The v0.14 upgrade moved these components to Miden's little-endian stack convention and updated the word reads to movdn.3 drop drop drop. It looks like four reads were missed:
crates/contracts/masm/auth/guardian.masm:182crates/contracts/masm/auth/guardian_ecdsa.masm:178crates/contracts/masm/auth/multisig.masm:87crates/contracts/masm/auth/multisig_ecdsa.masm:87
These read a word where the value sits in element 0 and the other three are zeros, so a bare drop drop drop keeps element 3, which is always 0.
Leading to two bugs:
-
In verify_guardian_signature the selector always reads as 0, so push.1 eq is never true and the signature check inside the if.true never runs. An account created with guardian_enabled = true behaves like a plain multisig.
-
In assert_new_tx the previous map value always reads as 0, so assertz always passes and ERR_TX_ALREADY_EXECUTED can't fire.
The v0.14 upgrade moved these components to Miden's little-endian stack convention and updated the word reads to
movdn.3 drop drop drop. It looks like four reads were missed:crates/contracts/masm/auth/guardian.masm:182crates/contracts/masm/auth/guardian_ecdsa.masm:178crates/contracts/masm/auth/multisig.masm:87crates/contracts/masm/auth/multisig_ecdsa.masm:87These read a word where the value sits in element 0 and the other three are zeros, so a bare
drop drop dropkeeps element 3, which is always 0.Leading to two bugs:
In
verify_guardian_signaturethe selector always reads as 0, sopush.1 eqis never true and the signature check inside theif.truenever runs. An account created withguardian_enabled = truebehaves like a plain multisig.In
assert_new_txthe previous map value always reads as 0, soassertzalways passes andERR_TX_ALREADY_EXECUTEDcan't fire.