Struct AuthNetworkAccount 

pub struct AuthNetworkAccount { /* private fields */ }

An AccountComponent implementing an authentication scheme that restricts what notes an account can consume to a fixed allowlist of note script roots, and what transaction scripts may run against the account to a fixed allowlist of tx script roots.

This is intended for network-owned accounts (e.g. the AggLayer bridge or a network faucet) whose only legitimate inputs are a known, finite set of system-issued notes and scripts.

The component exports a single auth procedure, auth_network_transaction, that rejects the transaction unless:

• the transaction script root, if any, is present in the component’s tx-script allowlist, and
• every consumed input note has a script root present in the component’s note-script allowlist.

If both checks pass, the procedure pays the transaction fee by creating a public TX_FEE note funded from the account’s vault in the native fee asset at rate 1/1 (see miden::standards::fee::pay_fee and miden::standards::fee::native_conversion_info). On chains with a zero verification base fee no note is created.

Because a network account has no signature gate by default, a transaction script is an unconstrained code path that could call the account’s procedures directly. The tx-script allowlist constrains this to a fixed set of owner-approved scripts; an empty tx-script allowlist permits no transaction scripts at all.

IMPORTANT: an allowlisted root pins a script’s code (its MAST root), not the inputs it runs on. A tx script still receives caller-controlled TX_SCRIPT_ARGS and advice-provider inputs, and a note script receives caller-controlled NOTE_ARGS; on an open network account anyone can supply those. A root should therefore only be allowlisted when the script’s effect is safe for every possible input. The canonical example is a tx script that sets the transaction expiration delta to a hardcoded constant: its effect is fixed regardless of caller or inputs, and the kernel only ever lets a script tighten the current transaction’s expiration window (never extend it), so the worst a caller can do is make their own transaction expire sooner. Allowlisting a script whose effect depends on its inputs re-opens the very code path the allowlist exists to constrain.

The note allowlist is stored in the standardized NetworkAccountNoteAllowlist slot so off-chain services can identify a network account by checking for this slot.

Both allowlists can be updated after deployment via the add_allowed_note_script / remove_allowed_note_script and add_allowed_tx_script / remove_allowed_tx_script account procedures. These are gated by the account-wide Authority component, which must be composed onto the account in OwnerControlled or RbacControlled mode. AuthControlled mode is unsafe here because this component’s auth scheme is intentionally permissionless, so authorization to mutate the allowlists must come from an owner or a role rather than from the auth scheme itself.

An update is driven by a note the authorized party sends to the account. That admin note’s own script root must already be in the note-script allowlist so the transaction passes auth. The auth procedure reads the allowlists from the transaction’s initial state, so an update only takes effect from the next transaction.

Fee policy

This component owns the fee-policy related storage slots and procedures. It carries the FeePolicyManager it was constructed with, which configures those slots, and, when expanded into AccountComponents, yields the components of the manager’s registered fee policies right after itself. The auth procedure also collects fees from FEE_SPONSORSHIP input notes, denominated in the configured fee asset.

Because every network transaction pays a fee, the fee policy is not optional: the component is constructed from a FeePolicyManager, which initializes the slots from the manager’s active policy, allowed policies and fee asset.

Sponsorship policy

Paying the fee also sponsors every network output note the transaction creates, out of this account’s vault. The component’s SponsorshipPolicy decides whether that spending is bounded by what the account collected in the same transaction. It defaults to SponsorshipPolicy::AtMostCollectedFees, so an account only forwards value it collected. Accounts that are meant to subsidise their own outgoing notes opt into SponsorshipPolicy::Unlimited.

Implementations

impl AuthNetworkAccount

pub const NAME: &'static str = "miden::standards::auth::network_account"

The name of the component.

pub fn new( allowed_notes: BTreeSet<NoteScriptRoot>, fee_policy_manager: FeePolicyManager, ) -> Result<AuthNetworkAccount, NetworkAccountNoteAllowlistError>

Creates a new AuthNetworkAccount component configured with the standard network-account defaults on top of the provided input-note script roots, paying fees per the given FeePolicyManager.

On top of allowed_notes, the following default configuration is always applied (use custom for a variant that applies none of it):

• The standardized NetworkAccountConfigNote script root is added to the note allowlist, so the account’s allowlists can be updated after deployment by sending that note.
• The FeeSponsorshipNote script root is added to the note allowlist. A network account collects prepaid fees by consuming these notes, so without it, fees could not be collected. Allowlisting it is safe: the note’s own script refuses consumption without the note it sponsors, and fee collection asserts every consumed note’s fee is covered by the sponsorships bound to it.
• The tx-script allowlist contains the ExpirationTransactionScript root, which the network transaction builder attaches to every network transaction, so the account is serviceable by the network.

The active policy, allowed policies and fee asset of fee_policy_manager initialize the three fee-policy storage slots this component owns. The manager is carried by the component and the components of its registered policies are emitted alongside it when the component is expanded (see the IntoIterator impl), so the caller does not install them separately.

pub fn default_allowed_note_scripts() -> [NoteScriptRoot; 2]

Returns the note script roots added to every standard network account’s allowlist.

pub fn custom( allowed_notes: BTreeSet<NoteScriptRoot>, fee_policy_manager: FeePolicyManager, ) -> Result<AuthNetworkAccount, NetworkAccountNoteAllowlistError>

Creates a raw AuthNetworkAccount component from the given note-script allowlist, with an empty tx-script allowlist and without any default configuration.

Most callers should use Self::new to include the defaults.

pub fn with_sponsorship_policy( self, sponsorship_policy: SponsorshipPolicy, ) -> AuthNetworkAccount

Sets the SponsorshipPolicy bounding how much the account spends sponsoring the network notes it creates.

pub fn with_allowed_tx_scripts( self, allowed_tx_script_roots: impl IntoIterator<Item = TransactionScriptRoot>, ) -> AuthNetworkAccount

Extends the tx-script allowlist with the given transaction script roots, keeping any that are already allowlisted.

Only tx scripts whose effect is safe for every possible input should be allowlisted: a root pins the script’s code but not its TX_SCRIPT_ARGS or advice inputs, which the (arbitrary) transaction submitter controls. See the AuthNetworkAccount type docs for the full rationale.

pub const fn name() -> AccountComponentName

Returns the canonical AccountComponentName of this component.

pub fn code() -> &'static AccountComponentCode

Returns the AccountComponentCode of this component.

pub fn allowed_notes(&self) -> &NetworkAccountNoteAllowlist

Returns the NetworkAccountNoteAllowlist of this component.

pub fn allowed_tx_scripts(&self) -> &NetworkAccountTxScriptAllowlist

Returns the NetworkAccountTxScriptAllowlist of this component.

pub fn sponsorship_policy(&self) -> SponsorshipPolicy

Returns the SponsorshipPolicy of this component.

pub fn add_allowed_note_script_root() -> AccountProcedureRoot

Returns the procedure root of the add_allowed_note_script procedure exposed by this component.

pub fn remove_allowed_note_script_root() -> AccountProcedureRoot

Returns the procedure root of the remove_allowed_note_script procedure exposed by this component.

pub fn add_allowed_tx_script_root() -> AccountProcedureRoot

Returns the procedure root of the add_allowed_tx_script procedure exposed by this component.

pub fn remove_allowed_tx_script_root() -> AccountProcedureRoot

Returns the procedure root of the remove_allowed_tx_script procedure exposed by this component.

pub fn estimate_note_fee_root() -> AccountProcedureRoot

Returns the procedure root of the estimate_note_fee procedure exposed by this component.

pub fn set_fee_policy_root() -> AccountProcedureRoot

Returns the procedure root of the set_fee_policy procedure exposed by this component.

pub fn get_fee_policy_root() -> AccountProcedureRoot

Returns the procedure root of the get_fee_policy procedure exposed by this component.

pub fn get_fee_asset_id_root() -> AccountProcedureRoot

Returns the procedure root of the get_fee_asset_id procedure exposed by this component.

pub fn add_allowed_fee_policy_root() -> AccountProcedureRoot

Returns the procedure root of the add_allowed_fee_policy account procedure.

pub fn remove_allowed_fee_policy_root() -> AccountProcedureRoot

Returns the procedure root of the remove_allowed_fee_policy account procedure.

pub fn allowed_note_scripts_slot() -> &'static StorageSlotName

Returns the storage slot holding the allowlist of allowed input-note script roots.

pub fn allowed_note_scripts_slot_schema() -> (StorageSlotName, StorageSlotSchema)

Returns the storage slot schema for the note-script allowlist slot.

pub fn allowed_tx_scripts_slot() -> &'static StorageSlotName

Returns the storage slot holding the allowlist of allowed transaction script roots.

pub fn allowed_tx_scripts_slot_schema() -> (StorageSlotName, StorageSlotSchema)

Returns the storage slot schema for the tx-script allowlist slot.

pub fn sponsorship_policy_slot() -> &'static StorageSlotName

Returns the storage slot holding the sponsorship policy.

pub fn sponsorship_policy_slot_schema() -> (StorageSlotName, StorageSlotSchema)

Returns the storage slot schema for the sponsorship policy slot.

pub fn component_metadata() -> AccountComponentMetadata

Returns the AccountComponentMetadata for this component.

Trait Implementations

impl IntoIterator for AuthNetworkAccount

fn into_iter(self) -> <AuthNetworkAccount as IntoIterator>::IntoIter

Expands the configuration into its AccountComponents: the auth component itself and all fee policy components registered with the FeePolicyManager.

type Item = AccountComponent

The type of the elements being iterated over.

type IntoIter = IntoIter<AccountComponent>

Which kind of iterator are we turning this into?