papers/lp-225-xss-x-chain-settlement-spine/sections/10-open-questions.tex

\section{Open questions and cryptographer-review items}
\label{sec:open}

XSS reuses two cryptographic verifiers that are implemented
(\texttt{0x012205} P3Q, \texttt{0x012220} starkfri) and a note model that
exists (\texttt{lux/chains/zkvm/}), but it composes them in ways the code
does not yet exercise. The cryptographic claims below are \emph{not}
asserted as proven. \textbf{The shielded-pool soundness and the
P3Q/starkfri trust model require cryptographer sign-off before
implementation.}

\subsection{Items requiring cryptographer sign-off}

\begin{enumerate}[leftmargin=2em]
\item \textbf{Shielded-pool soundness (commitments/nullifiers).} That
  the deployed commitment scheme is binding and hiding, that nullifiers
  are unforgeable and uniquely determined by a note, and that the note
  pool admits no inflation. The model objects exist
  (\texttt{transaction.go:113--120};
  \texttt{precompile/zk/commitment.go}) but the shield/unshield
  execution is a stub (\texttt{handlers.go:141,313}); the scheme must be
  pinned and reviewed as deployed.
\item \textbf{Cross-boundary double-spend (S4).} That a single note
  cannot be both unshielded to a visible X UTXO \emph{and} spent again
  on Z --- i.e. the nullifier set is the single arbiter across both the
  X mint side and the Z spend side, with no race or partition that
  admits two consumptions. This is the soundness of S4 specifically at
  the X$\leftrightarrow$Z seam.
\item \textbf{Boundary conservation enforcement (S2 shielded term).}
  That the equal-value link between a burned visible UTXO and a minted
  commitment (shield), and between a nullified note and a minted visible
  UTXO (unshield), is enforced by the validity proof and not merely
  asserted. Today \emph{no} code tracks visible $+$ shielded $=$ total;
  the mechanism that makes $S(a,h)$ auditable and conserved is new and
  must be designed under review.
\item \textbf{P3Q attestation trust model.} P3Q is an ML-DSA-65
  attestation --- its soundness reduces to the honesty of the attesting
  set (a single-venue / trusted-operator assumption, per its own
  ``rollup-commit verifier'' role, \texttt{contract.go:30,41}). The
  policy question: \emph{for which settlements is an attestation
  acceptable, and for which is a starkfri STARK mandatory?} XSS must
  define the boundary (e.g. attestation acceptable only single-venue and
  below a value threshold; STARK required otherwise) and a cryptographer
  must validate that the attestation assumption is acceptable wherever
  it is used for value transfer.
\item \textbf{starkfri trust model and AIR coverage.} starkfri is a
  STARK/FRI verifier (\texttt{contract.go:75}); its trustlessness
  depends on the soundness of the AIR it verifies and the FRI parameters.
  The settlement-validity AIR (``the module's state transition to
  \texttt{stateRoot} was valid, and the settled deltas are exactly
  these'') does not exist yet and must be specified and reviewed. Note:
  the repo's starkfri benchmark uses a \emph{toy} 2\,KiB proof payload
  (\texttt{starkfri/bench\_test.go}), so any performance expectation for
  a real settlement AIR is unestablished.
\end{enumerate}

\subsection{Architectural open questions}

\begin{enumerate}[leftmargin=2em]
\item \textbf{The rollup is not wired.} The pipeline batch $\to$ P3Q
  $\to$ starkfri $\to$ Z does not exist in \texttt{lx/dex/} today
  (Section~\ref{sec:bridge}). XSS depends on it both for the DEX (P2/P3
  settlement proofs) and for the shielded boundary. The
  ``shield/unshield generalizes the rollup'' claim is architectural
  until that wiring exists; it should be built and proven (under the
  coexistence harness) for the DEX first, then reused for the boundary.
\item \textbf{P's mint authority.} The P-Chain's independent
  \texttt{CreateAssetTx} and reward minting
  (\texttt{create\_asset\_tx.go:61};
  \texttt{proposal\_tx\_executor.go:300}) directly contradict ``other
  chains compute, X settles.'' Resolving this in P4 means moving asset
  creation and reward issuance to X-settled results. The migration of
  reward issuance in particular (rewards are \emph{new} value, not a
  movement of existing locked value) needs a precise conservation story:
  reward minting becomes an X-level inflation primitive gated by P's
  settlement, distinct from the net-zero \texttt{SettleTx}.
\item \textbf{No performance number is claimed.} This document asserts
  no throughput figure. The P3Q and starkfri precompiles have benchmark
  harnesses (\texttt{p3q/bench\_test.go}, \texttt{starkfri/bench\_test.go})
  but \emph{no measured throughput is committed in the repo}; the
  coexistence harness (Section~\ref{sec:coexistence}, axis 4) is the
  mechanism that produces the real performance delta before any flip to
  \texttt{unified}.
\item \textbf{Lock liveness vs module stalls.} \texttt{expiry} and
  \texttt{unlockCondition} guarantee value can always return to its
  owner if a module stalls, but the precise predicates (when may an
  owner unlock a \texttt{dex} lock whose order ``never rested''? a
  \texttt{stake} lock during an unbonding window?) are per-module policy
  to be specified in P2/P4 and must not admit an unlock that races a
  legitimate in-flight settlement.
\end{enumerate}

\subsection{Scope of this document}

This is a design specification. It defines the XSS model, the
\texttt{XLock} object, the five X primitives, the visible$\leftrightarrow$
shielded bridge, the per-chain reductions, the coexistence harness, the
phased migration, and the safety properties --- grounding every
architectural claim in current code with explicit \IMPL{} /
\DESIGN{} marks. It does \emph{not} implement the wire, and it does
\emph{not} assert the cryptographic soundness of the shielded pool or
the proof trust models, which are gated on the sign-off above.