fix(core): reject receiving objects owned by AA accounts #9869

miker83z · 2026-01-20T16:53:01Z

Description of change

Based on this scenario -> #9371 Receiving objects could be used to make AA TX certificates invalid, even after these were signed by the majority of validators.

This PR makes so that any TX trying to receive an object owned by an AA account (i.e., an object having a AuthenticatorFunctionRef dynamic field) would abort execution (a validator could still sign the certificate, but the execution makes sure that the received objects will not be received and won't bump the sequence number).

This PR also fixes a small issue related to duplicate function names in a package.

Links to any relevant issues

Closes #9371
Fixes #9862

How the change has been tested

Basic tests (linting, compilation, formatting, unit/integration tests)
Patch-specific tests (correctness, functionality coverage)
I have added tests that prove my fix is effective or that my feature works
I have checked that new and existing unit tests pass locally with my changes

… that checks what happens if the gas coin is locked by validators in TX1 and then TX2 is sequenced by consensus before TX1.

…unts

vercel · 2026-01-20T16:53:07Z

The latest updates on your projects. Learn more about Vercel for GitHub.

6 Skipped Deployments

Project	Deployment	Review	Updated (UTC)
apps-backend	Ignored	Preview	Jan 26, 2026 9:05am
apps-ui-kit	Ignored	Preview	Jan 26, 2026 9:05am
iota-evm-bridge	Ignored	Preview	Jan 26, 2026 9:05am
iota-multisig-toolkit	Ignored	Preview	Jan 26, 2026 9:05am
rebased-explorer	Ignored	Preview	Jan 26, 2026 9:05am
wallet-dashboard	Ignored	Preview	Jan 26, 2026 9:05am

crates/iota-core/src/transaction_input_loader.rs

This reverts commit 49a5f4e.

lzpap

@miker83z please modify crates/iota-adapter-transactional-tests/tests/abstract_account/account/receive_object.move as the tests are failing due to that test case expecting a receive to go through on an account object

crates/iota-e2e-tests/tests/abstract_account_tests.rs

…aa-auth/9862-remove-receive-aa-accounts

lzpap

lgtm!

Dkwcs · 2026-01-26T09:59:35Z

crates/iota-adapter-transactional-tests/tests/abstract_account/account/receive_object.snap

-mutated: object(2,0), object(2,2), object(5,0)
-gas summary: computation_cost: 1000000, computation_cost_burned: 1000000, storage_cost: 3351600,  storage_rebate: 3351600, non_refundable_storage_fee: 0
+Error: Transaction Effects Status: Move Runtime Abort. Location: iota::transfer::receive_impl (function index 12) at offset 0, Abort Code: 5
+Debug of error: MoveAbort(MoveLocation { module: ModuleId { address: iota, name: Identifier("transfer") }, function: 12, instruction: 0, function_name: Some("receive_impl") }, 5) at command Some(0)


Does this error explain the receiving case enough?

No, but that's the only one we could obtain through a native function I guess.

valeriyr · 2026-01-26T09:59:37Z

crates/iota-protocol-config/src/lib.rs

                        cfg.max_auth_gas = Some(250_000_000);
+                        // Increase the base cost for transfer receive object in devnet, since the
+                        // implementation now does check if parent is not an account.
+                        cfg.transfer_receive_object_cost_base = Some(100);


Just to clarify, how was the new value calculated?
The current cost is 52, dynamic_field_has_child_object_cost_base equals 100.
Should the new value be 52 + 100 = 152?

the current value of 52 covers the cost of:

querying the database against an objects id, loading up the child,

comparing the type of the loaded object to the one expected.

With the receive parent check, we only do essentially 1, as we know that under that key there can only be stored a dynamic field with a certain type, so no need to check. Therefore, the new check only adds an additional database query which makes us think that roughly double the cost is appropriate, hence 100

@valeriyr we could also do 104 if you deem the heavy lifting is the db query.

I am asking because, as far as I see, we added the same check as can be found here(child_object_exists is the only function that is called here):

iota/iota-execution/latest/iota-move-natives/src/dynamic_field.rs

Line 432 in 4a711d2

pub fn has_child_object(

It costs 100.

Dkwcs · 2026-01-26T10:02:00Z

crates/iota-protocol-config/src/snapshots/iota_protocol_config__test__version_19.snap

 transfer_freeze_object_cost_base: 52
 transfer_share_object_cost_base: 52
-transfer_receive_object_cost_base: 52
+transfer_receive_object_cost_base: 100


Just would like to know - what is the mechanism for changing those values? (Why 100 not other value, like 152? )

Dkwcs · 2026-01-26T10:03:49Z

iota-execution/latest/iota-move-natives/src/transfer.rs

 const E_UNABLE_TO_RECEIVE_OBJECT: u64 = 3;
+// Represents the case where it is trying to receive an object owned by an
+// account.
+const E_ACCOUNT_CANNOT_RECEIVE_OBJECT: u64 = 5;


Should it be 4 instead of 5? In order to maintain logical error numbering

Number 4 only appears on the Move side, we should take into consideration that also on the rust side

crates/iota-move-build/src/lib.rs

Dkwcs

LGTM, left minor comments

valeriyr · 2026-01-26T10:07:58Z

crates/iota-types/src/move_package.rs

 /// Uniquely identifies a function in a module
 pub struct FnInfoKey {
    pub fn_name: String,
+    pub mod_name: String,


Why do we need a module name here? Does it mean that FnInfoKey currently doesn't identify a function uniquely?
Do we have a test that shows the issue?

Does it mean that FnInfoKey currently doesn't identify a function uniquely?

Exactly, this is like this also upstream (but it only affects test attributes in that case)

# Description of change Based on this scenario -> #9371 Receiving objects could be used to make AA TX certificates invalid, even after these were signed by the majority of validators. This PR makes so that any TX trying to receive an object owned by an AA account (i.e., an object having a `AuthenticatorFunctionRef` dynamic field) would abort execution (a validator could still sign the certificate, but the execution makes sure that the received objects will not be received and won't bump the sequence number). This PR also fixes a small issue related to duplicate function names in a package. ## Links to any relevant issues Closes #9371 Fixes #9862 ## How the change has been tested - [x] Basic tests (linting, compilation, formatting, unit/integration tests) - [x] Patch-specific tests (correctness, functionality coverage) - [x] I have added tests that prove my fix is effective or that my feature works - [x] I have checked that new and existing unit tests pass locally with my changes --------- Co-authored-by: Dkwcs <pavlo.botnar@gmail.com>

Dkwcs and others added 4 commits January 20, 2026 13:04

feat(iota-e2e-tests): new test_receiving_gas_in_two_separate_txs test…

5de301f

… that checks what happens if the gas coin is locked by validators in TX1 and then TX2 is sequenced by consensus before TX1.

ObjectVersionUnavailableForConsumption panic case in the test

29a8629

refactor(e2e): aa receiving test after rebase

a7081c9

fix(core): tx input loader rejects receiving objects owned by AA acco…

5b37980

…unts

miker83z requested review from a team as code owners January 20, 2026 16:53

miker83z requested review from Dkwcs and lzpap January 20, 2026 16:53

iota-ci added sc-platform Issues related to the Smart Contract Platform group. vm-language Issues related to the VM & Language Team labels Jan 20, 2026

miker83z self-assigned this Jan 20, 2026

miker83z added this to the v1.16.x milestone Jan 20, 2026

miker83z linked an issue Jan 20, 2026 that may be closed by this pull request

[AA] Remove Receive ability for AA Account shared objects #9862

Closed

3 tasks

fix(e2e): AA receiving objects tests

abad653

miker83z force-pushed the vm-lang/aa-auth/9862-remove-receive-aa-accounts branch from bf4bf69 to abad653 Compare January 20, 2026 16:54

muXxer approved these changes Jan 20, 2026

View reviewed changes

Dkwcs reviewed Jan 20, 2026

View reviewed changes

crates/iota-core/src/transaction_input_loader.rs Outdated Show resolved Hide resolved

Dkwcs reviewed Jan 21, 2026

View reviewed changes

crates/iota-core/src/transaction_input_loader.rs Outdated Show resolved Hide resolved

alexsporn reviewed Jan 21, 2026

View reviewed changes

crates/iota-core/src/transaction_input_loader.rs Outdated Show resolved Hide resolved

miker83z marked this pull request as draft January 21, 2026 13:41

miker83z added 3 commits January 21, 2026 20:37

fix(move-build): make FnInfoKey unique

b575c03

feat(core): lock receiving objects at signing time

49a5f4e

feat(e2e): add delayed AA account test

9277a76

miker83z force-pushed the vm-lang/aa-auth/9862-remove-receive-aa-accounts branch from c891ab4 to 9277a76 Compare January 22, 2026 09:22

piotrm50 approved these changes Jan 22, 2026

View reviewed changes

Revert "feat(core): lock receiving objects at signing time"

cecbdde

This reverts commit 49a5f4e.

miker83z added 2 commits January 23, 2026 16:27

feat(protocol): bump transfer_receive_object_cost_base to 100

37ad2a8

fix(e2e): update aa tests

ae68a72

miker83z marked this pull request as ready for review January 23, 2026 15:37

miker83z changed the title ~~fix(core): tx input loader rejects receiving objects owned by AA accounts~~ fix(core): reject receiving objects owned by AA accounts Jan 23, 2026

lzpap reviewed Jan 23, 2026

View reviewed changes

crates/iota-e2e-tests/tests/abstract_account_tests.rs Outdated Show resolved Hide resolved

crates/iota-e2e-tests/tests/abstract_account_tests.rs Outdated Show resolved Hide resolved

miker83z added 3 commits January 24, 2026 11:19

fix(e2e): update comments

dab65e1

fix(adapter-tx-tests): update receiving object snap

8d4395e

fix(e2e): typo

6b5a516

miker83z changed the base branch from vm-lang/aa-auth/9371-Test-the-receiving-gas-coin-in-two-separate-TXs to vm-lang/aa-auth/8805-beta-feature-branch January 24, 2026 10:34

miker83z linked an issue Jan 24, 2026 that may be closed by this pull request

[AA][e2e] Test the receiving of a gas coin in two separate TXs #9371

Closed

miker83z mentioned this pull request Jan 24, 2026

feat(iota-e2e-tests): Test the receiving of a gas coin in two separate TXs #9854

Closed

update snapshots

f51894e

alexsporn approved these changes Jan 26, 2026

View reviewed changes

miker83z added 2 commits January 26, 2026 09:29

Merge branch 'vm-lang/aa-auth/8805-beta-feature-branch' into vm-lang/…

6d652da

…aa-auth/9862-remove-receive-aa-accounts

fix(iota): use local framework for example test

20442a7

miker83z requested a review from a team as a code owner January 26, 2026 09:04

lzpap approved these changes Jan 26, 2026

View reviewed changes

Dkwcs reviewed Jan 26, 2026

View reviewed changes

valeriyr reviewed Jan 26, 2026

View reviewed changes

Dkwcs reviewed Jan 26, 2026

View reviewed changes

valeriyr reviewed Jan 26, 2026

View reviewed changes

crates/iota-move-build/src/lib.rs Show resolved Hide resolved

Dkwcs approved these changes Jan 26, 2026

View reviewed changes

valeriyr reviewed Jan 26, 2026

View reviewed changes

miker83z merged commit 4091901 into vm-lang/aa-auth/8805-beta-feature-branch Jan 26, 2026
39 checks passed

miker83z deleted the vm-lang/aa-auth/9862-remove-receive-aa-accounts branch January 26, 2026 13:39

fix(core): reject receiving objects owned by AA accounts #9869

fix(core): reject receiving objects owned by AA accounts #9869

Uh oh!

Conversation

miker83z commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description of change

Links to any relevant issues

How the change has been tested

Uh oh!

vercel bot commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lzpap left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

lzpap left a comment

Choose a reason for hiding this comment

Uh oh!

Dkwcs Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

valeriyr Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Dkwcs Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Dkwcs left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

miker83z commented Jan 20, 2026 •

edited

Loading

vercel bot commented Jan 20, 2026 •

edited

Loading

Dkwcs Jan 26, 2026 •

edited

Loading

valeriyr Jan 26, 2026 •

edited

Loading

Dkwcs Jan 26, 2026 •

edited

Loading