K0 Fix C: SC-auth via verify_sig — owner auth at ringsize>=4 (fixes #97, stacks on #84)

[liqdmetal]

Summary

The last piece of the K0 sequence: once verify_sig (DVM v9, PR #84) lets a contract verify Ed25519 signatures in encrypted SCDATA, owner-gated entrypoints no longer need ringsize 2 — the signer is authorized by signature, not by ringsize-2 ring exposure. This PR is the wallet-side half plus the end-to-end demo.

Why it completes K0

The ringsize-2 ring exposes the signer by design. The K0 package removes every legitimate use:

PR	Fix	Effect
#80	A	wallet warns on ringsize 2 (non-consensus)
#82	B1	consensus min-ring-4 for NORMAL/BURN
#91	B2	ringsize-2 SC_TX only for contracts that declare SIGNER()
#84	C (intrinsic)	verify_sig — signature verification in the VM
this	C (wallet+demo)	owner auth by signature at ringsize ≥ 4

After this, ringsize 2 has no legitimate remaining use — the last reason it existed (owner-gated contracts needing SIGNER() at ringsize 2) is gone.

The implementation

walletapi/sc_auth.go — the wallet-side helper:

• SCAuthKey: app-level Ed25519 keypair. DERO spend keys are bn256 scalars, so SC-auth is a separate key, persisted by the wallet.
• SignSCData: builds + signs the call message domain:scid:entrypoint:args, bound to the call context so a signature can't be replayed onto another entrypoint or contract.
• VerifySCData: client-side mirror of the contract's verify_sig check (self-check before broadcast).

dvm/fixc_auth_test.go — the full Fix C flow in the simulator:

• install an owner-gated contract with the owner's Ed25519 pubkey
• wallet signs the call message
• the contract's verify_sig authorizes at ringsize ≥ 4
• attacker key rejected · tampered signature rejected · state transition verified

walletapi/sc_auth_test.go — direct unit tests for the helper (round-trip, tamper/wrong-key/malformed rejection, message convention + domain binding) that the dvm simulator test cannot reach due to the dvm↔walletapi import cycle.

How a contract uses it

Function OwnerAction(nonce String, pubkey String, sig String) Uint64
	5 version("9.0.0")
	10 LET msg = "relayos:" + SCID() + ":OwnerAction:" + nonce
	20 IF verify_sig(pubkey, msg, sig) != 1 THEN GOTO 900
	30 IF pubkey != LOAD("owner") THEN GOTO 900
	40 STORE("authorized", 1)
	50 RETURN 0
	900 RETURN 1
End Function

The caller signs domain:scid:entrypoint:nonce with the owner's Ed25519 key at ringsize ≥ 4 — no SIGNER(), no ringsize-2 exposure, and the caller stays anonymous (only the signature proves authorization).

Relationship

• Depends on PR DVM v9 intrinsics: signature verification, Pedersen commitments, asset balance, point addition (fixes #83) #84 (DVM v9 verify_sig) — this branch stacks on it
• Completes the K0 package: A (K0 Fix A: wallet ringsize-2 privacy warning + PrivacyWarning RPC field (fixes #79) #80) + B1 (K0 Fix B1: consensus min-ring-4 floor for NORMAL/BURN txs (fixes #81) #82) + B2 (K0 Fix B2: uses_signer contract registry (fixes #90) #91) + C (this PR)
• The ringsize-2 era ends here; combined with the decoy batch RPC (feat(walletapi): decoy selection — batch RPC + activity sampler + D6 bins (fixes #88) #89) and activity-matched sampling (Activity-matched decoy sampler (D5) (fixes #95, stacks on #89) #96), the privacy story is coherent

---

Branch: feature/k0-fix-c in the fork liqdmetal/derohe-improvements-by-liqdmetal (stacked on feature/dvm-v9-intrinsics). Carries the build-manifest fix (go.mod/go.sum).

[liqdmetal]

Superseded by PR #128 — Fix C (SC-auth via verify_sig) is now folded into the consolidated intrinsics package, since it builds directly on the verify_sig intrinsic.