Unverified Inputs Compromise Access Control in Compact Contracts

Compact contracts commonly use ownPublicKey() to verify ownership, but this approach has a critical flaw: ownPublicKey() is an unconstrained private input that any prover can supply arbitrarily. Since all ledger state is publicly visible on Midnight's transparent layer, attackers can read the owner's key and spoof authorization checks by supplying the stolen value to their proof. This vulnerability exposes a fundamental limitation in zero-knowledge circuit design where private inputs lack identity verification.