test(token): cover zero-address public balance drains

[alice-aztec]

Summary

• Adds Noir PoC/regression tests showing address(0) public balances are not spendable by third parties.
• Covers the direct drain attempt, a nonce/authwit-style hidden-sender attempt, and the NULL_MSG_SENDER sentinel path.
• Test-only split: no token logic changes are included here.

Test Plan

• git diff --check
• nargo check from src/token_contract (passes; existing unrelated mut env warnings remain)
• aztec test --help did not return within the 60s Hermes probe window, so full yarn test:nr was not run locally.

[alice-aztec]

Closing: wrong repository for the requested split; intended target is defi-wonderland/aztec-nr PR #2.

[github-actions]

Benchmark Comparison

CPU	Cores	RAM	Arch
AMD EPYC 9V74 80-Core Processor	16	63 GiB	x64

Contract: escrow

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	(partial) withdraw	532,162	532,162		1,312	1,312		495,400	495,400		6,933	7,366	+433 (+6.2%)
⚪	withdraw	532,162	532,162		736	736		483,700	483,700		6,966	7,348	+382 (+5.5%)
⚪	withdraw_nft	503,323	503,323		736	736		483,700	483,700		6,814	7,176	+362 (+5.3%)

Contract: logic

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	get_escrow	488,339	488,339		128	128		456,000	456,000		6,666	7,079	+413 (+6.2%)
⚪	secret_key_to_public_keys	483,417	483,417		128	128		456,000	456,000		6,622	7,036	+414 (+6.3%)
⚪	share_escrow	387,745	387,745		704	704		474,500	474,500		5,839	6,226	+387 (+6.6%)

Contract: nft

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	burn_private	422,217	422,217		416	416		661,169	661,169		6,128	6,512	+384 (+6.3%)
⚪	burn_public	308,698	308,698		448	448		670,145	670,145		5,239	5,525	+286 (+5.5%)
⚪	mint_to_private	439,895	439,895		960	960		652,042	652,042		6,242	6,581	+339 (+5.4%)
⚪	mint_to_public	308,698	308,698		448	448		670,790	670,790		5,205	5,545	+340 (+6.5%)
⚪	transfer_private_to_private	394,899	394,899		736	736		483,700	483,700		5,898	6,264	+366 (+6.2%)
⚪	transfer_private_to_public	422,293	422,293		416	416		659,249	659,249		6,100	6,500	+400 (+6.6%)
⚪	transfer_public_to_private	436,536	436,536		960	960		652,459	652,459		6,201	6,595	+394 (+6.4%)
⚪	transfer_public_to_public	308,698	308,698		384	384		633,270	633,270		5,202	5,523	+321 (+6.2%)

Contract: token

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	burn_private	447,046	447,046		992	992		682,815	682,815		6,293	6,681	+388 (+6.2%)
⚪	burn_public	308,698	308,698		448	448		668,939	668,939		5,193	5,532	+339 (+6.5%)
⚪	initialize_transfer_commitment	371,233	371,233		704	704		474,500	474,500		5,741	6,102	+361 (+6.3%)
⚪	mint_to_private	440,787	440,787		960	960		651,853	651,853		6,252	6,668	+416 (+6.7%)
⚪	mint_to_public	308,698	308,698		448	448		671,882	671,882		5,177	5,551	+374 (+7.2%)
⚪	transfer_private_to_commitment	404,209	404,209		896	896		495,400	495,400		5,984	6,382	+398 (+6.7%)
⚪	transfer_private_to_private	423,732	423,732		1,312	1,312		495,400	495,400		6,081	6,431	+350 (+5.8%)
⚪	transfer_private_to_public	447,122	447,122		992	992		683,040	683,040		6,285	6,641	+356 (+5.7%)
⚪	transfer_private_to_public_with_commitment	450,566	450,566		1,568	1,568		716,340	716,340		6,310	6,729	+419 (+6.6%)
⚪	transfer_public_to_commitment	308,698	308,698		576	576		658,995	658,995		5,204	5,517	+313 (+6.0%)
⚪	transfer_public_to_private	437,430	437,430		960	960		652,321	652,321		6,240	6,597	+357 (+5.7%)
⚪	transfer_public_to_public	308,698	308,698		448	448		669,014	669,014		5,211	5,562	+351 (+6.7%)

Contract: vault

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	deposit_private_to_private	856,726	856,726		1,280	1,280		846,413	846,413		9,712	10,253	+541 (+5.6%)
⚪	deposit_private_to_private_exact	965,570	965,570		1,856	1,856		883,247	883,247		10,614	11,272	+658 (+6.2%)
⚪	deposit_private_to_public	674,318	674,318		768	768		861,235	861,235		8,220	8,680	+460 (+5.6%)
⚪	deposit_public_to_private	554,293	554,293		1,344	1,344		885,660	885,660		7,222	7,647	+425 (+5.9%)
⚪	deposit_public_to_private_exact	709,509	709,509		1,920	1,920		922,656	922,656		8,529	9,038	+509 (+6.0%)
⚪	deposit_public_to_public	308,698	308,698		832	832		901,550	901,550		5,254	5,540	+286 (+5.4%)
⚪	issue_private_to_private_exact	965,570	965,570		1,856	1,856		883,904	883,904		10,593	11,238	+645 (+6.1%)
⚪	issue_private_to_public_exact	783,172	783,172		1,344	1,344		898,951	898,951		9,120	9,613	+493 (+5.4%)
⚪	issue_public_to_private	604,635	604,635		1,344	1,344		894,854	894,854		7,630	8,095	+465 (+6.1%)
⚪	issue_public_to_public	308,698	308,698		832	832		902,237	902,237		5,204	5,512	+308 (+5.9%)
⚪	redeem_private_to_private_exact	962,210	962,210		1,856	1,856		883,751	883,751		10,622	11,208	+586 (+5.5%)
⚪	redeem_private_to_public	674,241	674,241		768	768		858,328	858,328		8,152	8,703	+551 (+6.8%)
⚪	redeem_public_to_private_exact	659,929	659,929		1,920	1,920		922,980	922,980		8,029	8,487	+458 (+5.7%)
⚪	redeem_public_to_public	308,698	308,698		832	832		898,727	898,727		5,170	5,620	+450 (+8.7%)
⚪	withdraw_private_to_private	853,366	853,366		1,280	1,280		846,623	846,623		9,625	10,206	+581 (+6.0%)
⚪	withdraw_private_to_private_exact	962,210	962,210		1,856	1,856		883,700	883,700		10,600	11,229	+629 (+5.9%)
⚪	withdraw_private_to_public_exact	783,094	783,094		1,344	1,344		895,837	895,837		9,131	9,621	+490 (+5.4%)
⚪	withdraw_public_to_private	551,001	551,001		1,344	1,344		885,480	885,480		7,159	7,590	+431 (+6.0%)
⚪	withdraw_public_to_public	308,698	308,698		832	832		899,030	899,030		5,228	5,600	+372 (+7.1%)