The transaction handling consequences of the deprecation of divulgence

There was already some discussion about the consequences of the deprecation of divulgence: Deprecation of using Divulged Contracts

I bring up this topic again because I want to make sure that I fully understand its transaction handling consequences.

According to the docs, divulgence seems to be the privacy consequence of a deep transaction handling principle:

Daml’s privacy model is based on two principles:

Principle 1. Parties see those actions that they have a stake in. Principle 2. Every party that sees an action sees its (transitive) consequences.

Principle 2 is necessary to ensure that every party can independently verify the validity of every transaction they see.

See the Privacy section of the page 7 Composing choices — Daml SDK 2.1.1 documentation.

Later on the same page it says:


Note that Principle 2 of the privacy model means that sometimes parties see contracts that they are not signatories or observers on. If you look at the final ledger state of the test_trade script, for example, you may notice that both Alice and Bob now see both assets, as indicated by the Xs in their respective columns:

The table as described above.
This is because the create action of these contracts are in the transitive consequences of the Trade_Settle action both of them have a stake in. This kind of disclosure is often called “divulgence” and needs to be considered when designing Daml models for privacy sensitive applications.

See the Divulgence section of the page 7 Composing choices — Daml SDK 2.1.1 documentation

I guess the deprecation of divulgence doesn’t mess up the ledger execution model, but It’s not immediately obvious to me how this is possible.

The crucial part here is that the use of divulged contracts is deprecated not divulgence. The privacy rules for transactions are completely unchanged.

The problematic part was that divulgence had a side effect:
Because you’ve been divulged a contract in one transaction you were able to fetch it in later transactions. However, you might not see the archive of such a contract as you’re not a stakeholder meaning that it can never be pruned.

This is the part that is deprecated: You’ll still get to see the contract as part of the transaction but the side effect that you can therefore fetch it in later transactions is deprecated.


Thanks, I understand it now!

1 Like