@openzeppelin/miden-multisig-client 0.16.2 → 0.17.0-rc.2

package/src/account/builder.test.ts

@@ -1,15 +1,6 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { createMultisigAccount } from './builder.js';
-import {
-  MULTISIG_ECDSA_MASM,
-  MULTISIG_MASM,
-  GUARDIAN_ECDSA_MASM,
-  GUARDIAN_MASM,
-} from './masm/auth.js';
-import {
-  MULTISIG_GUARDIAN_ACCOUNT_COMPONENT_MASM,
-  MULTISIG_GUARDIAN_ECDSA_ACCOUNT_COMPONENT_MASM,
-} from './masm/account-components/auth.js';
+import { createMultisigAccount, validateMultisigConfig } from './builder.js';
+import { GUARDED_MULTISIG_ACCOUNT_COMPONENT_MASM } from './masm/account-components/auth.js';
 
 const {
   buildMultisigStorageSlots,
@@ -53,6 +44,12 @@ const {
         account: { id: () => ({ toString: () => '0x' + 'a'.repeat(30) }) },
       };
     }
+
+    buildWithoutSchemaCommitment() {
+      return {
+        account: { id: () => ({ toString: () => '0x' + 'a'.repeat(30) }) },
+      };
+    }
   }
 
   return {
@@ -93,7 +90,7 @@ describe('createMultisigAccount', () => {
     compileComponent.mockClear();
   });
 
-  it('uses Falcon MASM by default', async () => {
+  function makeClient() {
     const authBuilder = {
       linkModule: vi.fn(),
       compileAccountComponentCode: vi.fn((source) => ({ source })),
@@ -104,6 +101,11 @@ describe('createMultisigAccount', () => {
         insert: vi.fn().mockResolvedValue(undefined),
       },
     };
+    return { authBuilder, webClient };
+  }
+
+  it('compiles the guarded component without re-linking SDK-provided modules (Falcon)', async () => {
+    const { authBuilder, webClient } = makeClient();
 
     await createMultisigAccount(
       webClient as never,
@@ -115,33 +117,17 @@ describe('createMultisigAccount', () => {
       'http://localhost:57291',
     );
 
-    expect(authBuilder.linkModule).toHaveBeenNthCalledWith(
-      1,
-      'openzeppelin::auth::guardian',
-      GUARDIAN_MASM,
-    );
-    expect(authBuilder.linkModule).toHaveBeenNthCalledWith(
-      2,
-      'openzeppelin::auth::multisig',
-      MULTISIG_MASM,
-    );
+    // The web SDK assembler already provides `miden::standards::auth::*`; re-linking would
+    // raise a duplicate-definition error, so the builder must NOT call linkModule.
+    expect(authBuilder.linkModule).not.toHaveBeenCalled();
     expect(authBuilder.compileAccountComponentCode).toHaveBeenCalledWith(
-      MULTISIG_GUARDIAN_ACCOUNT_COMPONENT_MASM,
+      GUARDED_MULTISIG_ACCOUNT_COMPONENT_MASM,
     );
     expect(webClient.accounts.insert).toHaveBeenCalledTimes(1);
   });
 
-  it('uses ECDSA MASM when requested', async () => {
-    const authBuilder = {
-      linkModule: vi.fn(),
-      compileAccountComponentCode: vi.fn((source) => ({ source })),
-    };
-    const webClient = {
-      createCodeBuilder: vi.fn().mockReturnValue(authBuilder),
-      accounts: {
-        insert: vi.fn().mockResolvedValue(undefined),
-      },
-    };
+  it('uses the same scheme-agnostic component for ECDSA', async () => {
+    const { authBuilder, webClient } = makeClient();
 
     await createMultisigAccount(
       webClient as never,
@@ -154,19 +140,99 @@ describe('createMultisigAccount', () => {
       'http://localhost:57291',
     );
 
-    expect(authBuilder.linkModule).toHaveBeenNthCalledWith(
-      1,
-      'openzeppelin::auth::guardian_ecdsa',
-      GUARDIAN_ECDSA_MASM,
-    );
-    expect(authBuilder.linkModule).toHaveBeenNthCalledWith(
-      2,
-      'openzeppelin::auth::multisig_ecdsa',
-      MULTISIG_ECDSA_MASM,
-    );
+    expect(authBuilder.linkModule).not.toHaveBeenCalled();
     expect(authBuilder.compileAccountComponentCode).toHaveBeenCalledWith(
-      MULTISIG_GUARDIAN_ECDSA_ACCOUNT_COMPONENT_MASM,
+      GUARDED_MULTISIG_ACCOUNT_COMPONENT_MASM,
     );
     expect(webClient.accounts.insert).toHaveBeenCalledTimes(1);
   });
 });
+
+describe('validateMultisigConfig', () => {
+  const signer = '0x' + '1'.repeat(64);
+
+  it('rejects a guardian commitment equal to a signer (matches upstream Rust invariant)', () => {
+    expect(() =>
+      validateMultisigConfig({
+        threshold: 1,
+        signerCommitments: [signer],
+        guardianCommitment: signer,
+      }),
+    ).toThrow(/different from all signer commitments/);
+  });
+
+  it('accepts a distinct guardian commitment', () => {
+    expect(() =>
+      validateMultisigConfig({
+        threshold: 1,
+        signerCommitments: [signer],
+        guardianCommitment: '0x' + '2'.repeat(64),
+      }),
+    ).not.toThrow();
+  });
+
+  describe('procedure threshold overrides vs update_procedure_threshold', () => {
+    const signers = Array.from({ length: 5 }, (_, i) => '0x' + String(i + 1).repeat(64));
+    const guardian = '0x' + '9'.repeat(64);
+
+    const config = (
+      threshold: number,
+      procedureThresholds: Array<{ procedure: string; threshold: number }>,
+    ) =>
+      ({
+        threshold,
+        signerCommitments: signers,
+        guardianCommitment: guardian,
+        procedureThresholds,
+      }) as Parameters<typeof validateMultisigConfig>[0];
+
+    it('rejects an override above the default threshold that guards the setter', () => {
+      expect(() =>
+        validateMultisigConfig(config(2, [{ procedure: 'send_asset', threshold: 4 }])),
+      ).toThrow(/exceeds the threshold of 2 that guards update_procedure_threshold/);
+    });
+
+    it('accepts the same override once the setter is raised to match', () => {
+      expect(() =>
+        validateMultisigConfig(
+          config(2, [
+            { procedure: 'send_asset', threshold: 4 },
+            { procedure: 'update_procedure_threshold', threshold: 4 },
+          ]),
+        ),
+      ).not.toThrow();
+    });
+
+    it('rejects an override above an explicitly raised setter', () => {
+      expect(() =>
+        validateMultisigConfig(
+          config(2, [
+            { procedure: 'send_asset', threshold: 4 },
+            { procedure: 'update_procedure_threshold', threshold: 3 },
+          ]),
+        ),
+      ).toThrow(/exceeds the threshold of 3 that guards update_procedure_threshold/);
+    });
+
+    it('accepts overrides at or below the default threshold', () => {
+      expect(() =>
+        validateMultisigConfig(
+          config(3, [
+            { procedure: 'send_asset', threshold: 3 },
+            { procedure: 'receive_asset', threshold: 1 },
+          ]),
+        ),
+      ).not.toThrow();
+    });
+
+    it('allows the setter override to exceed the default threshold', () => {
+      // Raising only the setter is always safe: it makes overrides harder to
+      // edit, never easier.
+      expect(() =>
+        validateMultisigConfig(
+          config(2, [{ procedure: 'update_procedure_threshold', threshold: 5 }]),
+        ),
+      ).not.toThrow();
+    });
+  });
+});

package/src/account/builder.ts

@@ -9,22 +9,29 @@ import {
   AccountComponent,
   AccountStorageMode,
   type MidenClient,
+  type WasmWebClient,
 } from '@miden-sdk/miden-sdk';
 import type { MultisigConfig, CreateAccountResult } from '../types.js';
 import { getRawMidenClient } from '../raw-client.js';
 import { buildMultisigStorageSlots, buildGuardianStorageSlots } from './storage.js';
-import {
-  MULTISIG_ECDSA_MASM,
-  MULTISIG_MASM,
-  GUARDIAN_ECDSA_MASM,
-  GUARDIAN_MASM,
-} from './masm/auth.js';
-import {
-  MULTISIG_GUARDIAN_ACCOUNT_COMPONENT_MASM,
-  MULTISIG_GUARDIAN_ECDSA_ACCOUNT_COMPONENT_MASM,
-} from './masm/account-components/auth.js';
+import { GUARDED_MULTISIG_ACCOUNT_COMPONENT_MASM } from './masm/account-components/auth.js';
 import { normalizeSignerCommitment } from '../utils/signature.js';
 
+/** Builds the guarded-multisig component without relinking assembler-provided libraries. */
+function buildGuardedMultisigComponent(
+  authBuilder: Awaited<ReturnType<WasmWebClient['createCodeBuilder']>>,
+  config: MultisigConfig,
+): AccountComponent {
+  const authSlots = [
+    ...buildMultisigStorageSlots(config),
+    ...buildGuardianStorageSlots(config),
+  ];
+  const authComponentCode = authBuilder.compileAccountComponentCode(
+    GUARDED_MULTISIG_ACCOUNT_COMPONENT_MASM,
+  );
+  return AccountComponent.compile(authComponentCode, authSlots).withSupportsAllTypes();
+}
+
 /**
  * Creates a multisig account with GUARDIAN authentication.
  *
@@ -39,31 +46,10 @@ export async function createMultisigAccount(
   midenRpcEndpoint: string,
 ): Promise<CreateAccountResult> {
   validateMultisigConfig(config);
-  const signatureScheme = config.signatureScheme ?? 'falcon';
   const rawClient = await getRawMidenClient(midenClient, midenRpcEndpoint);
-  const authSlots = [
-    ...buildMultisigStorageSlots(config),
-    ...buildGuardianStorageSlots(config),
-  ];
-  const guardianMasm = signatureScheme === 'ecdsa' ? GUARDIAN_ECDSA_MASM : GUARDIAN_MASM;
-  const multisigMasm = signatureScheme === 'ecdsa' ? MULTISIG_ECDSA_MASM : MULTISIG_MASM;
-  const authComponentMasm = signatureScheme === 'ecdsa'
-    ? MULTISIG_GUARDIAN_ECDSA_ACCOUNT_COMPONENT_MASM
-    : MULTISIG_GUARDIAN_ACCOUNT_COMPONENT_MASM;
-  const guardianLibraryPath = signatureScheme === 'ecdsa'
-    ? 'openzeppelin::auth::guardian_ecdsa'
-    : 'openzeppelin::auth::guardian';
-  const multisigLibraryPath = signatureScheme === 'ecdsa'
-    ? 'openzeppelin::auth::multisig_ecdsa'
-    : 'openzeppelin::auth::multisig';
 
   const authBuilder = await rawClient.createCodeBuilder();
-  authBuilder.linkModule(guardianLibraryPath, guardianMasm);
-  authBuilder.linkModule(multisigLibraryPath, multisigMasm);
-  const authComponentCode = authBuilder.compileAccountComponentCode(authComponentMasm);
-  const authComponent = AccountComponent
-    .compile(authComponentCode, authSlots)
-    .withSupportsAllTypes();
+  const authComponent = buildGuardedMultisigComponent(authBuilder, config);
 
   let seed = config.seed;
   // Generate random seed if not provided
@@ -82,7 +68,7 @@ export async function createMultisigAccount(
     .withAuthComponent(authComponent)
     .withBasicWalletComponent();
 
-  const result = accountBuilder.build();
+  const result = accountBuilder.buildWithoutSchemaCommitment();
 
   await midenClient.accounts.insert({ account: result.account, overwrite: false });
 
@@ -123,6 +109,9 @@ export function validateMultisigConfig(config: MultisigConfig): void {
   if (!config.guardianCommitment) {
     throw new Error('GUARDIAN commitment is required');
   }
+  if (signerCommitments.has(normalizeSignerCommitment(config.guardianCommitment))) {
+    throw new Error('GUARDIAN commitment must be different from all signer commitments');
+  }
 
   // Validate procedure thresholds if provided
   if (config.procedureThresholds) {
@@ -142,5 +131,28 @@ export function validateMultisigConfig(config: MultisigConfig): void {
       }
       seen.add(pt.procedure);
     }
+
+    // An override is only enforceable if lowering it costs at least as many
+    // signatures as the override itself demands. `update_procedure_threshold`
+    // is the procedure that edits overrides, so anything above its own
+    // effective threshold can be lowered by a smaller quorum and then used:
+    // a 2-of-5 with `send_asset: 4` is a 2-of-5 spend lock, not a 4-of-5 one.
+    // Mirrors `AuthMultisig::new` in miden-standards, which rejects the same
+    // shape, so Rust cannot build an account TypeScript would otherwise allow.
+    const setterOverride = config.procedureThresholds.find(
+      (pt) => pt.procedure === 'update_procedure_threshold'
+    )?.threshold;
+    const setterThreshold = setterOverride ?? config.threshold;
+
+    for (const pt of config.procedureThresholds) {
+      if (pt.threshold > setterThreshold) {
+        throw new Error(
+          `procedure threshold override for ${pt.procedure} (${pt.threshold}) exceeds the ` +
+            `threshold of ${setterThreshold} that guards update_procedure_threshold; such an ` +
+            `override can be removed by a smaller quorum. Raise the update_procedure_threshold ` +
+            `override to at least ${pt.threshold} to make it enforceable`
+        );
+      }
+    }
   }
 }

package/src/account/layout.ts

@@ -0,0 +1,33 @@
+/**
+ * `AuthGuardedMultisig` storage slot names (`miden::standards::auth::*`),
+ * shared by the writer (`account/storage.ts`) and the readers
+ * (`inspector.ts`). Single source of truth so the two cannot drift. These
+ * must match the Rust `miden-standards` component exactly: account ID and
+ * commitment derive from the storage layout, so any divergence breaks
+ * cross-SDK determinism (guarded by the parity test).
+ *
+ * Deliberately not re-exported from the package index: consumers should use
+ * the `AccountInspector` accessors rather than reading storage directly
+ * (issue #306).
+ */
+
+export const MULTISIG_SLOT_NAMES = {
+  THRESHOLD_CONFIG: 'miden::standards::auth::multisig::threshold_config',
+  SIGNER_PUBLIC_KEYS: 'miden::standards::auth::multisig::approver_public_keys',
+  SIGNER_SCHEME_IDS: 'miden::standards::auth::multisig::approver_schemes',
+  EXECUTED_TRANSACTIONS: 'miden::standards::auth::multisig::executed_transactions',
+  PROCEDURE_THRESHOLDS: 'miden::standards::auth::multisig::procedure_thresholds',
+} as const;
+
+export const GUARDIAN_SLOT_NAMES = {
+  PUBLIC_KEY: 'miden::standards::auth::guardian::pub_key',
+  SCHEME_ID: 'miden::standards::auth::guardian::scheme',
+} as const;
+
+/**
+ * Sanity ceiling for the signer count read from `threshold_config`. The
+ * contract has no on-chain maximum (the felt is only asserted to be a u32),
+ * so a corrupt or adversarial account could report an arbitrarily large
+ * count; readers bound their loops with this instead of trusting it.
+ */
+export const MAX_SIGNERS = 1000;

package/src/account/masm/account-components/auth.ts

@@ -1,66 +1,46 @@
 // This file is generated by scripts/generate-masm.mjs from the MASM contract sources.
 // Do not edit it by hand.
 
-export const MULTISIG_ACCOUNT_COMPONENT_MASM = `# Multi-Signature RPO Falcon 512 Authentication Component
-
-use openzeppelin::auth::multisig
-
-pub use multisig::update_signers_and_threshold
-pub use multisig::update_procedure_threshold
-
+export const GUARDED_MULTISIG_ACCOUNT_COMPONENT_MASM = `# The MASM code of the Multi-Signature Authentication component integrated with a state guardian.
+#
+# See the \`AuthGuardedMultisig\` Rust type's documentation for more details.
+
+use miden::standards::auth::multisig
+use miden::standards::auth::guardian
+
+pub use {update_signers_and_threshold} from miden::standards::auth::multisig
+pub use {get_threshold_and_num_approvers} from miden::standards::auth::multisig
+pub use {set_procedure_threshold} from miden::standards::auth::multisig
+pub use {get_signer_at} from miden::standards::auth::multisig
+pub use {is_signer} from miden::standards::auth::multisig
+
+pub use {update_guardian_public_key} from miden::standards::auth::guardian
+
+#! Authenticate a transaction with multi-signature support and optional guardian verification.
+#!
+#! Inputs:
+#!   Operand stack: [SALT]
+#! Outputs:
+#!   Operand stack: []
+#!
+#! Invocation: call
 @auth_script
-pub proc auth_tx_multisig(salt: word)
-    exec.multisig::auth_tx
-    exec.multisig::assert_new_tx
-end
-`;
+pub proc auth_tx_guarded_multisig(salt: word)
+    # zero the leading user params (not exposed through this component's interface); the SALT
+    # occupies the trailing four
+    push.0.0.0
+    # => [0, 0, 0, SALT]
 
-export const MULTISIG_GUARDIAN_ACCOUNT_COMPONENT_MASM = `# Multi-Signature RPO Falcon 512 Authentication Component With GUARDIAN
-
-use openzeppelin::auth::multisig
-use openzeppelin::auth::guardian
-
-pub use multisig::update_signers_and_threshold
-pub use multisig::update_procedure_threshold
-pub use guardian::update_guardian_public_key
-pub use guardian::verify_guardian_signature
-
-@auth_script
-pub proc auth_tx_multisig_guardian(salt: word)
     exec.multisig::auth_tx
-    exec.guardian::verify_guardian_signature
-    exec.multisig::assert_new_tx
-end
-`;
-
-export const MULTISIG_ECDSA_ACCOUNT_COMPONENT_MASM = `# Multi-Signature ECDSA secp256k1 Authentication Component
-
-use openzeppelin::auth::multisig_ecdsa
+    # => [TX_SUMMARY_COMMITMENT]
 
-pub use multisig_ecdsa::update_signers_and_threshold
-pub use multisig_ecdsa::update_procedure_threshold
+    dupw
+    # => [TX_SUMMARY_COMMITMENT, TX_SUMMARY_COMMITMENT]
+    
+    exec.guardian::verify_signature
+    # => [TX_SUMMARY_COMMITMENT]
 
-@auth_script
-pub proc auth_tx_multisig_ecdsa(salt: word)
-    exec.multisig_ecdsa::auth_tx
-    exec.multisig_ecdsa::assert_new_tx
-end
-`;
-
-export const MULTISIG_GUARDIAN_ECDSA_ACCOUNT_COMPONENT_MASM = `# Multi-Signature ECDSA secp256k1 Authentication Component With GUARDIAN
-
-use openzeppelin::auth::multisig_ecdsa
-use openzeppelin::auth::guardian_ecdsa
-
-pub use multisig_ecdsa::update_signers_and_threshold
-pub use multisig_ecdsa::update_procedure_threshold
-pub use guardian_ecdsa::update_guardian_public_key
-pub use guardian_ecdsa::verify_guardian_signature
-
-@auth_script
-pub proc auth_tx_multisig_guardian_ecdsa(salt: word)
-    exec.multisig_ecdsa::auth_tx
-    exec.guardian_ecdsa::verify_guardian_signature
-    exec.multisig_ecdsa::assert_new_tx
+    exec.multisig::record_and_assert_new_tx
+    # => []
 end
 `;

package/src/account/masm/index.ts

@@ -1,5 +1,4 @@
 // This file is generated by scripts/generate-masm.mjs from the MASM contract sources.
 // Do not edit it by hand.
 
-export * from './auth.js';
 export * from './account-components/auth.js';

package/src/account/storage.ts

@@ -2,21 +2,7 @@ import type { MultisigConfig } from '../types.js';
 import { StorageSlot, StorageMap, Word } from '@miden-sdk/miden-sdk';
 import { ensureHexPrefix } from '../utils/encoding.js';
 import { getProcedureRoot } from '../procedures.js';
-
-// Storage slot names matching the MASM definitions
-const MULTISIG_SLOT_NAMES = {
-  THRESHOLD_CONFIG: 'openzeppelin::multisig::threshold_config',
-  SIGNER_PUBLIC_KEYS: 'openzeppelin::multisig::signer_public_keys',
-  SIGNER_SCHEME_IDS: 'openzeppelin::multisig::signer_scheme_ids',
-  EXECUTED_TRANSACTIONS: 'openzeppelin::multisig::executed_transactions',
-  PROCEDURE_THRESHOLDS: 'openzeppelin::multisig::procedure_thresholds',
-} as const;
-
-const GUARDIAN_SLOT_NAMES = {
-  SELECTOR: 'openzeppelin::guardian::selector',
-  PUBLIC_KEY: 'openzeppelin::guardian::public_key',
-  SCHEME_ID: 'openzeppelin::guardian::scheme_id',
-} as const;
+import { MULTISIG_SLOT_NAMES, GUARDIAN_SLOT_NAMES } from './layout.js';
 
 function signerMapKey(index: bigint): Word {
   return new Word(new BigUint64Array([index, 0n, 0n, 0n]));
@@ -70,24 +56,25 @@ export class StorageLayoutBuilder {
     return [slot0, slot1, slot2, slot3, slot4];
   }
 
+  /**
+   * The guarded-multisig has no enable/disable selector; the guardian is always present, so this
+   * returns just two slots: the guardian public-key map and its scheme map.
+   */
   buildGuardianSlots(config: MultisigConfig): StorageSlot[] {
-    const selector = config.guardianEnabled !== false ? 1n : 0n;
     const schemeId = config.signatureScheme === 'ecdsa' ? 1n : 2n;
-    const selectorWord = new Word(new BigUint64Array([selector, 0n, 0n, 0n]));
-    const slot0 = StorageSlot.fromValue(GUARDIAN_SLOT_NAMES.SELECTOR, selectorWord);
+    const zeroKey = signerMapKey(0n);
 
     const guardianKeyMap = new StorageMap();
-    const zeroKey = signerMapKey(0n);
     const guardianKey = Word.fromHex(ensureHexPrefix(config.guardianCommitment));
     guardianKeyMap.insert(zeroKey, guardianKey);
-    const slot1 = StorageSlot.map(GUARDIAN_SLOT_NAMES.PUBLIC_KEY, guardianKeyMap);
+    const slot0 = StorageSlot.map(GUARDIAN_SLOT_NAMES.PUBLIC_KEY, guardianKeyMap);
 
     const guardianSchemeMap = new StorageMap();
     const guardianScheme = new Word(new BigUint64Array([schemeId, 0n, 0n, 0n]));
     guardianSchemeMap.insert(zeroKey, guardianScheme);
-    const slot2 = StorageSlot.map(GUARDIAN_SLOT_NAMES.SCHEME_ID, guardianSchemeMap);
+    const slot1 = StorageSlot.map(GUARDIAN_SLOT_NAMES.SCHEME_ID, guardianSchemeMap);
 
-    return [slot0, slot1, slot2];
+    return [slot0, slot1];
   }
 }
 

package/src/client.test.ts

@@ -19,22 +19,27 @@ vi.mock('@miden-sdk/miden-sdk', () => ({
       vault: vi.fn(),
     })),
   },
+  Word: vi.fn(),
 }));
 
-// Mock the AccountInspector
-vi.mock('./inspector.js', () => ({
-  AccountInspector: {
-    fromAccount: vi.fn(() => ({
-      threshold: 2,
-      numSigners: 2,
-      signerCommitments: ['0x' + 'a'.repeat(64), '0x' + 'b'.repeat(64)],
-      guardianEnabled: true,
-      guardianCommitment: '0x' + 'c'.repeat(64),
-      vaultBalances: [],
-      procedureThresholds: new Map(),
-    })),
-  },
-}));
+// Mock the AccountInspector, keeping the real assertCompleteDetectedConfig
+// so load()'s fail-closed validation is exercised.
+vi.mock('./inspector.js', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('./inspector.js')>();
+  return {
+    ...actual,
+    AccountInspector: {
+      fromAccount: vi.fn(() => ({
+        threshold: 2,
+        numSigners: 2,
+        signerCommitments: ['0x' + 'a'.repeat(64), '0x' + 'b'.repeat(64)],
+        guardianCommitment: '0x' + 'c'.repeat(64),
+        vaultBalances: [],
+        procedureThresholds: new Map(),
+      })),
+    },
+  };
+});
 
 // Mock the account creation module
 vi.mock('./account/index.js', () => ({
@@ -232,6 +237,66 @@ describe('MultisigClient', () => {
       expect(webClient.accounts.insert).toHaveBeenCalledTimes(1);
     });
 
+    it('fails closed when the detected signer set is incomplete (issue #306 review)', async () => {
+      const client = new MultisigClient(webClient, CLIENT_CONFIG);
+
+      const { AccountInspector } = await import('./inspector.js');
+      // Storage reports 3 signers but only 2 entries were readable — adopting
+      // this config would let membership proposals drop the missing key.
+      vi.mocked(AccountInspector.fromAccount).mockReturnValueOnce({
+        threshold: 2,
+        numSigners: 3,
+        signerCommitments: ['0x' + 'a'.repeat(64), '0x' + 'b'.repeat(64)],
+        guardianCommitment: '0x' + 'c'.repeat(64),
+        vaultBalances: [],
+        procedureThresholds: new Map(),
+      });
+
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({
+          account_id: '0x' + 'd'.repeat(30),
+          commitment: '0x' + 'e'.repeat(64),
+          state_json: { data: 'base64state' },
+          created_at: '2024-01-01T00:00:00Z',
+          updated_at: '2024-01-02T00:00:00Z',
+        }),
+      });
+
+      await expect(client.load('0x' + 'd'.repeat(30), mockSigner)).rejects.toThrow(
+        /incomplete signer set: storage reports 3 signers, read 2/,
+      );
+    });
+
+    it('fails closed when the guardian commitment is missing', async () => {
+      const client = new MultisigClient(webClient, CLIENT_CONFIG);
+
+      const { AccountInspector } = await import('./inspector.js');
+      vi.mocked(AccountInspector.fromAccount).mockReturnValueOnce({
+        threshold: 1,
+        numSigners: 1,
+        signerCommitments: ['0x' + 'a'.repeat(64)],
+        guardianCommitment: null,
+        vaultBalances: [],
+        procedureThresholds: new Map(),
+      });
+
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({
+          account_id: '0x' + 'd'.repeat(30),
+          commitment: '0x' + 'e'.repeat(64),
+          state_json: { data: 'base64state' },
+          created_at: '2024-01-01T00:00:00Z',
+          updated_at: '2024-01-02T00:00:00Z',
+        }),
+      });
+
+      await expect(client.load('0x' + 'd'.repeat(30), mockSigner)).rejects.toThrow(
+        /missing guardian commitment/,
+      );
+    });
+
     it('should throw if account not found on GUARDIAN', async () => {
       const client = new MultisigClient(webClient, CLIENT_CONFIG);
 
@@ -242,7 +307,7 @@ describe('MultisigClient', () => {
         headers: new Headers(),
         text: async () =>
           JSON.stringify({
-            code: 'GUARDIAN_ACCOUNT_NOT_FOUND',
+            code: 'account_not_found',
             message: 'Account not found',
             meta: { retryable: false },
           }),

package/src/client.ts

@@ -10,7 +10,7 @@ import { GuardianHttpClient } from '@openzeppelin/guardian-client';
 import type { StateObject } from '@openzeppelin/guardian-client';
 import { Multisig } from './multisig.js';
 import { createMultisigAccount } from './account/index.js';
-import { AccountInspector } from './inspector.js';
+import { AccountInspector, assertCompleteDetectedConfig } from './inspector.js';
 import { getRawMidenClient, requireConfigValue, requireMidenRpcEndpoint } from './raw-client.js';
 import type { MultisigConfig, Signer } from './types.js';
 import {
@@ -214,11 +214,13 @@ export class MultisigClient {
     const account = Account.deserialize(accountBytes);
 
     const detected = AccountInspector.fromAccount(account);
+    // Fail closed on a partial read: the detected signer set becomes the
+    // authoritative config that membership proposals rewrite on-chain.
+    assertCompleteDetectedConfig(detected);
     const config: MultisigConfig = {
       threshold: detected.threshold,
       signerCommitments: detected.signerCommitments,
-      guardianCommitment: detected.guardianCommitment ?? '',
-      guardianEnabled: detected.guardianEnabled,
+      guardianCommitment: detected.guardianCommitment,
       procedureThresholds: Array.from(detected.procedureThresholds.entries()).map(
         ([procedure, threshold]) => ({ procedure, threshold })
       ),