# exported-shielded-descriptor

> Canonical shielded coin descriptor fields have an unchanged source route to an exported result.

Canonical: https://nightshade.dicksonwu.xyz/rules/exported-shielded-descriptor.html
Release: Nightshade 0.1.1 (v0.1.1)

| Field | Value |
| --- | --- |
| Rule ID | `exported-shielded-descriptor` |
| Severity | info |
| Confidence | varies |
| Maturity | experimental |
| Selection | Opt-in |
| Policy intent | not required |
| Default enabled | no |
| Category | Other active opt-ins / Token, coin and value transfers |
| Engine facts used | resolved-source, canonical-stdlib-calls, resolved-types |
| Release | v0.1.1 |

## Selection and scope

Not selected by default. Select it with `--detectors` or the `detectors` list in nightshade.json. Either one replaces profile selection, so list every rule you want.

```sh
./.nightshade/node_modules/.bin/nightshade ./contracts --detectors exported-shielded-descriptor
./.nightshade/node_modules/.bin/nightshade detector show exported-shielded-descriptor
```

The first command runs only this rule; `--detectors` takes a comma-separated list. The second prints the rule's metadata from your installed version.

Severity is review priority. It does not express exploitability or impact. Confidence is detector metadata, not a probability. All built-in rules are experimental.

Compiler scope: the engine supports the pinned profiles 0.28.0, 0.29.0, 0.30.0, 0.31.1, 0.33.0-rc.2, 0.34.0, 0.35.0-rc.1 and 0.35.0, with ZKIR2 by default. Support for this rule can be narrower; the rule documentation below states any narrower scope.

## Corpus checks

Synthetic corpus checks for this rule in the 0.1.1 proof run. A check counts only with compiler acceptance and complete analysis.

| Positive detected | Corrected quiet | Lookalike quiet | Other negative quiet | Incomplete |
| ---: | ---: | ---: | ---: | ---: |
| 3/3 | 3/3 | 3/3 | 0/0 | 0 |

No deviations were recorded for this rule.

These are behavior checks on synthetic fixtures, not a precision or recall estimate. See [evaluation](https://nightshade.dicksonwu.xyz/evaluation.md#synthetic-corpus).

## Rule documentation

From https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/exported-shielded-descriptor.md at v0.1.1.

A finding means canonical shielded coin descriptor fields have an unchanged
source route to an exported Compact result. Canonical `sendShielded`,
`sendImmediateShielded`, and `mintShieldedToken` results retain their native
identity. Canonical `ShieldedCoinInfo` and `QualifiedShieldedCoinInfo` inputs,
resolved references, defaults and constructions retain represented descriptor
fields. Import aliases retain canonical identity; user types and circuits with
the same names do not establish this fact.

The output boundary is the Compact/application result, not necessarily a public
ledger. Wallet metadata APIs may deliberately return these values and still
match. The finding establishes neither successful execution nor public ledger
publication, secrecy-policy violation, exploitability or deployed impact.
Existing explicit secrecy policies and native operation sink treatment remain
independent.

The source pass preserves immutable local aliases, disclosure, identity casts,
represented structs and sequences, field selection, literal sequence indexing,
helper arguments and helper result forwarding. It inspects syntactic branches
and returns without claiming path feasibility. Aggregate projection selects the
represented field; an unrelated field or helper argument does not inherit coin
provenance. A `Maybe.is_some` flag alone does not expose a descriptor field.
Known canonical hashes/commitments end the unchanged-field route. Arithmetic,
comparisons and representation-changing casts are outside this contract.

Relevant unresolved forwarding, opaque calls, callbacks, mutations, unsupported
projections, loops in applicable source routes, recursive forwarding, and
exhausted work/depth/layout allowances emit rule-scoped
`shielded-descriptor-provenance-unavailable`. A missing provenance certificate
never substitutes for a finding-free complete relevant route. The pass has one
shared 20,000-work allowance across entries and helper expansion, depth 64, and
represented sequence layouts up to 256 elements; its work is recorded in scan
metrics. These source limits are separate from the ordinary path interpreter's
analysis budgets.

An intentional metadata return can match this rule. Review the recipient and
disclosure policy before treating the result as a defect or suppressing it.

## Suppress a match

If a match is intentional, suppress it on the line before with the exact rule ID and a reason of at least eight characters:

```compact
// nightshade-disable-next-line exported-shielded-descriptor -- Reason this match is intentional
```

Diagnostics cannot be suppressed, and an unmatched directive for a selected rule makes analysis incomplete. See [configuration](https://nightshade.dicksonwu.xyz/configuration.md#suppress-an-intentional-match) for fingerprint suppressions and baselines.

## References

- [Rule source document at v0.1.1](https://github.com/DicksonWu654/nightshade/blob/v0.1.1/docs/detectors/exported-shielded-descriptor.md)
- [Catalog entry in rules.json](https://nightshade.dicksonwu.xyz/rules.json)
- [All rules](https://nightshade.dicksonwu.xyz/rules.md#token-coin-and-value-transfers)
- [Limitations](https://nightshade.dicksonwu.xyz/limitations.md)