@aztec-labs/archiver 6.0.0-rc.1 → 6.0.0-rc.2

package/src/modules/validation.ts

@@ -3,10 +3,11 @@ import type { ViemCommitteeAttestations } from '@aztec-labs/ethereum/contracts';
 import { type CheckpointNumber, EpochNumber } from '@aztec-labs/foundation/branded-types';
 import { compactArray } from '@aztec-labs/foundation/collection';
 import type { Fr } from '@aztec-labs/foundation/curves/bn254';
+import type { EthAddress } from '@aztec-labs/foundation/eth-address';
 import type { Logger } from '@aztec-labs/foundation/log';
 import {
   type AttestationInfo,
-  type CommitteeAttestation,
+  CommitteeAttestation,
   type ValidateCheckpointNegativeResult,
   type ValidateCheckpointResult,
   getAttestationInfoFromPayload,
@@ -16,6 +17,8 @@ import { type L1RollupConstants, computeQuorum, getEpochAtSlot } from '@aztec-la
 import { ConsensusPayload, type CoordinationSignatureContext } from '@aztec-labs/stdlib/p2p';
 import type { CheckpointHeader } from '@aztec-labs/stdlib/rollup';
 
+import { CheckpointAttestationsDecodeError } from '../errors.js';
+
 export type { ValidateCheckpointResult };
 
 /**
@@ -36,24 +39,57 @@ export type CalldataCheckpointForAttestations = {
   archiveRoot: Fr;
   feeAssetPriceModifier: bigint;
   header: CheckpointHeader;
-  attestations: CommitteeAttestation[];
   /** The exact packed attestations tuple from L1 calldata, carried verbatim for byte-faithful invalidation. */
   verbatimAttestations: ViemCommitteeAttestations;
 };
 
+/** A checkpoint's attestations decoded for its epoch committee, and their validation result. */
+export type ResolvedCheckpointAttestations = {
+  /** Empty if the epoch has an open escape hatch or no committee. */
+  attestations: CommitteeAttestation[];
+  validationResult: ValidateCheckpointResult;
+};
+
 /**
- * Validates the attestations of a checkpoint from L1 calldata only, without fetching or decoding its blobs.
- * The signed consensus payload (header, archive root, fee asset price modifier) is fully available from
- * calldata, so an invalid-attestation checkpoint can be rejected before any (possibly malformed) blob is
- * fetched and decoded.
+ * Decodes and validates the attestations of a checkpoint from L1 calldata only, so an invalid checkpoint can be
+ * rejected before its blobs are fetched. The tuple is decoded against the epoch's committee size, and not at all
+ * during an escape hatch, where the proposer may post an arbitrary tuple.
+ *
+ * @throws CheckpointAttestationsDecodeError if the tuple does not decode for the epoch committee.
  */
-export function validateCheckpointAttestationsFromCalldata(
+export async function resolveCheckpointAttestationsFromCalldata(
   checkpoint: CalldataCheckpointForAttestations,
   epochCache: EpochCache,
   constants: Pick<L1RollupConstants, 'epochDuration'>,
   signatureContext: CoordinationSignatureContext,
   logger?: Logger,
-): Promise<ValidateCheckpointResult> {
+): Promise<ResolvedCheckpointAttestations> {
+  const slot = checkpoint.header.slotNumber;
+  const epoch: EpochNumber = getEpochAtSlot(slot, constants);
+  // Read the hatch flag from the same cache entry as the committee, so both come from one snapshot.
+  const { committee, seed, isEscapeHatchOpen } = await epochCache.getCommitteeForEpoch(epoch);
+
+  if (isEscapeHatchOpen) {
+    logger?.warn(
+      `Escape hatch open for epoch ${epoch} at slot ${slot}, skipping attestations of checkpoint ${checkpoint.checkpointNumber}`,
+    );
+    return { attestations: [], validationResult: { valid: true } };
+  }
+
+  if (!committee || committee.length === 0) {
+    logger?.warn(
+      `No committee found for epoch ${epoch} at slot ${slot}. Accepting checkpoint ${checkpoint.checkpointNumber} without validation.`,
+    );
+    return { attestations: [], validationResult: { valid: true } };
+  }
+
+  let attestations: CommitteeAttestation[];
+  try {
+    attestations = CommitteeAttestation.fromPacked(checkpoint.verbatimAttestations, committee.length);
+  } catch (err) {
+    throw new CheckpointAttestationsDecodeError(checkpoint.checkpointNumber, epoch, committee.length, err);
+  }
+
   const payload = new ConsensusPayload(
     checkpoint.header,
     checkpoint.archiveRoot,
@@ -67,15 +103,16 @@ export function validateCheckpointAttestationsFromCalldata(
     checkpointNumber: checkpoint.checkpointNumber,
     timestamp: checkpoint.header.timestamp,
   };
-  return validateAttestations(
+
+  const validationResult = validateAttestationsAgainstCommittee(
     payload,
-    checkpoint.attestations,
+    attestations,
     checkpoint.verbatimAttestations,
     checkpointInfo,
-    epochCache,
-    constants,
+    { committee, seed, epoch },
     logger,
   );
+  return { attestations, validationResult };
 }
 
 /**
@@ -92,36 +129,58 @@ export async function validateAttestations(
   constants: Pick<L1RollupConstants, 'epochDuration'>,
   logger?: Logger,
 ): Promise<ValidateCheckpointResult> {
+  const slot = payload.header.slotNumber;
+  const epoch: EpochNumber = getEpochAtSlot(slot, constants);
+  const { committee, seed, isEscapeHatchOpen } = await epochCache.getCommitteeForEpoch(epoch);
+
+  if (isEscapeHatchOpen) {
+    logger?.warn(`Escape hatch open for epoch ${epoch} at slot ${slot}, skipping checkpoint validation`);
+    return { valid: true };
+  }
+
+  if (!committee || committee.length === 0) {
+    logger?.warn(`No committee found for epoch ${epoch} at slot ${slot}. Accepting checkpoint without validation.`, {
+      checkpointNumber: checkpointInfo.checkpointNumber,
+      slot,
+      epoch,
+    });
+    return { valid: true };
+  }
+
+  return validateAttestationsAgainstCommittee(
+    payload,
+    attestations,
+    verbatimAttestations,
+    checkpointInfo,
+    { committee, seed, epoch },
+    logger,
+  );
+}
+
+/** Validates decoded attestations against a known, non-empty epoch committee. */
+function validateAttestationsAgainstCommittee(
+  payload: ConsensusPayload,
+  attestations: CommitteeAttestation[],
+  verbatimAttestations: ViemCommitteeAttestations,
+  checkpointInfo: CheckpointInfo,
+  { committee, seed, epoch }: { committee: EthAddress[]; seed: bigint; epoch: EpochNumber },
+  logger?: Logger,
+): ValidateCheckpointResult {
   const attestorInfos = getAttestationInfoFromPayload(payload, attestations);
   const attestors = compactArray(attestorInfos.map(info => ('address' in info ? info.address : undefined)));
   const headerHash = payload.header.hash();
   const archiveRoot = payload.archive.toString();
   const slot = payload.header.slotNumber;
   const checkpointNumber = checkpointInfo.checkpointNumber;
-  const epoch: EpochNumber = getEpochAtSlot(slot, constants);
-  const { committee, seed } = await epochCache.getCommitteeForEpoch(epoch);
   const logData = { checkpointNumber, slot, epoch, headerHash, archiveRoot };
 
   logger?.debug(`Validating attestations for checkpoint ${checkpointNumber} at slot ${slot} in epoch ${epoch}`, {
-    committee: (committee ?? []).map(member => member.toString()),
+    committee: committee.map(member => member.toString()),
     recoveredAttestors: attestorInfos,
     postedAttestations: attestations.map(a => (a.address.isZero() ? a.signature : a.address).toString()),
     ...logData,
   });
 
-  if (!committee || committee.length === 0) {
-    logger?.warn(
-      `No committee found for epoch ${epoch} at slot ${slot}. Accepting checkpoint without validation.`,
-      logData,
-    );
-    return { valid: true };
-  }
-
-  if (await epochCache.isEscapeHatchOpen(epoch)) {
-    logger?.warn(`Escape hatch open for epoch ${epoch} at slot ${slot}, skipping checkpoint validation`);
-    return { valid: true };
-  }
-
   const requiredAttestationCount = computeQuorum(committee.length);
 
   const failedValidationResult = <TReason extends ValidateCheckpointNegativeResult['reason']>(reason: TReason) => ({

package/src/store/block_store.ts

@@ -51,6 +51,7 @@ import {
   CannotOverwriteCheckpointedBlockError,
   CheckpointNotFoundError,
   CheckpointNumberNotSequentialError,
+  DuplicateTxHashError,
   InitialCheckpointNumberNotSequentialError,
   NoProposedCheckpointToPromoteError,
   ProposedCheckpointArchiveRootMismatchError,
@@ -569,6 +570,10 @@ export class BlockStore {
       indexWithinCheckpoint,
     });
 
+    await this.assertTxsNotInAncestors(
+      block.body.txEffects.map(tx => tx.txHash),
+      block.number,
+    );
     for (let i = 0; i < block.body.txEffects.length; i++) {
       const txEffect: IndexedTxEffect = {
         data: block.body.txEffects[i],
@@ -587,6 +592,28 @@ export class BlockStore {
     await this.#blockArchiveIndex.set(block.archive.root.toString(), block.number);
   }
 
+  /**
+   * Throws if any of the txs is already owned by a stored block below `blockNumber`. Stored blocks below the one being
+   * inserted are its ancestors (archive chaining is enforced on insert), so the tx would be included twice and the new
+   * block would take over the ancestor's tx effect entry. An owner at the same or a higher height is a block being
+   * replaced (a losing local proposal, a re-presented checkpoint), so its entry is overwritten. This relies on replaced
+   * blocks at lower heights having been removed via deleteBlock first (as the updater does before inserting
+   * checkpoints), which also deletes their tx effect entries.
+   */
+  private async assertTxsNotInAncestors(txHashes: TxHash[], blockNumber: BlockNumber): Promise<void> {
+    const existing = await this.#txEffects.getManyAsync(txHashes.map(txHash => txHash.toString()));
+    for (let i = 0; i < txHashes.length; i++) {
+      const stored = existing[i];
+      if (stored === undefined) {
+        continue;
+      }
+      const owner = readTxLocation(stored).blockNumber;
+      if (owner < blockNumber) {
+        throw new DuplicateTxHashError(txHashes[i], blockNumber, owner);
+      }
+    }
+  }
+
   /** Deletes a block and all associated data (tx effects, indices). */
   private async deleteBlock(blockNumber: number, blockStorage: BlockStorage): Promise<void> {
     // Delete the block from the main blocks map
@@ -1283,19 +1310,7 @@ export class BlockStore {
    */
   public async getTxLocation(txHash: TxHash): Promise<TxLocation | undefined> {
     const txEffect = await this.#txEffects.getAsync(txHash.toString());
-    if (!txEffect) {
-      return undefined;
-    }
-    // Read only the IndexedTxEffect header (`blockHash(32) + l2BlockNumber(4) + txIndexInBlock(4)`); the
-    // large tail (the full TxEffect with logs etc.) is irrelevant here.
-    const view = Buffer.from(txEffect.buffer, txEffect.byteOffset, txEffect.byteLength);
-    const l2BlockNumber = view.readUInt32BE(32);
-    const txIndexInBlock = view.readUInt32BE(36);
-    return {
-      blockNumber: BlockNumber(l2BlockNumber),
-      blockHash: BlockHash.fromBuffer(view.subarray(0, 32)),
-      txIndexInBlock,
-    };
+    return txEffect ? readTxLocation(txEffect) : undefined;
   }
 
   /**
@@ -1714,3 +1729,16 @@ export class BlockStore {
     };
   }
 }
+
+/**
+ * Reads only the header of a serialized IndexedTxEffect (`blockHash(32) + l2BlockNumber(4) + txIndexInBlock(4)`),
+ * skipping the large tail (the full TxEffect with logs etc.).
+ */
+function readTxLocation(txEffect: Buffer): TxLocation {
+  const view = Buffer.from(txEffect.buffer, txEffect.byteOffset, txEffect.byteLength);
+  return {
+    blockNumber: BlockNumber(view.readUInt32BE(32)),
+    blockHash: BlockHash.fromBuffer(view.subarray(0, 32)),
+    txIndexInBlock: view.readUInt32BE(36),
+  };
+}

package/src/store/contract_class_store.ts

@@ -28,9 +28,8 @@ export class ContractClassStore {
    * @returns True if every insert succeeded.
    */
   async addContractClasses(data: ContractClassPublicWithCommitment[], blockNumber: number): Promise<boolean> {
-    return (await Promise.all(data.map(c => this.addContractClass(c, c.publicBytecodeCommitment, blockNumber)))).every(
-      Boolean,
-    );
+    await Promise.all(data.map(c => this.addContractClass(c, c.publicBytecodeCommitment, blockNumber)));
+    return true;
   }
 
   /**
@@ -40,7 +39,8 @@ export class ContractClassStore {
    * @returns True if every delete succeeded.
    */
   async deleteContractClasses(data: ContractClassPublic[], blockNumber: number): Promise<boolean> {
-    return (await Promise.all(data.map(c => this.deleteContractClass(c, blockNumber)))).every(Boolean);
+    await Promise.all(data.map(c => this.deleteContractClass(c, blockNumber)));
+    return true;
   }
 
   async addContractClass(

package/src/store/contract_instance_store.ts

@@ -45,16 +45,19 @@ export class ContractInstanceStore {
    * @returns True if every insert succeeded.
    */
   async addContractInstances(data: ContractInstanceWithAddress[], blockNumber: number): Promise<boolean> {
-    return (await Promise.all(data.map(c => this.addContractInstance(c, blockNumber)))).every(Boolean);
+    await Promise.all(data.map(c => this.addContractInstance(c, blockNumber)));
+    return true;
   }
 
   /**
-   * Removes multiple contract instances from the store.
+   * Removes multiple contract instances from the store, but only those that were published at the given block.
    * @param data - Contract instances to delete.
+   * @param blockNumber - L2 block being unwound, which must be the one that published each deleted instance.
    * @returns True if every delete succeeded.
    */
-  async deleteContractInstances(data: ContractInstanceWithAddress[]): Promise<boolean> {
-    return (await Promise.all(data.map(c => this.deleteContractInstance(c)))).every(Boolean);
+  async deleteContractInstances(data: ContractInstanceWithAddress[], blockNumber: number): Promise<boolean> {
+    await Promise.all(data.map(c => this.deleteContractInstance(c, blockNumber)));
+    return true;
   }
 
   /**
@@ -69,11 +72,10 @@ export class ContractInstanceStore {
     timestamp: UInt64,
     blockNumber: BlockNumber,
   ): Promise<boolean> {
-    return (
-      await Promise.all(
-        data.map((update, logIndex) => this.addContractInstanceUpdate(update, timestamp, blockNumber, logIndex)),
-      )
-    ).every(Boolean);
+    await Promise.all(
+      data.map((update, logIndex) => this.addContractInstanceUpdate(update, timestamp, blockNumber, logIndex)),
+    );
+    return true;
   }
 
   /**
@@ -88,11 +90,10 @@ export class ContractInstanceStore {
     timestamp: UInt64,
     blockNumber: BlockNumber,
   ): Promise<boolean> {
-    return (
-      await Promise.all(
-        data.map((update, logIndex) => this.deleteContractInstanceUpdate(update, timestamp, blockNumber, logIndex)),
-      )
-    ).every(Boolean);
+    await Promise.all(
+      data.map((update, logIndex) => this.deleteContractInstanceUpdate(update, timestamp, blockNumber, logIndex)),
+    );
+    return true;
   }
 
   addContractInstance(contractInstance: ContractInstanceWithAddress, blockNumber: number): Promise<void> {
@@ -119,15 +120,21 @@ export class ContractInstanceStore {
     });
   }
 
-  deleteContractInstance(contractInstance: ContractInstanceWithAddress): Promise<void> {
+  deleteContractInstance(contractInstance: ContractInstanceWithAddress, blockNumber: number): Promise<void> {
     // Protocol contracts are preloaded at block 0 and must never be deleted, even when the block that
     // (re-)published them on-chain is unwound by a reorg.
     if (isProtocolContract(contractInstance.address)) {
       return Promise.resolve();
     }
     return this.db.transactionAsync(async () => {
-      await this.#contractInstances.delete(contractInstance.address.toString());
-      await this.#contractInstancePublishedAt.delete(contractInstance.address.toString());
+      const key = contractInstance.address.toString();
+      // An unwound block can carry a log naming an address first published by a surviving block (a forged log in an
+      // unexecuted checkpoint, which the store path skipped). Deleting by address alone would erase that instance.
+      if ((await this.#contractInstancePublishedAt.getAsync(key)) !== blockNumber) {
+        return;
+      }
+      await this.#contractInstances.delete(key);
+      await this.#contractInstancePublishedAt.delete(key);
     });
   }
 

package/src/test/fake_l1_state.ts

@@ -80,6 +80,8 @@ type AddCheckpointOptions = {
    * `attestationsHash` the rollup stores at propose time covers.
    */
   spareAttestationsBitmapBit?: boolean;
+  /** Overrides the posted attestations tuple, e.g. to model an escape-hatch proposer's arbitrary tuple. */
+  verbatimAttestations?: ViemCommitteeAttestations;
 };
 
 /** Result from adding a checkpoint. */
@@ -263,6 +265,7 @@ export class FakeL1State {
       checkpoint,
       signers,
       options.spareAttestationsBitmapBit ?? false,
+      options.verbatimAttestations,
     );
     const blobHashes = await this.makeVersionedBlobHashes(checkpoint);
     const blobs = await this.makeBlobsFromCheckpoint(checkpoint);
@@ -776,6 +779,7 @@ export class FakeL1State {
     checkpoint: Checkpoint,
     signers: Secp256k1Signer[],
     spareAttestationsBitmapBit: boolean,
+    verbatimAttestationsOverride?: ViemCommitteeAttestations,
   ): Promise<{
     tx: Transaction;
     attestationsHash: Buffer32;
@@ -806,9 +810,11 @@ export class FakeL1State {
     );
 
     const packedAttestations = attestationsAndSigners.getPackedAttestations();
-    const verbatimAttestations = spareAttestationsBitmapBit
-      ? { ...packedAttestations, signatureIndices: setLastBitmapBit(packedAttestations.signatureIndices) }
-      : packedAttestations;
+    const verbatimAttestations =
+      verbatimAttestationsOverride ??
+      (spareAttestationsBitmapBit
+        ? { ...packedAttestations, signatureIndices: setLastBitmapBit(packedAttestations.signatureIndices) }
+        : packedAttestations);
 
     const rollupInput = encodeFunctionData({
       abi: RollupAbi,