fix(standards): stop mint policies from rewriting the output note

[onurinanc]

Summary

• Assert in execute_mint_policy that the mint policy returns the caller-supplied tag, note_type, and RECIPIENT unchanged.
• Keep ASSET_VALUE adjustable, so a fungible faucet still mints the policy-adjusted amount.
• Document the mint policy interface contract on MintPolicy.
• Cover both new assertions with custom-policy tests on the non-fungible faucet.

Closes #3759.

[partylikeits1983]

Looks good to me! Approving modulo the slight refactor of the execute_mint_policy procedure.

[partylikeits1983]

Since execute_mint_policy is already kind of large, I'd put this logic into a separate procedure, simply for readability.

[mmagician]

I'm not sure the underlying issue #3759 is a problem in the first place.

At the end of the day, minting of assets only affects the faucet owner/operator (not users directly; they are the beneficiary of a mint, if anything), and the owner is responsible for choosing the mint policy - so I don't see how this could be exploited or lead to a problem in any way?

[onurinanc]

@mmagician

Agreed, there is no exploit here, but the concern here is a potential mistake for a written policy. (It is also an informational issue: "N-16")

Nothing enforces the policy's stack contract at the dyncall boundary. Think about an allowlist policy written similar to this:

pub proc check_policy
    # => [ASSET_VALUE, tag, note_type, RECIPIENT, pad(6)]

    # get RECIPIENT to the top for the allowlist lookup, and forget to put it back
    # ...
    # assertz.err=ERR_RECIPIENT_NOT_ALLOWLISTED
    
    # => [RECIPIENT, ASSET_VALUE, tag, note_type, pad(6)]
end

The policy works as expected, it does reject a non-allowlisted recipient, but the stack comes back rotated. Nothing catches this, the transaction succeeds and token_supply increases, but the note that can never be consumed.

The non-fungible faucets already have this guard such as: "ERR_NFT_MINT_POLICY_MODIFIED_ASSET_VALUE"

With this PR, we are sure that the stack is not rewritten also for fungible faucets.

[mmagician]

I don't know if we'll ever be able to guard against all types of misconfigured policies @onurinanc, but I suppose it doesn't hurt.