ShadeCheck: FAIL

Defined observable behavior tests; passing does not establish anonymity.

Policy: strict · 1 findings

Evidence root: c9cd3fc432909f6f62d6a9faef141b6498eb73c07316033bd608ffa25bc02e9c

Tested rules

RuleCoverageCovered
SC-004verified-payment-outcomesTrue

Findings

SC-004 · HIGH · Transparent payment path under a shielded requirement

Observed behavior: The wallet created a transaction with transparent components and the verification backend accepted its exact payload.

Possible consequence: Transparent transaction components can publicly expose addresses and amounts despite the tested flow's shielded requirement.

Affected component: instrumented local zcashd wallet payment adapter

Investigation: Reject transparent recipient selection when shielding is required and enforce an appropriate wallet privacy policy; inspect the actual transaction before submission.

Inspect current evidence (5 events)
[
  {
    "elapsed_ns": 107466053,
    "event_hash": "64a17fd742067dc12a7ef8ccab2ff0a7782b86f9bdd1764f1c883ece7dcd77bb",
    "metadata": {
      "amount": "0.1",
      "fee": "0.0002",
      "flow_id": "32b915fd7edf46418a8efa43fe1d7379",
      "privacy_policy": "AllowRevealedRecipients",
      "receiver": "tmHEg8kURVWERz7DaCmxRwpxwwe1y72fTKZ",
      "receiver_type": "transparent",
      "receiver_validation": {
        "address": "tmHEg8kURVWERz7DaCmxRwpxwwe1y72fTKZ",
        "ismine": false,
        "isscript": false,
        "isvalid": true,
        "iswatchonly": false,
        "scriptPubKey": "76a91452850e2c394144c824644988011757b951cdacc088ac"
      },
      "require_shielded": true,
      "source_rpc": "z_sendmany"
    },
    "method": "WalletPayment",
    "mode": "wallet-adapter",
    "phase": "request",
    "previous_hash": "0000000000000000000000000000000000000000000000000000000000000000",
    "schema_version": 1,
    "sequence": 1,
    "session": "b2966fe57482c7cf664a555cb96ee23df730655def5112e118dc91405f44cb60",
    "timestamp_ns": 1792833826508322984
  },
  {
    "elapsed_ns": 5088295172,
    "event_hash": "12a1ffd3307dd7d3fc91be05408f80d95c583b2852f563954a8ace7d94c4abda",
    "metadata": {
      "flow_id": "32b915fd7edf46418a8efa43fe1d7379",
      "operation_result": {
        "creation_time": 1792833826,
        "execution_secs": "4.266667",
        "id": "opid-2a40ff15-d68f-48db-b2ac-9ed2854c9eee",
        "method": "z_sendmany",
        "params": {
          "amounts": [
            {
              "address": "tmHEg8kURVWERz7DaCmxRwpxwwe1y72fTKZ",
              "amount": "0.1"
            }
          ],
          "fee": "0.00020000",
          "fromaddress": "zregtestsapling1w470defy6ya5uwwtlrv6jlpznltyw7zdahqrqthgks9zqnz6uehvqn7f2jk2y4t9h98uwj2nd54",
          "minconf": 1
        },
        "result": {
          "txid": "2431d7ed7afdcdf2a93ffc95577a7b0f8f7802b2b4fb3c91d4e6b6d6da35dd9a"
        },
        "status": "success"
      },
      "request_sequence": 1,
      "source_rpc": "z_getoperationstatus",
      "txid": "2431d7ed7afdcdf2a93ffc95577a7b0f8f7802b2b4fb3c91d4e6b6d6da35dd9a"
    },
    "method": "WalletPayment",
    "mode": "wallet-adapter",
    "phase": "response",
    "previous_hash": "64a17fd742067dc12a7ef8ccab2ff0a7782b86f9bdd1764f1c883ece7dcd77bb",
    "schema_version": 1,
    "sequence": 2,
    "session": "b2966fe57482c7cf664a555cb96ee23df730655def5112e118dc91405f44cb60",
    "timestamp_ns": 1792833831489152454
  },
  {
    "elapsed_ns": 5405405443,
    "event_hash": "9f3edb0f14481b7d69e89bb74dd4d8b03aa520d08082bcad92ed64346114577d",
    "metadata": {
      "flow_id": "32b915fd7edf46418a8efa43fe1d7379",
      "payload_sha256": "330514c526d65a1075a9f3cd22a42b1a1c2072ca18f26fed006a27a42d03a0f1",
      "request_sequence": 1,
      "sapling_outputs": 2,
      "sapling_spends": 1,
      "source_rpc": "decoderawtransaction",
      "transparent_inputs": 0,
      "transparent_outputs": 1,
      "txid": "2431d7ed7afdcdf2a93ffc95577a7b0f8f7802b2b4fb3c91d4e6b6d6da35dd9a"
    },
    "method": "WalletTransaction",
    "mode": "wallet-adapter",
    "phase": "response",
    "previous_hash": "12a1ffd3307dd7d3fc91be05408f80d95c583b2852f563954a8ace7d94c4abda",
    "schema_version": 1,
    "sequence": 3,
    "session": "b2966fe57482c7cf664a555cb96ee23df730655def5112e118dc91405f44cb60",
    "timestamp_ns": 1792833831806262664
  },
  {
    "elapsed_ns": 5411896053,
    "event_hash": "3d4734e0b7a479405cabff028fb4039fa21687a363c20a128c3e04edb4e4b476",
    "metadata": {
      "payload_sha256": "330514c526d65a1075a9f3cd22a42b1a1c2072ca18f26fed006a27a42d03a0f1",
      "payload_size": 2407
    },
    "method": "SendTransaction",
    "mode": "upstream",
    "phase": "request",
    "previous_hash": "9f3edb0f14481b7d69e89bb74dd4d8b03aa520d08082bcad92ed64346114577d",
    "schema_version": 1,
    "sequence": 4,
    "session": "51e39d925518affbba08fbd8309ad9f9b2cf9419d0fed21953380c1bae530264",
    "timestamp_ns": 1792833831812753596
  },
  {
    "elapsed_ns": 5434552287,
    "event_hash": "423b77b9363fbf4d167c7fe750769e57c6a2db03e81450b6cc7b758fa4ff0967",
    "metadata": {
      "error_code": 0,
      "request_sequence": 4
    },
    "method": "SendTransaction",
    "mode": "upstream",
    "phase": "response",
    "previous_hash": "3d4734e0b7a479405cabff028fb4039fa21687a363c20a128c3e04edb4e4b476",
    "schema_version": 1,
    "sequence": 5,
    "session": "51e39d925518affbba08fbd8309ad9f9b2cf9419d0fed21953380c1bae530264",
    "timestamp_ns": 1792833831835409739
  }
]

Limitations

Complete JSON result
{
  "correlation_window_seconds": 30,
  "evidence_modes": [
    "upstream",
    "wallet-adapter"
  ],
  "evidence_root": "c9cd3fc432909f6f62d6a9faef141b6498eb73c07316033bd608ffa25bc02e9c",
  "findings": [
    {
      "affected_component": "instrumented local zcashd wallet payment adapter",
      "evidence": [
        {
          "elapsed_ns": 107466053,
          "event_hash": "64a17fd742067dc12a7ef8ccab2ff0a7782b86f9bdd1764f1c883ece7dcd77bb",
          "metadata": {
            "amount": "0.1",
            "fee": "0.0002",
            "flow_id": "32b915fd7edf46418a8efa43fe1d7379",
            "privacy_policy": "AllowRevealedRecipients",
            "receiver": "tmHEg8kURVWERz7DaCmxRwpxwwe1y72fTKZ",
            "receiver_type": "transparent",
            "receiver_validation": {
              "address": "tmHEg8kURVWERz7DaCmxRwpxwwe1y72fTKZ",
              "ismine": false,
              "isscript": false,
              "isvalid": true,
              "iswatchonly": false,
              "scriptPubKey": "76a91452850e2c394144c824644988011757b951cdacc088ac"
            },
            "require_shielded": true,
            "source_rpc": "z_sendmany"
          },
          "method": "WalletPayment",
          "mode": "wallet-adapter",
          "phase": "request",
          "previous_hash": "0000000000000000000000000000000000000000000000000000000000000000",
          "schema_version": 1,
          "sequence": 1,
          "session": "b2966fe57482c7cf664a555cb96ee23df730655def5112e118dc91405f44cb60",
          "timestamp_ns": 1792833826508322984
        },
        {
          "elapsed_ns": 5088295172,
          "event_hash": "12a1ffd3307dd7d3fc91be05408f80d95c583b2852f563954a8ace7d94c4abda",
          "metadata": {
            "flow_id": "32b915fd7edf46418a8efa43fe1d7379",
            "operation_result": {
              "creation_time": 1792833826,
              "execution_secs": "4.266667",
              "id": "opid-2a40ff15-d68f-48db-b2ac-9ed2854c9eee",
              "method": "z_sendmany",
              "params": {
                "amounts": [
                  {
                    "address": "tmHEg8kURVWERz7DaCmxRwpxwwe1y72fTKZ",
                    "amount": "0.1"
                  }
                ],
                "fee": "0.00020000",
                "fromaddress": "zregtestsapling1w470defy6ya5uwwtlrv6jlpznltyw7zdahqrqthgks9zqnz6uehvqn7f2jk2y4t9h98uwj2nd54",
                "minconf": 1
              },
              "result": {
                "txid": "2431d7ed7afdcdf2a93ffc95577a7b0f8f7802b2b4fb3c91d4e6b6d6da35dd9a"
              },
              "status": "success"
            },
            "request_sequence": 1,
            "source_rpc": "z_getoperationstatus",
            "txid": "2431d7ed7afdcdf2a93ffc95577a7b0f8f7802b2b4fb3c91d4e6b6d6da35dd9a"
          },
          "method": "WalletPayment",
          "mode": "wallet-adapter",
          "phase": "response",
          "previous_hash": "64a17fd742067dc12a7ef8ccab2ff0a7782b86f9bdd1764f1c883ece7dcd77bb",
          "schema_version": 1,
          "sequence": 2,
          "session": "b2966fe57482c7cf664a555cb96ee23df730655def5112e118dc91405f44cb60",
          "timestamp_ns": 1792833831489152454
        },
        {
          "elapsed_ns": 5405405443,
          "event_hash": "9f3edb0f14481b7d69e89bb74dd4d8b03aa520d08082bcad92ed64346114577d",
          "metadata": {
            "flow_id": "32b915fd7edf46418a8efa43fe1d7379",
            "payload_sha256": "330514c526d65a1075a9f3cd22a42b1a1c2072ca18f26fed006a27a42d03a0f1",
            "request_sequence": 1,
            "sapling_outputs": 2,
            "sapling_spends": 1,
            "source_rpc": "decoderawtransaction",
            "transparent_inputs": 0,
            "transparent_outputs": 1,
            "txid": "2431d7ed7afdcdf2a93ffc95577a7b0f8f7802b2b4fb3c91d4e6b6d6da35dd9a"
          },
          "method": "WalletTransaction",
          "mode": "wallet-adapter",
          "phase": "response",
          "previous_hash": "12a1ffd3307dd7d3fc91be05408f80d95c583b2852f563954a8ace7d94c4abda",
          "schema_version": 1,
          "sequence": 3,
          "session": "b2966fe57482c7cf664a555cb96ee23df730655def5112e118dc91405f44cb60",
          "timestamp_ns": 1792833831806262664
        },
        {
          "elapsed_ns": 5411896053,
          "event_hash": "3d4734e0b7a479405cabff028fb4039fa21687a363c20a128c3e04edb4e4b476",
          "metadata": {
            "payload_sha256": "330514c526d65a1075a9f3cd22a42b1a1c2072ca18f26fed006a27a42d03a0f1",
            "payload_size": 2407
          },
          "method": "SendTransaction",
          "mode": "upstream",
          "phase": "request",
          "previous_hash": "9f3edb0f14481b7d69e89bb74dd4d8b03aa520d08082bcad92ed64346114577d",
          "schema_version": 1,
          "sequence": 4,
          "session": "51e39d925518affbba08fbd8309ad9f9b2cf9419d0fed21953380c1bae530264",
          "timestamp_ns": 1792833831812753596
        },
        {
          "elapsed_ns": 5434552287,
          "event_hash": "423b77b9363fbf4d167c7fe750769e57c6a2db03e81450b6cc7b758fa4ff0967",
          "metadata": {
            "error_code": 0,
            "request_sequence": 4
          },
          "method": "SendTransaction",
          "mode": "upstream",
          "phase": "response",
          "previous_hash": "3d4734e0b7a479405cabff028fb4039fa21687a363c20a128c3e04edb4e4b476",
          "schema_version": 1,
          "sequence": 5,
          "session": "51e39d925518affbba08fbd8309ad9f9b2cf9419d0fed21953380c1bae530264",
          "timestamp_ns": 1792833831835409739
        }
      ],
      "flow_id": "32b915fd7edf46418a8efa43fe1d7379",
      "observed_behavior": "The wallet created a transaction with transparent components and the verification backend accepted its exact payload.",
      "payment_policy": {
        "require_shielded": true
      },
      "possible_privacy_consequence": "Transparent transaction components can publicly expose addresses and amounts despite the tested flow's shielded requirement.",
      "rule_id": "SC-004",
      "severity": "HIGH",
      "suggested_investigation": "Reject transparent recipient selection when shielding is required and enforce an appropriate wallet privacy policy; inspect the actual transaction before submission.",
      "title": "Transparent payment path under a shielded requirement"
    }
  ],
  "limitations": [
    "Defined tests cover SC-001 through SC-004; SC-005 requires a compatible saved baseline.",
    "A transport peer identifies a connection, not a person or wallet.",
    "Local fixture replay is not consensus validation or network acceptance.",
    "Transaction SHA-256 fingerprints are not Zcash transaction IDs.",
    "No violation observed does not establish anonymity."
  ],
  "payment_policy": {
    "require_shielded": true
  },
  "policy": "strict",
  "rules": [
    {
      "coverage": "verified-payment-outcomes",
      "covered": true,
      "executed": true,
      "rule_id": "SC-004"
    }
  ],
  "schema_version": 1,
  "status": "FAIL",
  "sync_policy": null
}