Someone can register jetton wallet not belonging to them

[ProgramCrafter]

zkJetton/contracts/zk-jetton-wallet.tact

Lines 25 to 35 in a67aceb

	receive(msg: Registration) {
	require(self.balance == 0, "you are registered");
	if(self.groth16Verify_registration(msg.piA, msg.piB, msg.piC, msg.pubInputs)) {
	self.balance = msg.pubInputs.get(0)!!;
	self.key.g = msg.pubInputs.get(1)!!;
	self.key.n = msg.pubInputs.get(3)!!;
	self.key.powN2 = pow(msg.pubInputs.get(3)!!, 2);
	} else {
	nativeThrow(300); // wrong proof
	}
	}

No check is done who is registering the wallet, therefore anyone can supply their own keys and owner will then be unable to access the jettons.

[mysteryon88]

@ProgramCrafter

Yes, you are absolutely right — this vulnerability does indeed exist. Thank you for pointing it out and clearly describing the risk.

It is important to note that this contract is a educational / demonstration example and is not intended to be secure or production-ready. Its purpose is to illustrate the general approach and mechanics (in particular, how Groth16 verification works), rather than to implement a fully secure access-control system.

Thanks again for the feedback — observations like this are valuable even for educational examples.