test(wallet): prove the #1698 exploit is UNWRITABLE, not merely rejected

Four compile-fail cases (trybuild) plus trait-absence and structural assertions:

- the #1698 exploit does not compile: authorize_op takes no description, and no
  signing method accepts loose coin spends.
- SpendApproval::new / PendingApproval::new are unreachable outside the crate.
- signing or confirming twice is a use-after-move error, not a nonce check.
- neither token implements Clone / Serialize / DeserializeOwned / Debug.
- production code mints an approval in exactly one module (the gate), assembles its
  fields in exactly one module, and derives the summary in exactly one module.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: MichaelTaylor3d

Cargo.lock

@@ -39,6 +39,10 @@ anyhow = "1"
 hex = "0.4"
 tokio = { version = "1", features = ["macros", "rt"] }
 serde_json = "1"
+# Compile-fail proofs: several custody properties of `SpendApproval` are TYPE-SYSTEM properties, so
+# the only honest test for them is that the wrong code does not compile.
+trybuild = "1.0"
+static_assertions = "1.1"
 
 [lints.rust]
 unsafe_code = "forbid"

Cargo.toml

@@ -0,0 +1,14 @@
+//! A ceremony cannot be run once and cashed in twice.
+//!
+//! `PendingApproval::confirmed` consumes `self`, so one prompt yields at most one signable approval.
+//! Without this, a host that held the pending value could convert a single user "yes" into any number
+//! of approvals over those spends.
+
+use dig_account::{PendingApproval, SpendDecision};
+
+fn confirm_twice(pending: PendingApproval) {
+    let _first = pending.confirmed(SpendDecision::Approve);
+    let _again = pending.confirmed(SpendDecision::Approve);
+}
+
+fn main() {}

tests/compile_fail/confirm_a_ceremony_twice.rs

@@ -0,0 +1,15 @@
+error[E0382]: use of moved value: `pending`
+  --> tests/compile_fail/confirm_a_ceremony_twice.rs:11:18
+   |
+ 9 | fn confirm_twice(pending: PendingApproval) {
+   |                  ------- move occurs because `pending` has type `PendingApproval`, which does not implement the `Copy` trait
+10 |     let _first = pending.confirmed(SpendDecision::Approve);
+   |                          --------------------------------- `pending` moved due to this method call
+11 |     let _again = pending.confirmed(SpendDecision::Approve);
+   |                  ^^^^^^^ value used here after move
+   |
+note: `PendingApproval::confirmed` takes ownership of the receiver `self`, which moves `pending`
+  --> src/wallet/approval.rs
+   |
+   |     pub fn confirmed(self, decision: SpendDecision) -> Result<SpendApproval> {
+   |                      ^^^^

tests/compile_fail/confirm_a_ceremony_twice.stderr

@@ -0,0 +1,19 @@
+//! A consumer cannot mint its own permission.
+//!
+//! `SpendApproval`/`PendingApproval` have private fields and `pub(crate)` constructors, so
+//! `PolicyAuthorizer` is MECHANICALLY the only minter of a permission — not merely the intended one.
+//! Were this to compile, "a dapp approves its own spend" would be a one-line change in a consumer,
+//! and every bound this crate advertises would be optional again.
+//!
+//! The constructors are merely NAMED rather than called, so the recorded verdict is the privacy error
+//! alone. Calling them would add an argument-count error that would still be reported if `new` were
+//! public — noise that could let this case keep "failing" for the wrong reason.
+
+use dig_account::{PendingApproval, SpendApproval};
+
+fn forge() {
+    let _mint_an_approval = SpendApproval::new;
+    let _mint_a_pending_approval = PendingApproval::new;
+}
+
+fn main() {}

tests/compile_fail/mint_an_approval_outside_the_gate.rs

@@ -0,0 +1,29 @@
+error[E0624]: associated function `new` is private
+  --> tests/compile_fail/mint_an_approval_outside_the_gate.rs:15:44
+   |
+15 |       let _mint_an_approval = SpendApproval::new;
+   |                                              ^^^ private associated function
+   |
+  ::: src/wallet/approval.rs
+   |
+   | /     pub(crate) fn new(
+   | |         coin_spends: Vec<CoinSpend>,
+   | |         summary: SpendSummary,
+   | |         verified: TransactionSummary,
+   | |     ) -> Self {
+   | |_____________- private associated function defined here
+
+error[E0624]: associated function `new` is private
+  --> tests/compile_fail/mint_an_approval_outside_the_gate.rs:16:53
+   |
+16 |       let _mint_a_pending_approval = PendingApproval::new;
+   |                                                       ^^^ private associated function
+   |
+  ::: src/wallet/approval.rs
+   |
+   | /     pub(crate) fn new(
+   | |         coin_spends: Vec<CoinSpend>,
+   | |         summary: SpendSummary,
+   | |         verified: TransactionSummary,
+   | |     ) -> Self {
+   | |_____________- private associated function defined here

tests/compile_fail/mint_an_approval_outside_the_gate.stderr

@@ -0,0 +1,15 @@
+//! Single-use is a MOVE, not a runtime replay check.
+//!
+//! `sign_approved` takes the approval by value and `SpendApproval` is not `Clone`/`Copy`, so signing
+//! the same approval twice is a use-after-move error the compiler catches. There is deliberately no
+//! nonce and no spent-set: a replay window that cannot exist needs no bookkeeping to close, and
+//! bookkeeping is a thing that can drift out of sync with what it guards.
+
+use dig_account::{MoneySigner, SpendApproval};
+
+fn sign_twice<S: MoneySigner>(signer: &S, approval: SpendApproval) {
+    let _first = signer.sign_approved(approval);
+    let _replay = signer.sign_approved(approval);
+}
+
+fn main() {}

tests/compile_fail/reuse_an_approval.rs

@@ -0,0 +1,9 @@
+error[E0382]: use of moved value: `approval`
+  --> tests/compile_fail/reuse_an_approval.rs:12:40
+   |
+10 | fn sign_twice<S: MoneySigner>(signer: &S, approval: SpendApproval) {
+   |                                           -------- move occurs because `approval` has type `SpendApproval`, which does not implement the `Copy` trait
+11 |     let _first = signer.sign_approved(approval);
+   |                                       -------- value moved here
+12 |     let _replay = signer.sign_approved(approval);
+   |                                        ^^^^^^^^ value used here after move

tests/compile_fail/reuse_an_approval.stderr

@@ -0,0 +1,38 @@
+//! The #1698 exploit, as a compile-fail proof.
+//!
+//! Authorize an honest-looking ONE-MOJO description, then sign a spend of a BILLION mojos. Under
+//! dig-account 0.1.2 this compiled and both steps succeeded: the gate judged a `SpendSummary` while
+//! the signer signed `&[CoinSpend]`, and nothing connected the two.
+//!
+//! The property under test is the SHAPE, not a rejection. A regression test asserting `is_err()`
+//! would pass equally against a patched digest comparison — and would keep passing if that comparison
+//! were later moved, mis-scoped, or fed the wrong bytes. Only non-compilation pins that there are no
+//! longer two values that could disagree.
+//!
+//! Both halves of the exploit fail independently:
+//!   1. `authorize_op` no longer accepts a description at all — it takes the spends.
+//!   2. no signing method accepts loose coin spends, so there is nothing to sign them with.
+
+use chia_protocol::CoinSpend;
+use dig_account::{MoneySigner, PolicyAuthorizer, SpendOpClass, SpendRecipient, SpendSummary, SpendTier};
+
+fn exploit<S: MoneySigner>(gate: &PolicyAuthorizer, signer: &S, real_spends: &[CoinSpend]) {
+    // A hand-built description of a one-mojo tip to a stranger.
+    let honest_looking = SpendSummary::new(
+        SpendTier::AutoSend,
+        vec![SpendRecipient {
+            address: "xch1qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq".to_string(),
+            amount_mojos: 1,
+            asset_id: None,
+        }],
+        0,
+    );
+
+    // (1) The gate will not judge a description.
+    let _ = gate.authorize_op(&honest_looking, SpendOpClass::Tip);
+
+    // (2) And nothing will sign the real, billion-mojo spends.
+    let _ = signer.sign_coin_spends(real_spends);
+}
+
+fn main() {}

tests/compile_fail/the_1698_exploit.rs

@@ -0,0 +1,21 @@
+error[E0308]: mismatched types
+  --> tests/compile_fail/the_1698_exploit.rs:32:31
+   |
+32 |     let _ = gate.authorize_op(&honest_looking, SpendOpClass::Tip);
+   |                  ------------ ^^^^^^^^^^^^^^^ expected `&[CoinSpend]`, found `&SpendSummary`
+   |                  |
+   |                  arguments to this method are incorrect
+   |
+   = note: expected reference `&[CoinSpend]`
+              found reference `&SpendSummary`
+note: method defined here
+  --> src/wallet/enforcer.rs
+   |
+   |     pub fn authorize_op(
+   |            ^^^^^^^^^^^^
+
+error[E0599]: no method named `sign_coin_spends` found for reference `&S` in the current scope
+  --> tests/compile_fail/the_1698_exploit.rs:35:20
+   |
+35 |     let _ = signer.sign_coin_spends(real_spends);
+   |                    ^^^^^^^^^^^^^^^^ method not found in `&S`