Rule
split-witness-identity
Ledger-bound witness digest and mutation operand use independently supplied witness snapshots without mandatory equality binding.
Specimen 55 of 96 · Other active opt-ins / Authorization, identity and membership
- Severity
- low
- Confidence
- high
- Maturity
- experimental
- Selection
- Opt-in
- Policy intent
- not required
- Release
- v0.1.1
- Engine facts used
all-predicatesdigest-inputscollection-operationsoriginal-write-history
Selection and scope#
Not selected by default. Select it with --detectors or the detectors list in nightshade.json. Either one replaces profile selection, so list every rule you want.
./.nightshade/node_modules/.bin/nightshade ./contracts --detectors split-witness-identity
./.nightshade/node_modules/.bin/nightshade detector show split-witness-identityThe first command runs only this rule; --detectors takes a comma-separated list. The second prints the rule's metadata from your installed version.
Severity is review priority. It does not express exploitability or impact. Confidence is detector metadata, not a probability. All built-in rules are experimental.
Compiler scope: the engine supports the pinned profiles 0.28.0, 0.29.0, 0.30.0, 0.31.1, 0.33.0-rc.2, 0.34.0, 0.35.0-rc.1 and 0.35.0, with ZKIR2 by default. Support for this rule can be narrower; the rule documentation below states any narrower scope.
Corpus checks#
Synthetic corpus checks for this rule in the 0.1.1 proof run. A check counts only with compiler acceptance and complete analysis.
| Positive detected | Corrected quiet | Lookalike quiet | Other negative quiet | Incomplete |
|---|---|---|---|---|
| 2/2 | 2/2 | 2/2 | 0/0 | 0 |
No deviations were recorded for this rule.
These are behavior checks on synthetic fixtures, not a precision or recall estimate. See evaluation.
Rule documentation#
From docs/detectors/split-witness-identity.md at v0.1.1.
Availability: opt-in. Severity: low. Confidence: high.
Opt-in low severity, high confidence review of a precise static relationship. A successful history enforces a canonical native digest of exact witness input snapshots equal to definite preexisting ledger data. A Map/Set mutation key (or same-typed scalar Kernel mutation operand) uses entirely independent supplied witness snapshots. No mandatory scalar equality connects the observed guard digest or represented input leaves to the effect operand or its represented input leaves. Output digest equality and transitive scalar equality can bind the identities. Checks after the mutation count because they constrain the same successful transaction.
The first implementation observes exact native digest inputs and resolved collection operation keys, not arbitrary arithmetic dependencies, stored value taint, wildcard write paths, or unrelated mutations. Aggregate Kernel operands, shielded-native recipient structures, collection lookups/member guards, and other protocol-specific authentication remain outside this contract. It does not interpret equal hash outputs as equal preimages. Fresh invocations of the same witness declaration remain independent; unchanged aliases retain identity. Ledger snapshots and revisions are not converted to live storage identities.
Rule-isolated source observation uses all predicates and original histories. Missing predicate/digest/collection evidence, optional predicate alternatives that cannot be decoded, and exhausted allowances produce rule-scoped incomplete coverage and withhold findings. Baseline completion is independent. Experimental Counter mode has an absence certificate because the closed terminal Counter grammar excludes witnesses; other entries route to exact source observations. Both instruction/reference engines and cached/uncached transfers are covered by focused compiler-backed tests.
Independent witness values can be intentional when the protocol treats the guard identity and mutation key as separate roles. The rule reports their unlinked source relationship; it does not infer caller intent or establish an authorization bypass.
Suppress a match#
If a match is intentional, suppress it on the line before with the exact rule ID and a reason of at least eight characters:
// nightshade-disable-next-line split-witness-identity -- Reason this match is intentionalDiagnostics cannot be suppressed, and an unmatched directive for a selected rule makes analysis incomplete. See configuration for fingerprint suppressions and baselines.