From d0fc8569c478111bfa5da90570ee3a0ac449a60d Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Sat, 1 Aug 2026 09:00:18 -0700 Subject: Never render another ASP's Ark state before connecting MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous fix still let a phantom balance through: loadArkState fell back to the pre-namespacing key when a namespace was empty, and the UI renders from that before any server is contacted — so the guard, which runs on connect, never got a say. loadArkState now returns only the namespaced state. Legacy state is claimed through adoptArkState(serverPubkey), which proves ownership first: from the state's own stamp, or failing that by decoding a vtxo, whose wire format names its cosigner. No network call, and it cannot guess wrong. On a match the state moves into the namespace and the legacy key is retired; on a mismatch it is left untouched for its real owner. Co-Authored-By: Claude Fable 5 --- src/ark/manager.js | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'src/ark') diff --git a/src/ark/manager.js b/src/ark/manager.js index 4814a26..03e8e18 100644 --- a/src/ark/manager.js +++ b/src/ark/manager.js @@ -103,6 +103,13 @@ export class ArkManager { this.psa = hs?.psa; this.serverPub = hex.decode(this.info.serverPubkey); + // Pre-namespacing state can now be proven to belong to this server (the + // vtxo wire format names its cosigner), so claim it before deciding. + if (!this.state.serverPubkey && this.storage.adopt) { + const adopted = this.storage.adopt(this.info.serverPubkey); + if (adopted) this.state = adopted; + } + // A vtxo is only meaningful against the server that cosigned it. State // carried over from a different ASP (a provider switch, or a snapshot // adopted from the pre-namespacing key) would show phantom balance and -- cgit v1.2.3