fix: remove insecure SchnorrSingleKeyAccount contract

docs/docs-developers/docs/resources/migration_notes.md

@@ -9,6 +9,21 @@ Aztec is in active development. Each version may introduce breaking changes that
 
 ## TBD
 
+### [Aztec.js] Removed `SingleKeyAccountContract`
+
+The `SchnorrSingleKeyAccount` contract and its TypeScript wrapper `SingleKeyAccountContract` have been removed. This contract was insecure: it used `ivpk_m` (incoming viewing public key) as its Schnorr signing key, meaning anyone who received a user's viewing key could sign transactions on their behalf.
+
+**Migration:**
+
+```diff
+- import { SingleKeyAccountContract } from '@aztec/accounts/single_key';
+- const contract = new SingleKeyAccountContract(signingKey);
++ import { SchnorrAccountContract } from '@aztec/accounts/schnorr';
++ const contract = new SchnorrAccountContract(signingKey);
+```
+
+**Impact**: If you were using `@aztec/accounts/single_key`, switch to `@aztec/accounts/schnorr` which uses separate keys for encryption and authentication.
+
 ### `aztec new` and `aztec init` now create a 2-crate workspace
 
 `aztec new` and `aztec init` now create a workspace with two crates instead of a single contract crate:

noir-projects/noir-contracts/Nargo.toml

@@ -4,7 +4,6 @@ members = [
     "contracts/account/ecdsa_r_account_contract",
     "contracts/account/schnorr_account_contract",
     "contracts/account/schnorr_hardcoded_account_contract",
-    "contracts/account/schnorr_single_key_account_contract",
     "contracts/account/simulated_account_contract",
     "contracts/app/amm_contract",
     "contracts/app/app_subscription_contract",

yarn-project/accounts/README.md

@@ -12,7 +12,6 @@ npm install @aztec/accounts
 
 - **Schnorr**: Uses an Grumpkin private key with Schnorr signatures for authentication, and a separate Grumpkin private key for encryption. Recommended for most use cases.
 - **ECDSA**: Uses an ECDSA private key for authentication, and a Grumpkin private key for encryption. Recommended for building integrations with Ethereum wallets.
-- **SingleKey**: Uses a single Grumpkin private key for both authentication and encryption. Recommended for testing purposes only.
 
 ## Usage
 

yarn-project/accounts/package.json

@@ -10,8 +10,6 @@
     "./ecdsa/lazy": "./dest/ecdsa/lazy.js",
     "./schnorr": "./dest/schnorr/index.js",
     "./schnorr/lazy": "./dest/schnorr/lazy.js",
-    "./single_key": "./dest/single_key/index.js",
-    "./single_key/lazy": "./dest/single_key/lazy.js",
     "./stub": "./dest/stub/index.js",
     "./stub/lazy": "./dest/stub/lazy.js",
     "./testing": "./dest/testing/index.js",
@@ -25,7 +23,6 @@
       "./src/defaults/index.ts",
       "./src/ecdsa/index.ts",
       "./src/schnorr/index.ts",
-      "./src/single_key/index.ts",
       "./src/testing/index.ts"
     ],
     "name": "Accounts",

yarn-project/accounts/scripts/copy-contracts.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 mkdir -p ./artifacts
 
-contracts=(schnorr_account_contract-SchnorrAccount ecdsa_k_account_contract-EcdsaKAccount ecdsa_r_account_contract-EcdsaRAccount schnorr_single_key_account_contract-SchnorrSingleKeyAccount simulated_account_contract-SimulatedAccount )
+contracts=(schnorr_account_contract-SchnorrAccount ecdsa_k_account_contract-EcdsaKAccount ecdsa_r_account_contract-EcdsaRAccount simulated_account_contract-SimulatedAccount )
 
 decl=$(cat <<EOF
 import { type NoirCompiledContract } from '@aztec/stdlib/noir';

yarn-project/cli-wallet/src/cmds/index.ts

@@ -63,7 +63,7 @@ export function injectCommands(
   const createAccountCommand = program
     .command('create-account')
     .description(
-      'Creates an aztec account that can be used for sending transactions. Registers the account on the PXE and deploys an account contract. Uses a Schnorr single-key account which uses the same key for encryption and authentication (not secure for production usage).',
+      'Creates an aztec account that can be used for sending transactions. Registers the account on the PXE and deploys an account contract. Uses a Schnorr account which uses an immutable key for authentication.',
     )
     .summary('Creates an aztec account that can be used for sending transactions.')
     .addOption(createAccountOption('Alias or address of the account performing the deployment', !db, db))

yarn-project/end-to-end/src/e2e_account_contracts.test.ts

@@ -1,6 +1,5 @@
 import { EcdsaKAccountContract } from '@aztec/accounts/ecdsa';
 import { SchnorrAccountContract } from '@aztec/accounts/schnorr';
-import { SingleKeyAccountContract } from '@aztec/accounts/single_key';
 import { type Account, type AccountContract, BaseAccount, getAccountContractAddress } from '@aztec/aztec.js/account';
 import { AztecAddress, CompleteAddress } from '@aztec/aztec.js/addresses';
 import { Fr, GrumpkinScalar } from '@aztec/aztec.js/fields';
@@ -99,11 +98,7 @@ const itShouldBehaveLikeAnAccountContract = (
 };
 
 describe('e2e_account_contracts', () => {
-  describe('schnorr single-key account', () => {
-    itShouldBehaveLikeAnAccountContract((encryptionKey: GrumpkinScalar) => new SingleKeyAccountContract(encryptionKey));
-  });
-
-  describe('schnorr multi-key account', () => {
+  describe('schnorr account', () => {
     itShouldBehaveLikeAnAccountContract(() => new SchnorrAccountContract(GrumpkinScalar.random()));
   });