verify confidential per-asset conservation

7 files changed, 296 insertions, 0 deletions

diff --git a/docs/MONZERO_ASSETS_V1_SPEC.md b/docs/MONZERO_ASSETS_V1_SPEC.md
index 73bd27790..55d1391ef 100644
--- a/docs/MONZERO_ASSETS_V1_SPEC.md
+++ b/docs/MONZERO_ASSETS_V1_SPEC.md
@@ -252,6 +252,29 @@ properties remain prerequisites for an isolated prototype network. The
 transparent statement must never be mistaken for a production transaction
 design.
 
+### 6.2 Inactive confidential conservation prototype
+
+The source tree now contains an inactive per-asset Pedersen-commitment and
+Bulletproof+ verifier. It reuses the inherited RingCT curve and range-proof
+implementation, requires exact proof coverage of every output and explicit
+burn commitment, and checks that pseudo inputs equal outputs plus burns inside
+each public asset-ID domain. Fixed-supply issuance uses a zero-mask commitment
+to the descriptor's public lifetime supply. Limits currently cap each balance
+group at 16 pseudo inputs and 16 destinations.
+
+Adversarial tests reject inflation, substituted commitments, malformed range
+proofs, duplicate asset groups, unknown assets, cross-asset pseudo inputs, and
+issuance commitments that disagree with the declared supply. Malformed curve
+proofs are converted to deterministic validation failure rather than escaping
+as exceptions.
+
+This layer still does **not** authorize ownership or prevent double spends.
+Production integration requires ring-member references resolved against stored
+asset outputs, asset key images, a domain-separated CLSAG transcript, canonical
+wire serialization, and database indexes for unspent output lookup. Until that
+layer exists and is reviewed, these proofs cannot make an asset transaction
+valid on any Monzero network.
+
 ## 7. Metadata
 
 Consensus stores only bounded identity and commitment fields. Descriptions,
diff --git a/docs/MONZERO_PHASE0_STABILIZATION.md b/docs/MONZERO_PHASE0_STABILIZATION.md
index 13ce9ef20..4b9a37e72 100644
--- a/docs/MONZERO_PHASE0_STABILIZATION.md
+++ b/docs/MONZERO_PHASE0_STABILIZATION.md
@@ -133,6 +133,8 @@ isolated disposable development network may be used after cryptographic review.
 - [x] Atomic ordered block-issuance adapter, detach behavior, and deterministic state commitments.
 - [x] Detached versioned transaction extension bound to a native prefix commitment.
 - [x] Atomic block-extension validation against independently supplied native carrier commitments.
+- [x] Persistent LMDB issuance registry with restart reconstruction and native reorg rollback.
+- [x] Inactive per-asset Pedersen/Bulletproof+ conservation and burn verifier.
 - [x] External cryptographic-review brief and mandatory threat cases.
 - [ ] Reviewed confidential per-asset commitment and range-proof construction.
 - [ ] Versioned asset transaction serialization with strict parser limits.
diff --git a/src/cryptonote_basic/CMakeLists.txt b/src/cryptonote_basic/CMakeLists.txt
index 91612168c..84e86803c 100644
--- a/src/cryptonote_basic/CMakeLists.txt
+++ b/src/cryptonote_basic/CMakeLists.txt
@@ -45,6 +45,7 @@ target_link_libraries(cryptonote_format_utils_basic
 )
 
 set(cryptonote_basic_sources
+  asset_confidential.cpp
   account.cpp
   asset_types.cpp
   connection_context.cpp
diff --git a/src/cryptonote_basic/asset_confidential.cpp b/src/cryptonote_basic/asset_confidential.cpp
new file mode 100644
index 000000000..d2473bea1
--- /dev/null
+++ b/src/cryptonote_basic/asset_confidential.cpp
@@ -0,0 +1,131 @@
+#include "asset_confidential.h"
+
+#include <cstring>
+
+#include "ringct/bulletproofs_plus.h"
+#include "ringct/rctOps.h"
+
+namespace cryptonote
+{
+namespace assets
+{
+namespace
+{
+  bool fail(std::string* error, const std::string& message)
+  {
+    if (error)
+      *error = message;
+    return false;
+  }
+
+  bool valid_points(const rct::keyV& points)
+  {
+    for (const rct::key& point : points)
+      if (!rct::isInMainSubgroup(point))
+        return false;
+    return true;
+  }
+}
+
+bool verify_confidential_asset_balance(const confidential_asset_balance& balance, std::string* error)
+{
+  if (balance.asset_id == crypto::null_hash)
+    return fail(error, "confidential balance has a zero asset id");
+  if (balance.pseudo_inputs.empty())
+    return fail(error, "confidential balance has no pseudo inputs");
+  if (balance.outputs.empty() && balance.burns.empty())
+    return fail(error, "confidential balance has no outputs or burns");
+  if (balance.pseudo_inputs.size() > MAX_CONFIDENTIAL_ASSET_INPUTS
+      || balance.outputs.size() + balance.burns.size() > MAX_CONFIDENTIAL_ASSET_OUTPUTS)
+    return fail(error, "confidential balance exceeds input or output limits");
+  rct::keyV input_commitments;
+  input_commitments.reserve(balance.pseudo_inputs.size());
+  for (const confidential_pseudo_input& input : balance.pseudo_inputs)
+  {
+    if (input.source_asset_id != balance.asset_id)
+      return fail(error, "pseudo input crosses asset balance domains");
+    input_commitments.push_back(input.commitment);
+  }
+  if (!valid_points(input_commitments) || !valid_points(balance.outputs) || !valid_points(balance.burns))
+    return fail(error, "confidential balance contains an invalid curve point");
+
+  const size_t commitment_count = balance.outputs.size() + balance.burns.size();
+  size_t proof_commitments = 0;
+  rct::keyV proven_commitments;
+  proven_commitments.reserve(commitment_count);
+  for (const rct::BulletproofPlus& proof : balance.range_proofs)
+  {
+    if (proof.V.empty() || proof_commitments > commitment_count - proof.V.size())
+      return fail(error, "range proofs do not cover the declared commitments exactly");
+    try
+    {
+      if (!rct::bulletproof_plus_VERIFY(proof))
+        return fail(error, "invalid asset Bulletproof+");
+    }
+    catch (const std::exception&)
+    {
+      return fail(error, "malformed asset Bulletproof+");
+    }
+    for (const rct::key& scaled : proof.V)
+    {
+      proven_commitments.push_back(rct::scalarmult8(scaled));
+    }
+    proof_commitments += proof.V.size();
+  }
+  if (proof_commitments != commitment_count)
+    return fail(error, "range proofs do not cover every output and burn");
+  for (size_t index = 0; index < balance.outputs.size(); ++index)
+    if (!rct::equalKeys(proven_commitments[index], balance.outputs[index]))
+      return fail(error, "range proof output commitment mismatch");
+  for (size_t index = 0; index < balance.burns.size(); ++index)
+    if (!rct::equalKeys(proven_commitments[balance.outputs.size() + index], balance.burns[index]))
+      return fail(error, "range proof burn commitment mismatch");
+
+  const rct::key input_sum = rct::addKeys(input_commitments);
+  rct::keyV destinations = balance.outputs;
+  destinations.insert(destinations.end(), balance.burns.begin(), balance.burns.end());
+  const rct::key output_sum = rct::addKeys(destinations);
+  if (!rct::equalKeys(input_sum, output_sum))
+    return fail(error, "asset commitments do not conserve value");
+  return true;
+}
+
+bool verify_confidential_asset_transaction(
+  const std::vector<confidential_asset_balance>& balances,
+  const std::set<crypto::hash>& known_assets,
+  const boost::optional<issuance_descriptor>& issuance,
+  std::string* error)
+{
+  if (balances.empty())
+    return fail(error, "confidential asset transaction is empty");
+  std::set<crypto::hash> seen;
+  crypto::hash issued_id{};
+  if (issuance && !derive_asset_id(*issuance, issued_id, error))
+    return false;
+  bool found_issuance = false;
+  for (const confidential_asset_balance& balance : balances)
+  {
+    if (!seen.insert(balance.asset_id).second)
+      return fail(error, "asset appears in more than one balance group");
+    const bool is_issuance = issuance && balance.asset_id == issued_id;
+    if (!is_issuance && known_assets.count(balance.asset_id) == 0)
+      return fail(error, "confidential balance references an unknown asset");
+    if (is_issuance)
+    {
+      if (known_assets.count(balance.asset_id) != 0)
+        return fail(error, "confidential issuance duplicates an existing asset");
+      if (balance.pseudo_inputs.size() != 1
+          || !rct::equalKeys(balance.pseudo_inputs.front().commitment, rct::commit(issuance->atomic_supply, rct::zero()))
+          || balance.pseudo_inputs.front().source_asset_id != balance.asset_id)
+        return fail(error, "issuance pseudo input does not commit to the fixed supply");
+      found_issuance = true;
+    }
+    if (!verify_confidential_asset_balance(balance, error))
+      return false;
+  }
+  if (issuance && !found_issuance)
+    return fail(error, "issuance has no matching confidential balance group");
+  return true;
+}
+}
+}
diff --git a/src/cryptonote_basic/asset_confidential.h b/src/cryptonote_basic/asset_confidential.h
new file mode 100644
index 000000000..d79efb56f
--- /dev/null
+++ b/src/cryptonote_basic/asset_confidential.h
@@ -0,0 +1,42 @@
+#pragma once
+
+#include <set>
+#include <string>
+#include <vector>
+
+#include "asset_types.h"
+#include "ringct/rctTypes.h"
+
+namespace cryptonote
+{
+namespace assets
+{
+  constexpr size_t MAX_CONFIDENTIAL_ASSET_INPUTS = 16;
+  constexpr size_t MAX_CONFIDENTIAL_ASSET_OUTPUTS = 16;
+
+  struct confidential_pseudo_input
+  {
+    crypto::hash source_asset_id{};
+    rct::key commitment{};
+  };
+
+  struct confidential_asset_balance
+  {
+    crypto::hash asset_id{};
+    std::vector<confidential_pseudo_input> pseudo_inputs;
+    rct::keyV outputs;
+    rct::keyV burns;
+    std::vector<rct::BulletproofPlus> range_proofs;
+  };
+
+  bool verify_confidential_asset_balance(
+    const confidential_asset_balance& balance,
+    std::string* error = nullptr);
+
+  bool verify_confidential_asset_transaction(
+    const std::vector<confidential_asset_balance>& balances,
+    const std::set<crypto::hash>& known_assets,
+    const boost::optional<issuance_descriptor>& issuance,
+    std::string* error = nullptr);
+}
+}
diff --git a/tests/unit_tests/CMakeLists.txt b/tests/unit_tests/CMakeLists.txt
index 16e498ae9..b3328fe74 100644
--- a/tests/unit_tests/CMakeLists.txt
+++ b/tests/unit_tests/CMakeLists.txt
@@ -30,6 +30,7 @@ set(unit_tests_sources
   account.cpp
   apply_permutation.cpp
   address_from_url.cpp
+  asset_confidential.cpp
   asset_types.cpp
   base58.cpp
   blockchain_db.cpp
diff --git a/tests/unit_tests/asset_confidential.cpp b/tests/unit_tests/asset_confidential.cpp
new file mode 100644
index 000000000..2b3980758
--- /dev/null
+++ b/tests/unit_tests/asset_confidential.cpp
@@ -0,0 +1,96 @@
+#include "gtest/gtest.h"
+
+#include "cryptonote_basic/asset_confidential.h"
+#include "ringct/bulletproofs_plus.h"
+#include "ringct/rctOps.h"
+
+namespace
+{
+  crypto::hash asset_id(unsigned char value)
+  {
+    crypto::hash id{};
+    id.data[0] = value;
+    return id;
+  }
+
+  cryptonote::assets::confidential_asset_balance make_balance(
+    const crypto::hash& id, uint64_t input_amount,
+    const std::vector<uint64_t>& outputs, const std::vector<uint64_t>& burns)
+  {
+    rct::keyV masks = rct::skvGen(outputs.size() + burns.size());
+    rct::key input_mask = rct::zero();
+    for (const rct::key& mask : masks)
+      sc_add(input_mask.bytes, input_mask.bytes, mask.bytes);
+    cryptonote::assets::confidential_asset_balance balance;
+    balance.asset_id = id;
+    balance.pseudo_inputs.push_back({id, rct::commit(input_amount, input_mask)});
+    size_t index = 0;
+    for (const uint64_t amount : outputs)
+      balance.outputs.push_back(rct::commit(amount, masks[index++]));
+    for (const uint64_t amount : burns)
+      balance.burns.push_back(rct::commit(amount, masks[index++]));
+    std::vector<uint64_t> amounts = outputs;
+    amounts.insert(amounts.end(), burns.begin(), burns.end());
+    balance.range_proofs.push_back(rct::bulletproof_plus_PROVE(amounts, masks));
+    return balance;
+  }
+}
+
+TEST(asset_confidential, verifies_private_transfer_and_explicit_burn)
+{
+  const crypto::hash id = asset_id(1);
+  const auto balance = make_balance(id, 10, {7}, {3});
+  std::string error;
+  ASSERT_TRUE(cryptonote::assets::verify_confidential_asset_balance(balance, &error)) << error;
+  ASSERT_TRUE(cryptonote::assets::verify_confidential_asset_transaction({balance}, {id}, boost::none, &error)) << error;
+}
+
+TEST(asset_confidential, rejects_inflation_and_commitment_substitution)
+{
+  const crypto::hash id = asset_id(2);
+  std::string error;
+  auto inflated = make_balance(id, 10, {11}, {});
+  EXPECT_FALSE(cryptonote::assets::verify_confidential_asset_balance(inflated, &error));
+  auto substituted = make_balance(id, 10, {10}, {});
+  substituted.outputs.front() = rct::commit(10, rct::skGen());
+  EXPECT_FALSE(cryptonote::assets::verify_confidential_asset_balance(substituted, &error));
+  auto malformed = make_balance(id, 10, {10}, {});
+  malformed.range_proofs.front().A.bytes[0] ^= 1;
+  EXPECT_FALSE(cryptonote::assets::verify_confidential_asset_balance(malformed, &error));
+}
+
+TEST(asset_confidential, rejects_cross_asset_and_duplicate_balance_domains)
+{
+  const crypto::hash first = asset_id(3);
+  const crypto::hash second = asset_id(4);
+  std::string error;
+  auto crossed = make_balance(first, 9, {9}, {});
+  crossed.pseudo_inputs.front().source_asset_id = second;
+  EXPECT_FALSE(cryptonote::assets::verify_confidential_asset_balance(crossed, &error));
+  const auto valid = make_balance(first, 9, {9}, {});
+  EXPECT_FALSE(cryptonote::assets::verify_confidential_asset_transaction({valid, valid}, {first}, boost::none, &error));
+  EXPECT_FALSE(cryptonote::assets::verify_confidential_asset_transaction({valid}, {second}, boost::none, &error));
+}
+
+TEST(asset_confidential, validates_fixed_supply_issuance_commitment)
+{
+  crypto::public_key issuer{};
+  crypto::secret_key secret{};
+  crypto::generate_keys(issuer, secret);
+  cryptonote::assets::issuance_descriptor descriptor;
+  descriptor.network = cryptonote::TESTNET;
+  descriptor.issuer_key = issuer;
+  descriptor.atomic_supply = 10;
+  descriptor.issuance_nonce.data[0] = 9;
+  crypto::hash id{};
+  ASSERT_TRUE(cryptonote::assets::derive_asset_id(descriptor, id));
+  cryptonote::assets::confidential_asset_balance balance;
+  balance.asset_id = id;
+  balance.pseudo_inputs.push_back({id, rct::commit(10, rct::zero())});
+  balance.outputs.push_back(rct::commit(10, rct::zero()));
+  balance.range_proofs.push_back(rct::bulletproof_plus_PROVE(10, rct::zero()));
+  std::string error;
+  ASSERT_TRUE(cryptonote::assets::verify_confidential_asset_transaction({balance}, {}, descriptor, &error)) << error;
+  balance.pseudo_inputs.front().commitment = rct::commit(11, rct::zero());
+  EXPECT_FALSE(cryptonote::assets::verify_confidential_asset_transaction({balance}, {}, descriptor, &error));
+}