fix(assembly): validate procedure roots during library deserialization

[giwaov]

Description

This PR fixes an issue where \Library::read_from\ accepts procedure exports whose \MastNodeId\ is not a procedure root in the underlying MAST forest. This allows crafting a library with uncallable procedure exports, violating the invariant enforced by \Library::new().

This was identified as finding 19 in the audit report.

Changes

Fix

• Added a validation loop to the \Deserializable\ implementation for \Library\ (in \crates/assembly-syntax/src/library/mod.rs) that checks each procedure export references a valid procedure root in the \MastForest, matching the existing check in \Library::new().

Test

• Added \library_deserialization_rejects_non_root_export\ test that constructs a tampered serialized library with an export pointing to a non-root node and verifies deserialization rejects it with an appropriate error message.

Testing

• \cargo test -p miden-assembly library_deserialization_rejects_non_root_export\ passes
• \cargo test -p miden-assembly library_serialization\ still passes (no regression)
• Both \miden-assembly\ and \miden-assembly-syntax\ crates compile cleanly

Closes #2831

[huitseeker]

@amathxbt Please cease spam comments.

[huitseeker]

🙏

[bitwalker]

@giwaov Can you rebase this and resolve the CHANGELOG conflict? I think we can get this merged once that is done

[github-actions]

Automated check (CONTRIBUTING.md)

Findings:

• Add a short Rationale explaining why the change is needed.

Recommendations:

• Consider adding a Test plan or clear review steps.

Next steps:

• Ensure issue Library deserialization accepts uncallable procedure exports #2831 is assigned to you.
• See CONTRIBUTING.md for expectations.
• If this is a false positive, comment: /quality-review.

[giwaov]

Rebased onto the latest next and force-pushed the branch.

I also reran the regression test locally:

• cargo test -p miden-assembly library_deserialization_rejects_non_root_export

That passes now, so this should be ready for another look.

[huitseeker]

I wonder if this should call Library::new(mast_forest, exports) instead of re-checking roots here. The last bug came from deserialization drifting away from the constructor path, and keeping the invariant and digest logic in one place would make the next validation change harder to miss.

[giwaov]

Updated on the branch now. Library::read_from delegates to Self::new(mast_forest, exports) so the procedure-root invariant and digest computation stay on the constructor path instead of drifting here again.

I also re-ran cargo test -p miden-assembly library_deserialization_rejects_non_root_export locally.

[huitseeker]

Lol. Good bot

[giwaov]

Haha, fair enough 😄 Thanks again for the review and for merging this one.

That makes 10 merged PRs on my side now, which I’m really happy about and would love to do more, I also wanted to ask: when Miden eventually goes mainnet, is there likely to be any kind of recognition or reward for contributors, or is it still too early to say? Thank you sir.