Added proposal
Development Fund Proposal Submission
Proposal file: Link to the proposal added in this PR: /proposals/verify-before-sign-by-ftp-team.md
---
Summary
Canton's Ledger API requires clients to recompute the prepared-transaction hash and to display the transaction content before signing. No production signing path in the official wallet stack recomputes that hash, so nothing binds what a user approves to what their key signs, and five teams have each written a private version of the missing check. This proposal delivers one Apache-2.0 TypeScript library that recomputes the hash for schemes V2, V3 and V4 and refuses to sign unless four template-independent properties hold, plus a published conformance vector corpus any language including embedded C can validate against, and a free upstream patch to canton-network/wallet.
---
Checklist
- [x] Proposal file added under
/proposals/ - [x] Milestones and funding amounts defined
- [x] Acceptance criteria included
- [x] Alignment with Canton priorities described
---
Notes for Reviewers
Canton's Ledger API states that clients MUST recompute the prepared-transaction hash and MUST display the transaction content before signing. No production signing path in the official wallet stack recomputes it: the gateway shows a decoded transaction and a hash beside it, and nothing binds the two. Five teams have each written a private version of the missing check, four pinned to scheme V2, while Canton 3.5.1 tells integrators to move to V3 and no V3 implementation is installable today.
No retroactive component. 320,000 CC of the 570,000 CC ceiling pays only on third-party adoption verified by the consuming team. The proposal also states what it does not claim: byte comparison of choice arguments requires the DAR, so Section 1 names the four properties decidable without it and enforces only those fail-closed.
Links Production precursor: https://www.npmjs.com/package/@ftptech/canton-agent-wallet Dev Fund #78, Milestones 1 and 2 accepted: https://github.com/canton-foundation/canton-dev-fund/pull/78 Both MUST clauses: https://github.com/digital-asset/canton/blob/main/community/ledger-api-proto/src/main/protobuf/com/daml/ledger/api/v2/interactive/interactive_submission_service.proto#L237 The open TODO where the check belongs, 13 months old: https://github.com/canton-network/wallet/blob/main/core/signing-internal/src/controller.ts#L79
