ShadeCheck evidence report

Rule	Coverage	Covered
SC-001	complete-range-delivery	True
SC-005	compatible-baseline-comparison	True

Rule

Coverage

Covered

SC-001

complete-range-delivery

True

SC-005

compatible-baseline-comparison

True

Findings

SC-001 · MEDIUM · Block range violates configured sync disclosure policy

Observed behavior: Requested heights 100 through 106 (7 blocks): inclusive request size differs from the configured chunk size.

Possible consequence: The service observes the connection's exact scan boundary and request size. These can depend on local sync state, but wallet history or identity is not proven.

Affected component: lightwalletd block-range synchronization

Investigation: Review fixed-size aligned retrieval, local filtering, and chain-tip handling against the declared policy; evaluate extra bandwidth and other privacy tradeoffs.

Inspect current evidence (8 events)

[
  {
    "elapsed_ns": 4155339,
    "event_hash": "9bc47b85d6968d1c27f18b4db5c10cfd604d3652c84b57e2769c06c4673755dd",
    "metadata": {
      "end_height": 106,
      "start_height": 100
    },
    "method": "GetBlockRange",
    "mode": "upstream",
    "phase": "request",
    "previous_hash": "0000000000000000000000000000000000000000000000000000000000000000",
    "schema_version": 1,
    "sequence": 1,
    "session": "e4ad8a93e89e6230e05a434961cd3fd5a695f65efdbf6d020e9694f030a1568f",
    "timestamp_ns": 1792833858244580535
  },
  {
    "elapsed_ns": 5791252,
    "event_hash": "c51a4899876063a7f595d5a3cd7f7059cb63a49c07725d203883a6ec2e9a6888",
    "metadata": {
      "block_hash": "a8e074974f6bb064524ccd34a8dab5b81f6097f273bc0c65209a34f28d489802",
      "height": 100,
      "request_sequence": 1,
      "serialized_sha256": "de61628338e5fde38daa54059c64d6ff4c37e604d284ae712b5d1462ed75b9c3",
      "transaction_ids": []
    },
    "method": "GetBlockRange",
    "mode": "upstream",
    "phase": "response",
    "previous_hash": "9bc47b85d6968d1c27f18b4db5c10cfd604d3652c84b57e2769c06c4673755dd",
    "schema_version": 1,
    "sequence": 2,
    "session": "e4ad8a93e89e6230e05a434961cd3fd5a695f65efdbf6d020e9694f030a1568f",
    "timestamp_ns": 1792833858246216428
  },
  {
    "elapsed_ns": 6233758,
    "event_hash": "5107c4517a818386745fcc60fcfd3d21b7c09126a077c7d06efe09f4c85de17c",
    "metadata": {
      "block_hash": "18844d130895ef0917b62421e03fcc585469392eb6bd0d8ca46d37ba9b630e03",
      "height": 101,
      "request_sequence": 1,
      "serialized_sha256": "11a078bb0b066c379eee0fdb1fd6a13f00784b515a651d3170d115cc2e96c28e",
      "transaction_ids": []
    },
    "method": "GetBlockRange",
    "mode": "upstream",
    "phase": "response",
    "previous_hash": "c51a4899876063a7f595d5a3cd7f7059cb63a49c07725d203883a6ec2e9a6888",
    "schema_version": 1,
    "sequence": 3,
    "session": "e4ad8a93e89e6230e05a434961cd3fd5a695f65efdbf6d020e9694f030a1568f",
    "timestamp_ns": 1792833858246659145
  },
  {
    "elapsed_ns": 6567802,
    "event_hash": "5119d3cadae68a10baf254f5b401904e9745fab4179b386d57320b41cb19c52b",
    "metadata": {
      "block_hash": "e694d37e5dfe6d82ba05c43969e639c15bbd234b1ce78d468019e7e144b68c07",
      "height": 102,
      "request_sequence": 1,
      "serialized_sha256": "ee9dff79eb1b47693ad29bf9dd73bcd7209942d81fd7137d5b66c876d2c8ebb5",
      "transaction_ids": []
    },
    "method": "GetBlockRange",
    "mode": "upstream",
    "phase": "response",
    "previous_hash": "5107c4517a818386745fcc60fcfd3d21b7c09126a077c7d06efe09f4c85de17c",
    "schema_version": 1,
    "sequence": 4,
    "session": "e4ad8a93e89e6230e05a434961cd3fd5a695f65efdbf6d020e9694f030a1568f",
    "timestamp_ns": 1792833858246993178
  },
  {
    "elapsed_ns": 6931142,
    "event_hash": "dc93de968746b1626fd0cb1e01da341d62ab61e57cd8dbcda16b4f823554a20f",
    "metadata": {
      "block_hash": "f24d6e7666100c5ddb3fe9a42e8dbe150eebdad9b89177cf341086eb26ed0d02",
      "height": 103,
      "request_sequence": 1,
      "serialized_sha256": "6e3f4e63f4bb6a678599c75cbd43e99c70e6d2d8305f782af495e0614af5f948",
      "transaction_ids": []
    },
    "method": "GetBlockRange",
    "mode": "upstream",
    "phase": "response",
    "previous_hash": "5119d3cadae68a10baf254f5b401904e9745fab4179b386d57320b41cb19c52b",
    "schema_version": 1,
    "sequence": 5,
    "session": "e4ad8a93e89e6230e05a434961cd3fd5a695f65efdbf6d020e9694f030a1568f",
    "timestamp_ns": 1792833858247356488
  },
  {
    "elapsed_ns": 7206535,
    "event_hash": "e2bef3be550d686da820b65b364e1c928240e237bb1d1885ea47dfe2c6f684ca",
    "metadata": {
      "block_hash": "9bd1d1e029b32ff597a5fdcd6cf19ab46e23adcfbb1a5ec531787a8a7136bd0b",
      "height": 104,
      "request_sequence": 1,
      "serialized_sha256": "440462894933a096cb461dd2cf651977fffa082985a82a602be9b1305ed4a643",
      "transaction_ids": []
    },
    "method": "GetBlockRange",
    "mode": "upstream",
    "phase": "response",
    "previous_hash": "dc93de968746b1626fd0cb1e01da341d62ab61e57cd8dbcda16b4f823554a20f",
    "schema_version": 1,
    "sequence": 6,
    "session": "e4ad8a93e89e6230e05a434961cd3fd5a695f65efdbf6d020e9694f030a1568f",
    "timestamp_ns": 1792833858247631901
  },
  {
    "elapsed_ns": 7524639,
    "event_hash": "b35b3cff1e474893f6ff9ecd2406f2373720df80574d5968e233b5b563417bba",
    "metadata": {
      "block_hash": "f1d476273a0bf74a1c073dbe098e94a66a760dd14412629890feaef39b26140b",
      "height": 105,
      "request_sequence": 1,
      "serialized_sha256": "0f591157cf09e74ce9132b11eb1c762c2f28b8314a9ef6f94f698f13413908e3",
      "transaction_ids": []
    },
    "method": "GetBlockRange",
    "mode": "upstream",
    "phase": "response",
    "previous_hash": "e2bef3be550d686da820b65b364e1c928240e237bb1d1885ea47dfe2c6f684ca",
    "schema_version": 1,
    "sequence": 7,
    "session": "e4ad8a93e89e6230e05a434961cd3fd5a695f65efdbf6d020e9694f030a1568f",
    "timestamp_ns": 1792833858247950005
  },
  {
    "elapsed_ns": 7840037,
    "event_hash": "3509aed257541bb43ecb78cd8616cd444cf508a5d49c273df52b23cb702a38eb",
    "metadata": {
      "block_hash": "58dbb3169028cbb4726dcef18103bf73a87abf502a360923a3e2196701165a09",
      "height": 106,
      "request_sequence": 1,
      "serialized_sha256": "494f9ac12f5846fe6fbaea3bfe457a7af3b7b53dd7fbf3aec45fa38be55e331f",
      "transaction_ids": []
    },
    "method": "GetBlockRange",
    "mode": "upstream",
    "phase": "response",
    "previous_hash": "b35b3cff1e474893f6ff9ecd2406f2373720df80574d5968e233b5b563417bba",
    "schema_version": 1,
    "sequence": 8,
    "session": "e4ad8a93e89e6230e05a434961cd3fd5a695f65efdbf6d020e9694f030a1568f",
    "timestamp_ns": 1792833858248265404
  }
]

Baseline comparison

PASS · 0 regressions

{ "baseline_evidence_root": "3509aed257541bb43ecb78cd8616cd444cf508a5d49c273df52b23cb702a38eb", "baseline_hash": "a6bd509ae342b9364f9168f6b709fddb5d921b67d2942c533ee7356cb986d460", "changes": [], "regressions": 0, "resolved_behaviors": [], "status": "PASS", "unchanged_behaviors": 1 }

Limitations

Defined tests cover SC-001 through SC-004; SC-005 requires a compatible saved baseline.

A transport peer identifies a connection, not a person or wallet.

Local fixture replay is not consensus validation or network acceptance.

Transaction SHA-256 fingerprints are not Zcash transaction IDs.

No violation observed does not establish anonymity.

SC-005 compares rule/component/behavior categories, not changing transaction IDs, sessions, timestamps, or finding counts.

Baselines include inspectable evidence; hashes detect editing but do not authenticate an author.

Compatible policy and complete coverage are required; a baseline is not a privacy exemption.

Complete JSON result

{
  "baseline_comparison": {
    "baseline_evidence_root": "3509aed257541bb43ecb78cd8616cd444cf508a5d49c273df52b23cb702a38eb",
    "baseline_hash": "a6bd509ae342b9364f9168f6b709fddb5d921b67d2942c533ee7356cb986d460",
    "changes": [],
    "regressions": 0,
    "resolved_behaviors": [],
    "status": "PASS",
    "unchanged_behaviors": 1
  },
  "correlation_window_seconds": 30,
  "evidence_modes": [
    "upstream"
  ],
  "evidence_root": "3509aed257541bb43ecb78cd8616cd444cf508a5d49c273df52b23cb702a38eb",
  "findings": [
    {
      "affected_component": "lightwalletd block-range synchronization",
      "complete_range_delivered": true,
      "evidence": [
        {
          "elapsed_ns": 4155339,
          "event_hash": "9bc47b85d6968d1c27f18b4db5c10cfd604d3652c84b57e2769c06c4673755dd",
          "metadata": {
            "end_height": 106,
            "start_height": 100
          },
          "method": "GetBlockRange",
          "mode": "upstream",
          "phase": "request",
          "previous_hash": "0000000000000000000000000000000000000000000000000000000000000000",
          "schema_version": 1,
          "sequence": 1,
          "session": "e4ad8a93e89e6230e05a434961cd3fd5a695f65efdbf6d020e9694f030a1568f",
          "timestamp_ns": 1792833858244580535
        },
        {
          "elapsed_ns": 5791252,
          "event_hash": "c51a4899876063a7f595d5a3cd7f7059cb63a49c07725d203883a6ec2e9a6888",
          "metadata": {
            "block_hash": "a8e074974f6bb064524ccd34a8dab5b81f6097f273bc0c65209a34f28d489802",
            "height": 100,
            "request_sequence": 1,
            "serialized_sha256": "de61628338e5fde38daa54059c64d6ff4c37e604d284ae712b5d1462ed75b9c3",
            "transaction_ids": []
          },
          "method": "GetBlockRange",
          "mode": "upstream",
          "phase": "response",
          "previous_hash": "9bc47b85d6968d1c27f18b4db5c10cfd604d3652c84b57e2769c06c4673755dd",
          "schema_version": 1,
          "sequence": 2,
          "session": "e4ad8a93e89e6230e05a434961cd3fd5a695f65efdbf6d020e9694f030a1568f",
          "timestamp_ns": 1792833858246216428
        },
        {
          "elapsed_ns": 6233758,
          "event_hash": "5107c4517a818386745fcc60fcfd3d21b7c09126a077c7d06efe09f4c85de17c",
          "metadata": {
            "block_hash": "18844d130895ef0917b62421e03fcc585469392eb6bd0d8ca46d37ba9b630e03",
            "height": 101,
            "request_sequence": 1,
            "serialized_sha256": "11a078bb0b066c379eee0fdb1fd6a13f00784b515a651d3170d115cc2e96c28e",
            "transaction_ids": []
          },
          "method": "GetBlockRange",
          "mode": "upstream",
          "phase": "response",
          "previous_hash": "c51a4899876063a7f595d5a3cd7f7059cb63a49c07725d203883a6ec2e9a6888",
          "schema_version": 1,
          "sequence": 3,
          "session": "e4ad8a93e89e6230e05a434961cd3fd5a695f65efdbf6d020e9694f030a1568f",
          "timestamp_ns": 1792833858246659145
        },
        {
          "elapsed_ns": 6567802,
          "event_hash": "5119d3cadae68a10baf254f5b401904e9745fab4179b386d57320b41cb19c52b",
          "metadata": {
            "block_hash": "e694d37e5dfe6d82ba05c43969e639c15bbd234b1ce78d468019e7e144b68c07",
            "height": 102,
            "request_sequence": 1,
            "serialized_sha256": "ee9dff79eb1b47693ad29bf9dd73bcd7209942d81fd7137d5b66c876d2c8ebb5",
            "transaction_ids": []
          },
          "method": "GetBlockRange",
          "mode": "upstream",
          "phase": "response",
          "previous_hash": "5107c4517a818386745fcc60fcfd3d21b7c09126a077c7d06efe09f4c85de17c",
          "schema_version": 1,
          "sequence": 4,
          "session": "e4ad8a93e89e6230e05a434961cd3fd5a695f65efdbf6d020e9694f030a1568f",
          "timestamp_ns": 1792833858246993178
        },
        {
          "elapsed_ns": 6931142,
          "event_hash": "dc93de968746b1626fd0cb1e01da341d62ab61e57cd8dbcda16b4f823554a20f",
          "metadata": {
            "block_hash": "f24d6e7666100c5ddb3fe9a42e8dbe150eebdad9b89177cf341086eb26ed0d02",
            "height": 103,
            "request_sequence": 1,
            "serialized_sha256": "6e3f4e63f4bb6a678599c75cbd43e99c70e6d2d8305f782af495e0614af5f948",
            "transaction_ids": []
          },
          "method": "GetBlockRange",
          "mode": "upstream",
          "phase": "response",
          "previous_hash": "5119d3cadae68a10baf254f5b401904e9745fab4179b386d57320b41cb19c52b",
          "schema_version": 1,
          "sequence": 5,
          "session": "e4ad8a93e89e6230e05a434961cd3fd5a695f65efdbf6d020e9694f030a1568f",
          "timestamp_ns": 1792833858247356488
        },
        {
          "elapsed_ns": 7206535,
          "event_hash": "e2bef3be550d686da820b65b364e1c928240e237bb1d1885ea47dfe2c6f684ca",
          "metadata": {
            "block_hash": "9bd1d1e029b32ff597a5fdcd6cf19ab46e23adcfbb1a5ec531787a8a7136bd0b",
            "height": 104,
            "request_sequence": 1,
            "serialized_sha256": "440462894933a096cb461dd2cf651977fffa082985a82a602be9b1305ed4a643",
            "transaction_ids": []
          },
          "method": "GetBlockRange",
          "mode": "upstream",
          "phase": "response",
          "previous_hash": "dc93de968746b1626fd0cb1e01da341d62ab61e57cd8dbcda16b4f823554a20f",
          "schema_version": 1,
          "sequence": 6,
          "session": "e4ad8a93e89e6230e05a434961cd3fd5a695f65efdbf6d020e9694f030a1568f",
          "timestamp_ns": 1792833858247631901
        },
        {
          "elapsed_ns": 7524639,
          "event_hash": "b35b3cff1e474893f6ff9ecd2406f2373720df80574d5968e233b5b563417bba",
          "metadata": {
            "block_hash": "f1d476273a0bf74a1c073dbe098e94a66a760dd14412629890feaef39b26140b",
            "height": 105,
            "request_sequence": 1,
            "serialized_sha256": "0f591157cf09e74ce9132b11eb1c762c2f28b8314a9ef6f94f698f13413908e3",
            "transaction_ids": []
          },
          "method": "GetBlockRange",
          "mode": "upstream",
          "phase": "response",
          "previous_hash": "e2bef3be550d686da820b65b364e1c928240e237bb1d1885ea47dfe2c6f684ca",
          "schema_version": 1,
          "sequence": 7,
          "session": "e4ad8a93e89e6230e05a434961cd3fd5a695f65efdbf6d020e9694f030a1568f",
          "timestamp_ns": 1792833858247950005
        },
        {
          "elapsed_ns": 7840037,
          "event_hash": "3509aed257541bb43ecb78cd8616cd444cf508a5d49c273df52b23cb702a38eb",
          "metadata": {
            "block_hash": "58dbb3169028cbb4726dcef18103bf73a87abf502a360923a3e2196701165a09",
            "height": 106,
            "request_sequence": 1,
            "serialized_sha256": "494f9ac12f5846fe6fbaea3bfe457a7af3b7b53dd7fbf3aec45fa38be55e331f",
            "transaction_ids": []
          },
          "method": "GetBlockRange",
          "mode": "upstream",
          "phase": "response",
          "previous_hash": "b35b3cff1e474893f6ff9ecd2406f2373720df80574d5968e233b5b563417bba",
          "schema_version": 1,
          "sequence": 8,
          "session": "e4ad8a93e89e6230e05a434961cd3fd5a695f65efdbf6d020e9694f030a1568f",
          "timestamp_ns": 1792833858248265404
        }
      ],
      "observed_behavior": "Requested heights 100 through 106 (7 blocks): inclusive request size differs from the configured chunk size.",
      "possible_privacy_consequence": "The service observes the connection's exact scan boundary and request size. These can depend on local sync state, but wallet history or identity is not proven.",
      "request_size": 7,
      "rule_id": "SC-001",
      "severity": "MEDIUM",
      "suggested_investigation": "Review fixed-size aligned retrieval, local filtering, and chain-tip handling against the declared policy; evaluate extra bandwidth and other privacy tradeoffs.",
      "sync_policy": {
        "alignment_height": 0,
        "chunk_size": 20
      },
      "title": "Block range violates configured sync disclosure policy",
      "violations": [
        "inclusive request size differs from the configured chunk size"
      ]
    }
  ],
  "limitations": [
    "Defined tests cover SC-001 through SC-004; SC-005 requires a compatible saved baseline.",
    "A transport peer identifies a connection, not a person or wallet.",
    "Local fixture replay is not consensus validation or network acceptance.",
    "Transaction SHA-256 fingerprints are not Zcash transaction IDs.",
    "No violation observed does not establish anonymity.",
    "SC-005 compares rule/component/behavior categories, not changing transaction IDs, sessions, timestamps, or finding counts.",
    "Baselines include inspectable evidence; hashes detect editing but do not authenticate an author.",
    "Compatible policy and complete coverage are required; a baseline is not a privacy exemption."
  ],
  "payment_policy": null,
  "policy": "strict",
  "rules": [
    {
      "coverage": "complete-range-delivery",
      "covered": true,
      "executed": true,
      "rule_id": "SC-001"
    },
    {
      "coverage": "compatible-baseline-comparison",
      "covered": true,
      "executed": true,
      "rule_id": "SC-005"
    }
  ],
  "schema_version": 1,
  "status": "FAIL",
  "sync_policy": {
    "alignment_height": 0,
    "chunk_size": 20
  }
}

ShadeCheck: FAIL

Tested rules

Findings

SC-001 · MEDIUM · Block range violates configured sync disclosure policy

Baseline comparison

Limitations