Access-control libraries for a zkVM execution layer

1. Context

Every program on a new execution layer needs the same two building blocks: a way to gate privileged instructions behind an authority, and an emergency stop. Without a shared, reviewed version, each team rebuilds both by hand and each rebuild is a fresh chance to get them wrong. The target here is an SVM-style execution layer whose programs compile to RISC Zero guests, with a hash-based account model, so patterns from the Solana world had to be rethought for a platform without its assumptions.

We built the two foundational libraries: an admin authority (set, transfer, revoke a single admin, one require_admin gate) and a freeze authority, a circuit breaker for the program and for individual accounts, with the freeze role itself managed by the admin role.

2. One annotation to adopt

The libraries are designed for adoption cost. A program takes on the whole pattern by adding one attribute and carries no access-control logic of its own; the sample programs in the repository gate their own instructions this way, and the measured transaction-size overhead ships alongside them.

#[admin_authority]        // set, transfer, revoke, require_admin
#[freeze_authority]       // program and per-account circuit breaker
pub mod my_program { ... }

3. Verified against the chain

The libraries pass 60 host tests in continuous integration, and tests were the floor. We built the sample programs into RISC Zero guests, packaged them for the chain, ran a local sequencer, and exercised every privileged path on-chain. The admin library went through its full lifecycle: initialize, set under the admin, transfer to a new admin, the old admin rejected, revoke, and rejected again after revoke. The freeze breaker was driven from both sides: frozen, a write is rejected and state is unchanged; unfrozen, the same write lands. Every step was checked against on-chain state and the sequencer’s execution log, and the transcript ships in the repository with reproduction steps.

4. The bug in the toolchain

Working that close to the platform surfaced a defect in its own CLI: it could not submit a class of instruction argument that its own code generator produces. We found the root cause, wrote the fix, verified it against the running chain, and prepared it as an upstream contribution; the maintainers later landed an equivalent fix.

Both libraries are dual-licensed under MIT and Apache 2.0.

5. What to take away

• 1

  Shared access-control primitives are security work: one reviewed implementation replaces a rebuild per team.

• 2

  Tests are the floor. The claim that matters is the lifecycle exercised on-chain and checked against state.

• 3

  On a young platform, budget for the toolchain. Fixing the CLI upstream was part of shipping the libraries.