fix(drive-abci): duplicate identity key bypasses pre-validation, returns internal error instead of ConsensusError

[lklimek]

User Story

As a Dash Platform user, I want duplicate identity key errors to be caught during validation (returning a proper ConsensusError) rather than during execution (returning a raw internal error), so that my wallet application can display a clear, structured error message.

Problem

validate_unique_identity_public_key_hashes_not_in_state() only checks the unique key hash set via has_any_of_unique_public_key_hashes(). However, the insertion code in insert_unique_public_key_hash_reference_to_identity_operations_v0() checks both unique AND non-unique sets before inserting.

This asymmetry creates a bypass:

1. Identity with key K is registered → K goes into the non-unique set
2. Another identity tries to register with the same key K
3. Pre-validation checks unique set only → K not there → validation passes ✅
4. Insertion checks non-unique set → K exists → execution fails 💥
5. Error surfaces as StateTransitionExecutionResult::InternalError(string) instead of a ConsensusError

The SDK client receives a gRPC Internal error with a raw string message instead of a structured ConsensusError::BasicError(DuplicatedIdentityPublicKeyIdBasicError).

Suggested Fix

In packages/rs-drive-abci/src/execution/validation/state_transition/common/validate_unique_identity_public_key_hashes_in_state/v0/mod.rs, extend the validation to also call has_any_of_non_unique_public_key_hashes() (or equivalent) and return a DuplicatedIdentityPublicKeyIdBasicError if the key exists in either set.

Files

File	Current behavior
.../validate_unique_identity_public_key_hashes_in_state/v0/mod.rs	Only checks unique set
.../insert_unique_public_key_hash_reference_to_identity/v0/mod.rs	Checks both unique + non-unique

Related

• PR fix(rs-dapi,sdk): decode base64 CBOR error messages and detect duplicate identity keys #3350 — decodes base64 CBOR error messages (workaround at DAPI level)
• fix(error): classify DAPI transport errors and decode gRPC domain errors dash-evo-tool#766 — DET-side error classification workaround

_{🤖 Co-authored by Claudius the Magnificent AI Agent}