Z010: Detect missing access control on verifying-key rotation/upgrade

[Gbangbolaoluwagbemiga]

Overview

Implement rule Z010: detect any function capable of writing/rotating the stored verifying key that lacks an admin/auth check, which would let anyone replace the trusted verification parameters and forge acceptance of invalid proofs.

Background / Context

This is the ZK-specific analogue of the existing S010 upgrade-admin rule family, applied specifically to verifying-key storage rather than contract WASM upgrades — a distinct and equally critical attack surface once contracts support VK rotation (as recommended for long-lived ZK systems needing circuit updates).

Goal

sanctifier-core flags any public function that writes to verifying-key storage without a preceding require_auth/admin check, following the same detection pattern already proven for S010.

Scope of Work

1. Extend the existing S010 upgrade-admin detection pattern to also match verifying-key storage writes.
2. Add triggering/clean fixtures under z010_missing_vk_rotation_access_control.rs.
3. Document in docs/rules/Z010.md, cross-referencing S010.

Out of Scope

• Building the VK-rotation feature itself — detection of missing access control on any such feature, existing or future.

Acceptance Criteria

• Rule flags an unauthenticated VK-write function and not an authenticated one.
• Snapshot tests pass.

Files & Pointers

• tooling/sanctifier-core/src
• contracts/fixtures/finding-codes/z010_missing_vk_rotation_access_control.rs
• docs/rules/Z010.md
• docs/rules/S010.md

Dependencies / Related

Depends on #1192, #1194. Reuses S010 pattern infrastructure.

Difficulty & Estimated Effort

Medium — ~2-3 days (reuses existing S010 detection infra).

[Hayatt74]

@Hayatt74 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi I’d love to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Hayatt74 to this issue.

[GOE001]

@GOE001 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I would like to work on this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @GOE001 to this issue.

[thebabalola]

@thebabalola has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello maintainer. I'm a Stellar dev specializing in smart contract security constraints. I see we need a Z010 rule to detect missing access controls on verifying-key rotations. I'm highly familiar with Soroban's authorization framework (require_auth) and AST analysis. I will implement a static check inside the engine that validates if any function modifying the verifying-key state explicitly asserts admin authentication before execution. Let me know if you want me to pick this up.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @thebabalola to this issue.

[anumukul]

@anumukul has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Greetings maintainer! Can I work on this ?

ℹ️ Repo Maintainers: To accept this application, review their application or assign @anumukul to this issue.