/privacy-disclosure

name: "privacy-disclosure"
description: "Trigger Pattern Always required for DAML audits - Inject Into Breadth agents, depth-edge-case"

PRIVACY_DISCLOSURE Skill (DAML)

> **Trigger Pattern**: Always required for DAML audits > **Inject Into**: Breadth agents, depth-edge-case > **Finding prefix**: `[DML-PD-N]` > **Rules referenced**: R10, R13

DAML enforces sub-transaction privacy: a contract is visible only to its **stakeholders** (signatories + observers), plus parties to whom it is **divulged** (incidentally disclosed when they participate in a transaction that `fetch`es it). An over-broad `observer`, divulgence through a shared transaction, or an interface `view` that exposes too much, all leak confidential state to parties who should not see it. STRICT GATE: a privacy finding is reportable ONLY with a party-scoped `query@T outsider` PoC steer that returns a non-empty result for a party who should see nothing. Disclosure-design prose without a `query@T` steer is NOT a finding — drop it.

1. Stakeholder-Set Inventory

For every template, enumerate exactly who can see each instance:

| Template | Signatories | Observers | Observer Source | Confidential Fields | Over-Broad? | |----------|-------------|-----------|-----------------|---------------------|-------------| | `{T}` | `{parties}` | `{parties}` | fixed / `arg.X` / list field | `{amount, counterparty, terms}` | `[DML-PD-N]` if observer sees secrets |

**Critical patterns to flag**:

• An `observer` set derived from a choice argument or a caller-supplied list → a party can add themselves as an observer of a contract carrying confidential terms (`[ELEVATE:OBSERVER_BROAD]`).
• An observer added "for convenience" (e.g., a market operator) who thereby sees per-party amounts/positions that should remain bilateral.

**DAML note**: `controller p` auto-adds `p` as an observer for the duration the choice is exercisable. A nonconsuming choice with a broad controller persistently discloses the contract to all those parties.

2. Divulgence-via-Fetch

Divulgence is incidental: when party X participates in a transaction that `fetch`es contract C, X learns C's contents even if X is not a stakeholder of C.

| Choice | Fetches Confidential Contract? | Transaction Participants | Non-Stakeholder Participant Sees It? | Finding? | |--------|--------------------------------|--------------------------|--------------------------------------|----------| | `{T.C}` | `{C}` | `{parties to the tx}` | YES/NO | `[DML-PD-N]` if non-stakeholder learns secrets |

**Attack**: A choice exercised by party A fetches a confidential `Position`/`Quote` belonging to B and includes A as a participant in the same transaction. A is divulged B's confidential contract even though A is not a stakeholder. Verify confidential contracts are not fetched into transactions involving parties who should not learn them (`[ELEVATE:DIVULGENCE]`).

**Note**: divulgence is transient (the divulged party learns the contents but does not gain authority), but the disclosure itself is the harm for confidential financial terms. Distinguish from persistent observer disclosure.

3. Interface View Over-Exposure

An interface `view` is computed from the underlying contract and visible to every party who can see the contract through the interface.

| Interface | view Fields Exposed | Underlying Confidential? | Viewer Set | Over-Exposure? | |-----------|---------------------|--------------------------|------------|----------------| | `{I}` | `{fields}` | YES/NO | `{parties}` | `[DML-PD-N]` if confidential field in view |

**Check for**:

• A `view` that surfaces a confidential field (amount, counterparty, internal id) to interface viewers who were not stakeholders of the underlying template.
• A view used as a "public summary" that leaks more than intended.

4. Choice-Observer Leakage

A choice's controllers/observers and the contracts it discloses in consequences can leak relationships.

| Template.Choice | Discloses (via create/observer) | To Whom | Should They See It? | Finding? | |-----------------|---------------------------------|---------|---------------------|----------| | `{T.C}` | `{child contract / disclosed field}` | `{parties}` | YES/NO | `[DML-PD-N]` if leak |

**Check for**:

• A choice that creates a child contract with an observer set wider than the parent's stakeholders, broadening disclosure each step.
• A consequence that discloses one party's existence/terms to another through shared observers.

Finding Template

**ID**: [DML-PD-N]
**Severity**: [High if confidential financial terms leak to a competitor/counterparty, Medium otherwise; cap per impact — NOT auto-downgraded as on-chain-only]
**Step Execution**: ✓1,2,3,4 | ✗(reasons) | ?(uncertain)
**Rules Applied**: [R10:✓/✗, R13:✓/✗]
**Location**: {Module}.daml:LineN (template X, choice/observer Y)
**Title**: Over-broad observer / divulgence-via-fetch / interface view exposes {confidential field} to {party}
**Description**: [The disclosure mechanism (observer source, fetch-in-shared-tx, or view field) and which party learns what they should not]
**Impact**: [Counterparty/competitor learns confidential amount, position, or relationship]
**PoC steer (MANDATORY)**: `outsider <- allocateParty "Outsider"; cids <- query @T outsider; assert (not (null cids))` — the outsider, who should see nothing, sees the confidential contract. For divulgence, query AFTER the divulging transaction.

---

Step Execution Checklist (MANDATORY)

| Section | Required | Completed? | Notes | |---------|----------|------------|-------| | 1. Stakeholder-Set Inventory | YES | ✓/✗/? | Every template's signatories + observers | | 2. Divulgence-via-Fetch | IF fetch of another party's contract present | ✓/✗(N/A)/? | Every shared-tx fetch of confidential state | | 3. Interface View Over-Exposure | IF interfaces with views present | ✓/✗(N/A)/? | Every view field vs underlying confidentiality | | 4. Choice-Observer Leakage | YES | ✓