Rule
public-two-component-domain-review
Review a public two-input native digest lacking represented self binding and component default exclusion.
Specimen 61 of 96 · Other active opt-ins / Privacy and cryptographic derivations
- Severity
- info
- Confidence
- high
- Maturity
- experimental
- Selection
- Opt-in
- Policy intent
- not required
- Release
- v0.1.1
- Engine facts used
exact-native-preimagecanonical-self-provenanceall-successful-predicatesscalar-entry-input-identity
Selection and scope#
Not selected by default. Select it with --detectors or the detectors list in nightshade.json. Either one replaces profile selection, so list every rule you want.
./.nightshade/node_modules/.bin/nightshade ./contracts --detectors public-two-component-domain-review
./.nightshade/node_modules/.bin/nightshade detector show public-two-component-domain-reviewThe first command runs only this rule; --detectors takes a comma-separated list. The second prints the rule's metadata from your installed version.
Severity is review priority. It does not express exploitability or impact. Confidence is detector metadata, not a probability. All built-in rules are experimental.
Compiler scope: the engine supports the pinned profiles 0.28.0, 0.29.0, 0.30.0, 0.31.1, 0.33.0-rc.2, 0.34.0, 0.35.0-rc.1 and 0.35.0, with ZKIR2 by default. Support for this rule can be narrower; the rule documentation below states any narrower scope.
Corpus checks#
Synthetic corpus checks for this rule in the 0.1.1 proof run. A check counts only with compiler acceptance and complete analysis.
| Positive detected | Corrected quiet | Lookalike quiet | Other negative quiet | Incomplete |
|---|---|---|---|---|
| 6/6 | 5/5 | 3/4 | 4/5 | 1 |
Deviations recorded for this rule:
| Case | Kind | Expected to observed lines | Issue |
|---|---|---|---|
| manifest.json / publicTwoComponentDomainReview43/drafts/owner-domain43/lookalike.compact | lookalike | [15] to [15] | control hit |
| manifest.json / publicTwoComponentDomainReview43/drafts/owner-domain43/opaque-salt-guard.compact | negative | [] to [] | incomplete or unvalidated |
These are behavior checks on synthetic fixtures, not a precision or recall estimate. See evaluation.
Rule documentation#
From docs/detectors/public-two-component-domain-review.md at v0.1.1.
Availability: opt-in, no policy required. Severity: info. Confidence: high for the stated source relationship.
Select with --detectors public-two-component-domain-review.
This review observes a public ledger write containing a canonical native persistentHash of exactly two distinct scalar entry parameters of type Bytes<32>. The represented preimage lacks a canonical kernel.self() value, and assigning both components their default bytes is compatible with supported component-only scalar equality guards on a modeled successful history. Findings identify the actual native hash span, the two parameter declarations and the public write. An authorization consumer is unnecessary.
The scope deliberately excludes a history when either component's default is excluded by a required supported equality guard. Thus both salt != default and owner != default can be quiet, independently of self binding. This is a narrower source surface, not a general repair of an owner/salt domain obligation: an owner restriction may still admit default salt, and nonzero salt alone does not establish uniqueness or instance separation. Late checks constrain complete successful histories. Exclusive branches retain separate guards.
Canonical self must reach the actual preimage. A helper-returned self value or its exact bytes projection qualifies; storing self separately does not. A known single-component identifier, a single aggregate parameter, constant component, repeated parameter or other fully represented shape is outside the two-scalar scope. Other native hash/commitment primitives are outside this initial rule. Opaque or transformed preimages, opaque component guard operands, missing exact history evidence and exhausted preparation/proof budgets yield rule-scoped incomplete diagnostics. Absence of a rejection check alone never supplies a feasible-default claim. Baseline-incomplete entries withhold structural absence; standalone preparation also requires a complete resolved callable closure.
Preparation, exact interpretation, traversal and retained certificates share the existing limits: 40,000 steps per entry, 256 paths and 50,000 cumulative abstract values. Instruction/reference and cached/uncached execution preserve the same findings. Values measure cumulative abstract allocation units, not physical memory. The ordinary scan remains independent of this opt-in observation pass.
Suppress a match#
If a match is intentional, suppress it on the line before with the exact rule ID and a reason of at least eight characters:
// nightshade-disable-next-line public-two-component-domain-review -- Reason this match is intentionalDiagnostics cannot be suppressed, and an unmatched directive for a selected rule makes analysis incomplete. See configuration for fingerprint suppressions and baselines.