Rule
membership-identity-binding-review
Keyed mutation digest/key equality and required Set membership use independent witness snapshots.
Specimen 51 of 96 · Other active opt-ins / Authorization, identity and membership
- Severity
- info
- Confidence
- varies
- Maturity
- experimental
- Selection
- Opt-in
- Policy intent
- not required
- Release
- v0.1.1
- Engine facts used
all-predicatesdigest-inputscollection-operationsoriginal-write-history
Selection and scope#
Not selected by default. Select it with --detectors or the detectors list in nightshade.json. Either one replaces profile selection, so list every rule you want.
./.nightshade/node_modules/.bin/nightshade ./contracts --detectors membership-identity-binding-review
./.nightshade/node_modules/.bin/nightshade detector show membership-identity-binding-reviewThe first command runs only this rule; --detectors takes a comma-separated list. The second prints the rule's metadata from your installed version.
Severity is review priority. It does not express exploitability or impact. Confidence is detector metadata, not a probability. All built-in rules are experimental.
Compiler scope: the engine supports the pinned profiles 0.28.0, 0.29.0, 0.30.0, 0.31.1, 0.33.0-rc.2, 0.34.0, 0.35.0-rc.1 and 0.35.0, with ZKIR2 by default. Support for this rule can be narrower; the rule documentation below states any narrower scope.
Corpus checks#
Synthetic corpus checks for this rule in the 0.1.1 proof run. A check counts only with compiler acceptance and complete analysis.
| Positive detected | Corrected quiet | Lookalike quiet | Other negative quiet | Incomplete |
|---|---|---|---|---|
| 4/4 | 3/3 | 2/3 | 5/5 | 0 |
Deviations recorded for this rule:
| Case | Kind | Expected to observed lines | Issue |
|---|---|---|---|
| manifest.json / independentMembershipIdentity54/drafts/memo-identity44-boundaries/intentional-admin.compact | lookalike | [20] to [20] | control hit |
These are behavior checks on synthetic fixtures, not a precision or recall estimate. See evaluation.
Rule documentation#
From docs/detectors/membership-identity-binding-review.md at v0.1.1.
Availability: opt-in with --detectors membership-identity-binding-review. Findings are informational policy questions, with high confidence limited to the observed source relationship.
The rule observes a canonical Map<Bytes<32>, List<Bytes<32>>> mutation at an exact key. Imported aliases and nominal container aliases are admitted only when canonical native identity and recursively resolved argument shapes agree. Required scalar equalities connect that key to a canonical persistentHash of one raw, declared Bytes<32> witness snapshot. A required canonical Set<Bytes<32>>.member predicate tests an independent raw witness snapshot in the same completed atomic history. No required scalar equality connects the digest or its input to the membership input. A public key parameter is not trusted ledger data; this equality alone does not establish authentication policy.
One report groups a digest/key snapshot, membership predicate and nested Map root, retaining a representative mutation and the observed source sites. Different roots, membership snapshots and digest snapshots remain separate questions. Source sites can occur on different complete histories; their effects are never combined into a single executable history. Zero-iteration histories supply no mutation. Optional membership in an alternative successful history at the same mutation site suppresses the mandatory composition question. Required Boolean facts are intersected; exclusive checks never donate equality or membership.
Direct, transitive, aliased and late atomic scalar equalities bind snapshots. Repeated invocations of one witness declaration remain independent. Equal hash outputs never establish equal preimages. Query identities retain the exact Set receiver, operand and ledger revision. Wildcard mutation paths cannot supply exact key evidence. Unavailable histories, predicate structure, snapshot identities, checkpoints and exhausted budgets produce diagnostics and incomplete coverage.
The initial boundary excludes other represented container shapes, aggregate or transformed witness inputs, user collection lookalikes, and cross-entry policy comparison. Preparation, execution, additional collection retention, matching and report construction share 40,000 steps per entry, 256 paths per entry and 50,000 cumulative abstract values per selected rule; no retry budget applies.
An application may intentionally use one supplied identity for a stored map key and an independent witness for membership. That source relationship is an informational review question, not proof of an authorization defect; confirm the intended identity-binding policy before changing it.
Suppress a match#
If a match is intentional, suppress it on the line before with the exact rule ID and a reason of at least eight characters:
// nightshade-disable-next-line membership-identity-binding-review -- Reason this match is intentionalDiagnostics cannot be suppressed, and an unmatched directive for a selected rule makes analysis incomplete. See configuration for fingerprint suppressions and baselines.