned, pre-approved code can run against a signature-less account.

Changes:
- Add `TransactionScriptRoot` newtype mirroring `NoteScriptRoot`; `TransactionScript::root()` now returns it.
- Add `tx_script_allowlist.masm` (`assert_tx_script_allowed`) and switch the network auth component to it; remove the now-unused `assert_no_tx_script`.
- Add `NetworkAccountTxScriptAllowlist` storage (`allowed_tx_scripts` slot); an empty allowlist permits no tx scripts (the prior behavior).
- Wire through `AuthNetworkAccount::with_allowed_tx_scripts` and `AuthMethod::NetworkAccount.allowed_tx_script_roots`.

A root pins a script's code but not its `TX_SCRIPT_ARGS`/advice inputs, which an arbitrary submitter controls, so only scripts whose behavior is fixed regardless of those inputs should be allowlisted.

Breaking: the component gains a second storage slot (existing network accounts must be recreated), and `TransactionScript::root()` returns `TransactionScriptRoot` instead of `Word`.

Closes #3027.

Co-authored-by: Philipp Gackstatter <PhilippGackstatter@users.noreply.github.com>

Author: partylikeits1983

CHANGELOG.md

@@ -26,6 +26,13 @@
 - Fixed `pausable::assert_not_paused` to guard its storage read with `active_account::has_storage_slot`, making it a no-op on accounts without the `Pausable` component instead of panicking on the missing `is_paused` slot ([#3047](https://github.com/0xMiden/protocol/pull/3047)).
 - [BREAKING] Fixed batch ID being serialized/deserialized and potentially not matching the serialized transaction headers ([#3061](https://github.com/0xMiden/protocol/pull/3061)).
 
+## v0.15.2 (TBD)
+
+### Changes
+
+- [BREAKING] `AuthNetworkAccount` now gates transaction scripts with a root allowlist instead of banning them outright, enabling network accounts to run approved tx scripts such as setting the expiration delta ([#3028](https://github.com/0xMiden/protocol/pull/3028)).
+- [BREAKING] `TransactionScript::root()` now returns `TransactionScriptRoot` instead of `Word` ([#3028](https://github.com/0xMiden/protocol/pull/3028)).
+
 ## v0.15.1 (TBD)
 
 ### Changes

crates/miden-protocol/src/transaction/kernel/advice_inputs.rs

@@ -197,7 +197,9 @@ impl TransactionAdviceInputs {
         // --- number of notes, script root and args --------------------------
         self.extend_stack([Felt::from(tx_inputs.input_notes().num_notes())]);
         let tx_args = tx_inputs.tx_args();
-        self.extend_stack(tx_args.tx_script().map_or(Word::empty(), |script| script.root()));
+        self.extend_stack(
+            tx_args.tx_script().map_or(Word::empty(), |script| script.root().as_word()),
+        );
         self.extend_stack(tx_args.tx_script_args());
 
         // --- auth procedure args --------------------------------------------

crates/miden-protocol/src/transaction/mod.rs

@@ -33,7 +33,7 @@ pub use outputs::{
 pub use partial_blockchain::PartialBlockchain;
 pub use proven_tx::{InputNoteCommitment, ProvenTransaction, TxAccountUpdate};
 pub use transaction_id::TransactionId;
-pub use tx_args::{TransactionArgs, TransactionScript};
+pub use tx_args::{TransactionArgs, TransactionScript, TransactionScriptRoot};
 pub use tx_header::TransactionHeader;
 pub use tx_summary::TransactionSummary;
 pub use verifier::TransactionVerifier;

crates/miden-protocol/src/transaction/tx_args.rs

@@ -1,9 +1,12 @@
 use alloc::collections::BTreeMap;
+use alloc::string::String;
 use alloc::sync::Arc;
 use alloc::vec::Vec;
+use core::fmt::Display;
 
 use miden_core::mast::MastNodeExt;
 use miden_crypto::merkle::InnerNodeInfo;
+use miden_crypto_derive::WordWrapper;
 use miden_mast_package::Package;
 
 use super::{Felt, Hasher, Word};
@@ -276,6 +279,42 @@ impl Deserializable for TransactionArgs {
     }
 }
 
+// TRANSACTION SCRIPT ROOT
+// ================================================================================================
+
+/// The MAST root of a [`TransactionScript`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, WordWrapper)]
+pub struct TransactionScriptRoot(Word);
+
+impl From<TransactionScriptRoot> for Word {
+    fn from(root: TransactionScriptRoot) -> Self {
+        root.0
+    }
+}
+
+impl Display for TransactionScriptRoot {
+    fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+        Display::fmt(&self.0, f)
+    }
+}
+
+impl Serializable for TransactionScriptRoot {
+    fn write_into<W: ByteWriter>(&self, target: &mut W) {
+        target.write(self.0);
+    }
+
+    fn get_size_hint(&self) -> usize {
+        self.0.get_size_hint()
+    }
+}
+
+impl Deserializable for TransactionScriptRoot {
+    fn read_from<R: ByteReader>(source: &mut R) -> Result<Self, DeserializationError> {
+        let word: Word = source.read()?;
+        Ok(Self::from_raw(word))
+    }
+}
+
 // TRANSACTION SCRIPT
 // ================================================================================================
 
@@ -334,8 +373,8 @@ impl TransactionScript {
     }
 
     /// Returns the commitment of this transaction script (i.e., the script's MAST root).
-    pub fn root(&self) -> Word {
-        self.mast[self.entrypoint].digest()
+    pub fn root(&self) -> TransactionScriptRoot {
+        TransactionScriptRoot::from_raw(self.mast[self.entrypoint].digest())
     }
 
     /// Returns a new [TransactionScript] with the provided advice map entries merged into the

crates/miden-standards/asm/account_components/auth/network_account.masm

@@ -6,6 +6,7 @@ use miden::protocol::active_account
 use miden::protocol::native_account
 use miden::core::word
 use miden::standards::auth::note_script_allowlist
+use miden::standards::auth::tx_script_allowlist
 
 # CONSTANTS
 # =================================================================================================
@@ -14,13 +15,18 @@ use miden::standards::auth::note_script_allowlist
 # (defined as Word); any non-empty value marks a root as allowed.
 const ALLOWED_NOTE_SCRIPTS_SLOT = word("miden::standards::auth::network_account::allowed_note_scripts")
 
+# The slot holding the map of allowed tx script roots. Keys are tx script roots (defined as Word);
+# any non-empty value marks a root as allowed.
+const ALLOWED_TX_SCRIPTS_SLOT = word("miden::standards::auth::network_account::allowed_tx_scripts")
+
 # AUTH PROCEDURE
 # =================================================================================================
 
 #! Authenticates a transaction against an `AuthNetworkAccount` component.
 #!
 #! Enforces two invariants:
-#! 1. No transaction script was executed in this transaction.
+#! 1. The transaction script root, if any, must be present in the allowlist stored at
+#!    `ALLOWED_TX_SCRIPTS_SLOT` (a transaction that executed no tx script is always allowed).
 #! 2. Every consumed input note must have a script root present in the allowlist stored at
 #!    `ALLOWED_NOTE_SCRIPTS_SLOT`.
 #!
@@ -36,8 +42,11 @@ pub proc auth_network_transaction(auth_args: word)
     dropw
     # => [pad(16)]
 
-    # ---- Reject transactions that executed a tx script ----
-    exec.note_script_allowlist::assert_no_tx_script
+    # ---- Reject any tx script whose root is not allowlisted ----
+    push.ALLOWED_TX_SCRIPTS_SLOT[0..2]
+    # => [slot_id_suffix, slot_id_prefix, pad(16)]
+
+    exec.tx_script_allowlist::assert_tx_script_allowed
     # => [pad(16)]
 
     # ---- Reject any input note whose script root is not allowlisted ----

crates/miden-standards/asm/standards/auth/note_script_allowlist.masm

@@ -1,11 +1,10 @@
-# Reusable note-script allowlist primitives.
+# Reusable note-script allowlist primitive.
 #
-# Provides two checks used to restrict what an account can do during a transaction:
-# - `assert_no_tx_script` rejects transactions that executed a tx script.
+# Provides one check used to restrict what an account can do during a transaction:
 # - `assert_all_input_notes_allowed` rejects transactions that consume an input note whose script
 #   root is not present in a storage map at the given slot id.
 #
-# These are designed to be composed into auth components. The caller owns the storage map and
+# This is designed to be composed into auth components. The caller owns the storage map and
 # passes the slot id (suffix, prefix) so the same logic can back multiple components, each with
 # their own allowlist.
 
@@ -17,29 +16,11 @@ use miden::core::word
 # ERRORS
 # =================================================================================================
 
-const ERR_NOTE_SCRIPT_ALLOWLIST_TX_SCRIPT_NOT_ALLOWED="a transaction script cannot be executed against an account guarded by a note script allowlist"
 const ERR_NOTE_SCRIPT_ALLOWLIST_NOTE_NOT_ALLOWED="input note script root is not in the note script allowlist"
 
 # PROCEDURES
 # =================================================================================================
 
-#! Asserts that no transaction script was executed in the current transaction.
-#!
-#! Inputs:  []
-#! Outputs: []
-#!
-#! Invocation: exec
-pub proc assert_no_tx_script
-    exec.tx::get_tx_script_root
-    # => [TX_SCRIPT_ROOT]
-
-    exec.word::eqz
-    # => [has_no_tx_script]
-
-    assert.err=ERR_NOTE_SCRIPT_ALLOWLIST_TX_SCRIPT_NOT_ALLOWED
-    # => []
-end
-
 #! Asserts that every input note consumed by this transaction has a script root present in the
 #! storage map at the given slot id.
 #!

crates/miden-standards/asm/standards/auth/tx_script_allowlist.masm

@@ -0,0 +1,66 @@
+# Reusable tx-script allowlist primitive.
+#
+# Provides a single check used to restrict which transaction scripts an account will execute:
+# - `assert_tx_script_allowed` accepts transactions that executed no tx script, and otherwise
+#   rejects transactions whose tx script root is not present in a storage map at the given slot id.
+#
+# This is designed to be composed into auth components. The caller owns the storage map and passes
+# the slot id (suffix, prefix) so the same logic can back multiple components, each with their own
+# allowlist.
+
+use miden::protocol::active_account
+use miden::protocol::tx
+use miden::core::word
+
+# ERRORS
+# =================================================================================================
+
+const ERR_TX_SCRIPT_ALLOWLIST_TX_SCRIPT_NOT_ALLOWED="transaction script root is not in the tx script allowlist"
+
+# PROCEDURES
+# =================================================================================================
+
+#! Asserts that the transaction script root is present in the storage map at the given slot id.
+#!
+#! A transaction that executed no tx script (empty root) is always allowed. Any other tx script must
+#! have its root present in the allowlist.
+#!
+#! Map convention: keys are tx script roots (defined as Word), and any non-empty value marks a root
+#! as allowed. Empty values (the default for absent keys) cause this procedure to fail.
+#!
+#! Inputs:  [allowlist_slot_id_suffix, allowlist_slot_id_prefix]
+#! Outputs: []
+#!
+#! Where:
+#! - allowlist_slot_id_{suffix, prefix} are the suffix and prefix felts of the slot identifier
+#!   pointing at the allowlist storage map.
+#!
+#! Invocation: exec
+pub proc assert_tx_script_allowed
+    # => [slot_id_suffix, slot_id_prefix]
+
+    exec.tx::get_tx_script_root
+    # => [TX_SCRIPT_ROOT, slot_id_suffix, slot_id_prefix]
+
+    exec.word::testz
+    # => [no_tx_script, TX_SCRIPT_ROOT, slot_id_suffix, slot_id_prefix]
+
+    if.true
+        # No tx script was executed, which is always allowed.
+        dropw drop drop
+        # => []
+    else
+        movup.5 movup.5
+        # => [slot_id_suffix, slot_id_prefix, TX_SCRIPT_ROOT]
+
+        exec.active_account::get_map_item
+        # => [VALUE]
+
+        exec.word::eqz not
+        # => [is_allowed]
+
+        assert.err=ERR_TX_SCRIPT_ALLOWLIST_TX_SCRIPT_NOT_ALLOWED
+        # => []
+    end
+    # => []
+end

crates/miden-standards/src/account/auth/mod.rs

@@ -22,4 +22,6 @@ pub use network_account::{
     NetworkAccount,
     NetworkAccountNoteAllowlist,
     NetworkAccountNoteAllowlistError,
+    NetworkAccountTxScriptAllowlist,
+    NetworkAccountTxScriptAllowlistError,
 };