@aztec-labs/cli 6.0.0-rc.3 → 6.0.0

package/src/cmds/validator_keys/new.ts

@@ -10,9 +10,12 @@ import { basename, dirname, join } from 'path';
 import { createPublicClient, fallback, http } from 'viem';
 import { generateMnemonic, mnemonicToAccount, privateKeyToAccount } from 'viem/accounts';
 
+import { type BlsKeyDerivationOptions, resolveBlsKeyDerivationPolicy } from './bls_key_derivation.js';
 import {
   buildValidatorEntries,
   encryptFundingAccountToFile,
+  getBlsDerivationPaths,
+  getBlsKeyCandidates,
   logValidatorSummaries,
   maybePrintJson,
   resolveFundingAccount,
@@ -21,7 +24,7 @@ import {
   writeEthJsonV3ToFile,
   writeKeystoreFile,
 } from './shared.js';
-import { processAttesterAccounts } from './staker.js';
+import { type StakerOutput, assertWithinProofOfPossessionGasLimit, processAttesterAccounts } from './staker.js';
 import {
   validateBlsPathOptions,
   validateFundingAccountOptions,
@@ -59,7 +62,7 @@ export type NewValidatorKeystoreOptions = {
   gseAddress?: EthAddress;
   l1RpcUrls?: string[];
   l1ChainId?: number;
-};
+} & BlsKeyDerivationOptions;
 
 type PasswordSourceOptions = Pick<
   NewValidatorKeystoreOptions,
@@ -152,6 +155,7 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
   validateRemoteSignerOptions(options);
   // validate funding account option
   validateFundingAccountOptions(options);
+  const blsKeyDerivation = resolveBlsKeyDerivationPolicy(options);
 
   const {
     dataDir,
@@ -192,8 +196,9 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
   });
   const shouldEncryptKeystores = ethPassword !== undefined && blsPassword !== undefined;
   const mnemonic = _mnemonic ?? generateMnemonic(wordlist);
+  const showGeneratedMnemonic = !_mnemonic && !json && !shouldEncryptKeystores;
 
-  if (!_mnemonic && !json && !shouldEncryptKeystores) {
+  if (showGeneratedMnemonic) {
     log('No mnemonic provided, generating new one...');
     log(`Using new mnemonic:`);
     log('');
@@ -217,8 +222,35 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
     feeRecipient,
     coinbase,
     remoteSigner,
+    blsKeyDerivation,
+    generatedMnemonic: _mnemonic ? undefined : showGeneratedMnemonic ? 'shown' : 'hidden',
   });
 
+  // Generate staker outputs if requested, from the plaintext keys and before writing anything, so that keys the GSE
+  // would reject leave no files behind.
+  const allStakerOutputs: StakerOutput[] = [];
+  if (stakerOutput && gseAddress && l1RpcUrls && l1ChainId !== undefined) {
+    const chain = createEthereumChain(l1RpcUrls, l1ChainId);
+    const publicClient = createPublicClient({
+      chain: chain.chainInfo,
+      transport: fallback(l1RpcUrls.map(url => http(url, { batch: false }))),
+    });
+    const gse = new GSEContract(publicClient, gseAddress);
+
+    // Process each validator
+    for (let i = 0; i < validators.length; i++) {
+      const validator = validators[i];
+      const outputs = await processAttesterAccounts(validator.attester, gse);
+
+      // Collect all staker outputs
+      for (let j = 0; j < outputs.length; j++) {
+        allStakerOutputs.push(outputs[j]);
+      }
+    }
+
+    await assertWithinProofOfPossessionGasLimit(gse, allStakerOutputs);
+  }
+
   let resolvedFundingAccount = fundingAccount ? resolveFundingAccount(fundingAccount, remoteSigner) : undefined;
 
   // If password provided, write ETH JSON V3 and BLS BN254 keystores and replace plaintext
@@ -226,7 +258,11 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
     const encryptedKeystoreOutDir =
       encryptedKeystoreDir && encryptedKeystoreDir.length > 0 ? encryptedKeystoreDir : keystoreOutDir;
     await writeEthJsonV3ToFile(validators, { outDir: encryptedKeystoreOutDir, password: ethPassword });
-    await writeBlsBn254ToFile(validators, { outDir: encryptedKeystoreOutDir, password: blsPassword });
+    await writeBlsBn254ToFile(validators, {
+      outDir: encryptedKeystoreOutDir,
+      password: blsPassword,
+      derivationPaths: getBlsDerivationPaths(summaries),
+    });
     if (resolvedFundingAccount) {
       resolvedFundingAccount = await encryptFundingAccountToFile(resolvedFundingAccount, {
         outDir: encryptedKeystoreOutDir,
@@ -243,38 +279,20 @@ export async function newValidatorKeystore(options: NewValidatorKeystoreOptions,
 
   await writeKeystoreFile(outputPath, keystore);
 
-  // Generate staker outputs if requested
-  const allStakerOutputs: any[] = [];
-  if (stakerOutput && gseAddress && l1RpcUrls && l1ChainId !== undefined) {
-    const chain = createEthereumChain(l1RpcUrls, l1ChainId);
-    const publicClient = createPublicClient({
-      chain: chain.chainInfo,
-      transport: fallback(l1RpcUrls.map(url => http(url, { batch: false }))),
-    });
-    const gse = new GSEContract(publicClient, gseAddress);
-
+  // Write a single JSON file with all staker outputs
+  if (allStakerOutputs.length > 0) {
     // Extract keystore base name without extension for unique staker output filenames
     const keystoreBaseName = basename(outputPath, '.json');
-
-    // Process each validator
-    for (let i = 0; i < validators.length; i++) {
-      const validator = validators[i];
-      const outputs = await processAttesterAccounts(validator.attester, gse);
-
-      // Collect all staker outputs
-      for (let j = 0; j < outputs.length; j++) {
-        allStakerOutputs.push(outputs[j]);
-      }
-    }
-
-    // Write a single JSON file with all staker outputs
-    if (allStakerOutputs.length > 0) {
-      const stakerOutputPath = join(keystoreOutDir, `${keystoreBaseName}_staker_output.json`);
-      await writeFile(stakerOutputPath, prettyPrintJSON(allStakerOutputs), 'utf-8');
-    }
+    const stakerOutputPath = join(keystoreOutDir, `${keystoreBaseName}_staker_output.json`);
+    await writeFile(stakerOutputPath, prettyPrintJSON(allStakerOutputs), 'utf-8');
   }
 
-  const outputData = !_mnemonic && !shouldEncryptKeystores ? { ...keystore, generatedMnemonic: mnemonic } : keystore;
+  const blsKeyCandidates = getBlsKeyCandidates(summaries);
+  const outputData = {
+    ...keystore,
+    ...(!_mnemonic && !shouldEncryptKeystores ? { generatedMnemonic: mnemonic } : {}),
+    ...(blsKeyCandidates.length > 0 ? { blsKeyCandidates } : {}),
+  };
 
   // Handle JSON output
   if (json) {

package/src/cmds/validator_keys/shared.ts

@@ -1,6 +1,6 @@
 import { prettyPrintJSON } from '@aztec-labs/cli/utils';
 import { asyncPool } from '@aztec-labs/foundation/async-pool';
-import { deriveBlsPrivateKey } from '@aztec-labs/foundation/crypto/bls';
+import { getEnv } from '@aztec-labs/foundation/config/env';
 import { createBn254Keystore } from '@aztec-labs/foundation/crypto/bls/bn254_keystore';
 import { computeBn254G1PublicKeyCompressed } from '@aztec-labs/foundation/crypto/bn254';
 import { EthAddress } from '@aztec-labs/foundation/eth-address';
@@ -8,6 +8,7 @@ import type { LogFn } from '@aztec-labs/foundation/log';
 import type { EthAccount, EthPrivateKey, ValidatorKeyStore } from '@aztec-labs/node-keystore/types';
 import type { AztecAddress } from '@aztec-labs/stdlib/aztec-address';
 import { Wallet } from '@ethersproject/wallet';
+import { Buffer } from 'buffer';
 import { constants as fsConstants, mkdirSync } from 'fs';
 import { access, writeFile } from 'fs/promises';
 import { availableParallelism, homedir } from 'os';
@@ -15,6 +16,12 @@ import { dirname, isAbsolute, join } from 'path';
 import { mnemonicToAccount } from 'viem/accounts';
 import { Worker } from 'worker_threads';
 
+import {
+  type BlsKeyDerivationPolicy,
+  type GeneratedMnemonic,
+  resolveBlsKeyDerivationPolicy,
+  selectBlsKey,
+} from './bls_key_derivation.js';
 import { defaultBlsPath } from './utils.js';
 
 type EthJsonV3WorkerResult = { json: string } | { error: { message: string; name?: string; stack?: string } };
@@ -59,13 +66,23 @@ function encryptEthJsonV3InWorker(privateKeyHex: string, password: string): Prom
 }
 
 async function encryptEthJsonV3(privateKeyHex: string, password: string): Promise<string> {
-  if (process.env.JEST_WORKER_ID !== undefined) {
+  if (getEnv().JEST_WORKER_ID !== undefined) {
     return await new Wallet(privateKeyHex).encrypt(password);
   }
   return await encryptEthJsonV3InWorker(privateKeyHex, password);
 }
 
-export type ValidatorSummary = { attesterEth?: string; attesterBls?: string; publisherEth?: string[] };
+export type ValidatorSummary = {
+  attesterEth?: string;
+  attesterBls?: string;
+  /** Derivation path of the BLS key, including the candidate component when the candidate is not 0. */
+  blsPath?: string;
+  /** Candidate selected by the BLS key derivation policy; 0 unless a retry picked another one. */
+  blsCandidate?: number;
+  /** The `--bls-key-derivation-max-gas` budget, when it took part in selecting a candidate other than 0. */
+  blsMaxGas?: number;
+  publisherEth?: string[];
+};
 
 export type BuildValidatorsInput = {
   validatorCount: number;
@@ -79,12 +96,16 @@ export type BuildValidatorsInput = {
   feeRecipient: AztecAddress;
   coinbase?: EthAddress;
   remoteSigner?: string;
+  /** Defaults to the policy used when no BLS key derivation flag is given. */
+  blsKeyDerivation?: BlsKeyDerivationPolicy;
+  /** Set when the CLI generated `mnemonic` in this run. */
+  generatedMnemonic?: GeneratedMnemonic;
 };
 
 export function withValidatorIndex(path: string, accountIndex: number = 0, addressIndex: number = 0) {
   // NOTE: The legacy BLS CLI is to allow users who generated keys in 2.1.4 to be able to use the same command
   // to re-generate their keys. In 2.1.5 we switched how we append addresses to the path so this is to maintain backwards compatibility.
-  const useLegacyBlsCli = ['true', '1', 'yes', 'y'].includes(process.env.LEGACY_BLS_CLI ?? '');
+  const useLegacyBlsCli = ['true', '1', 'yes', 'y'].includes(getEnv().LEGACY_BLS_CLI ?? '');
 
   const defaultBlsPathParts = defaultBlsPath.split('/');
 
@@ -153,6 +174,8 @@ export async function buildValidatorEntries(input: BuildValidatorsInput) {
     feeRecipient,
     coinbase,
     remoteSigner,
+    blsKeyDerivation = resolveBlsKeyDerivationPolicy({}),
+    generatedMnemonic,
   } = input;
 
   const summaries: ValidatorSummary[] = [];
@@ -163,7 +186,11 @@ export async function buildValidatorEntries(input: BuildValidatorsInput) {
       const basePath = blsPath ?? defaultBlsPath;
       const perValidatorPath = withValidatorIndex(basePath, accountIndex, addressIndex);
 
-      const blsPrivKey = ikm || mnemonic ? deriveBlsPrivateKey(mnemonic, ikm, perValidatorPath) : undefined;
+      const blsKey =
+        ikm || mnemonic
+          ? selectBlsKey(blsKeyDerivation, { mnemonic, ikm, perValidatorPath, generatedMnemonic })
+          : undefined;
+      const blsPrivKey = blsKey?.privateKey;
       const blsPubCompressed = blsPrivKey ? await computeBlsPublicKeyCompressed(blsPrivKey) : undefined;
 
       const ethAttester = deriveEthAttester(mnemonic, accountIndex, addressIndex, remoteSigner);
@@ -198,6 +225,9 @@ export async function buildValidatorEntries(input: BuildValidatorsInput) {
       summaries.push({
         attesterEth: attesterEthAddress,
         attesterBls: blsPubCompressed,
+        blsPath: blsKey?.path,
+        blsCandidate: blsKey?.candidate,
+        blsMaxGas: blsKey?.maxGas,
         publisherEth: publisherAddresses.length > 0 ? publisherAddresses : undefined,
       });
 
@@ -252,6 +282,10 @@ export function logValidatorSummaries(log: LogFn, summaries: ValidatorSummary[])
     if (v.attesterBls) {
       lines.push(`    bls: ${v.attesterBls}`);
     }
+    if (v.blsCandidate) {
+      const maxGas = v.blsMaxGas !== undefined ? `, max gas ${v.blsMaxGas}` : '';
+      lines.push(`    bls derivation path: ${v.blsPath} (candidate ${v.blsCandidate}${maxGas})`);
+    }
     if (v.publisherEth && v.publisherEth.length > 0) {
       lines.push(`  publisher:`);
       for (const addr of v.publisherEth) {
@@ -259,11 +293,35 @@ export function logValidatorSummaries(log: LogFn, summaries: ValidatorSummary[])
       }
     }
   }
+  if (summaries.some(v => v.blsCandidate)) {
+    lines.push(
+      'Some BLS keys were derived from a retry candidate (see "bls derivation path" above).',
+      'To regenerate them from the mnemonic, re-run with --bls-key-derivation-v6 and the same --bls-key-derivation-max-gas, if any.',
+    );
+  }
   if (lines.length > 0) {
     log(lines.join('\n'));
   }
 }
 
+/** BLS keys in `summaries` that came from a retry candidate, for reporting alongside JSON output. */
+export function getBlsKeyCandidates(summaries: ValidatorSummary[]) {
+  return summaries
+    .filter(v => v.blsCandidate)
+    .map(v => ({
+      attesterEth: v.attesterEth,
+      bls: v.attesterBls,
+      path: v.blsPath,
+      candidate: v.blsCandidate,
+      ...(v.blsMaxGas !== undefined ? { maxGas: v.blsMaxGas } : {}),
+    }));
+}
+
+/** Derivation path of each BLS key in `summaries`, keyed by its compressed public key. */
+export function getBlsDerivationPaths(summaries: ValidatorSummary[]): Map<string, string> {
+  return new Map(summaries.flatMap(v => (v.attesterBls && v.blsPath ? [[v.attesterBls, v.blsPath] as const] : [])));
+}
+
 export function maybePrintJson(log: LogFn, jsonFlag: boolean | undefined, obj: unknown) {
   if (jsonFlag) {
     log(prettyPrintJSON(obj as Record<string, any>));
@@ -300,10 +358,14 @@ export async function writeBn254BlsKeystore(
   return outPath;
 }
 
-/** Replace plaintext BLS keys in validators with { path, password } pointing to BN254 keystore files. */
+/**
+ * Replace plaintext BLS keys in validators with { path, password } pointing to BN254 keystore files. Each file records
+ * the key's derivation path from `derivationPaths` (keyed by compressed public key), or an empty path for keys missing
+ * from it, such as keys that were already in a keystore file, whose origin is unknown.
+ */
 export async function writeBlsBn254ToFile(
   validators: ValidatorKeyStore[],
-  options: { outDir: string; password: string; blsPath?: string },
+  options: { outDir: string; password: string; derivationPaths?: Map<string, string> },
 ): Promise<void> {
   await Promise.all(
     validators.map(async (v, i) => {
@@ -319,7 +381,7 @@ export async function writeBlsBn254ToFile(
       }
 
       const pub = await computeBlsPublicKeyCompressed(blsKey);
-      const path = options.blsPath ?? defaultBlsPath;
+      const path = options.derivationPaths?.get(pub) ?? '';
       const fileBase = `${String(i + 1)}_${pub.slice(2, 18)}`;
       const keystorePath = await writeBn254BlsKeystore(options.outDir, fileBase, options.password, blsKey, pub, path);
 

package/src/cmds/validator_keys/staker.ts

@@ -1,4 +1,11 @@
+import { GSEAbi } from '@aztec-foundation/l1-artifacts/GSEAbi';
+
 import { prettyPrintJSON } from '@aztec-labs/cli/utils';
+import {
+  AMSTERDAM_PROOF_OF_POSSESSION_GAS_MODEL,
+  computeBn254RegistrationDigest,
+  estimateProofOfPossessionGas,
+} from '@aztec-labs/ethereum/bn254';
 import { createEthereumChain } from '@aztec-labs/ethereum/chain';
 import { GSEContract } from '@aztec-labs/ethereum/contracts';
 import { decryptBn254Keystore } from '@aztec-labs/foundation/crypto/bls/bn254_keystore';
@@ -21,6 +28,8 @@ import { basename, dirname, join } from 'path';
 import { createPublicClient, fallback, http } from 'viem';
 import { privateKeyToAddress } from 'viem/accounts';
 
+import { LATEST_BLS_KEY_DERIVATION } from './bls_key_derivation.js';
+
 export type StakerOptions = {
   from: string;
   password?: string;
@@ -247,6 +256,51 @@ export async function processAttesterAccounts(
   return result ? [result] : [];
 }
 
+/**
+ * Throws when registering any of `outputs` could fail because the proof-of-possession check of its BLS key is estimated
+ * to need more gas than the GSE gives it. Governance sets that limit and can change it, so it is read from L1.
+ */
+export async function assertWithinProofOfPossessionGasLimit(gse: GSEContract, outputs: StakerOutput[]): Promise<void> {
+  const gasLimit = Number(
+    await gse.client.readContract({
+      address: gse.address.toString(),
+      abi: GSEAbi,
+      functionName: 'proofOfPossessionGasLimit',
+    }),
+  );
+
+  const overLimit = outputs
+    .map(output => {
+      const { attempts, sqrtCalls } = computeBn254RegistrationDigest({
+        x: BigInt(output.publicKeyG1.x),
+        y: BigInt(output.publicKeyG1.y),
+      });
+      return {
+        attester: output.attester,
+        estimatedGas: estimateProofOfPossessionGas(AMSTERDAM_PROOF_OF_POSSESSION_GAS_MODEL, attempts, sqrtCalls),
+      };
+    })
+    .filter(({ estimatedGas }) => estimatedGas > gasLimit);
+  if (overLimit.length === 0) {
+    return;
+  }
+
+  // Leave the same 10% margin below the limit that the derivation version budgets leave below the cap they target.
+  const { version, budget } = LATEST_BLS_KEY_DERIVATION;
+  const maxGas = Math.floor(gasLimit * 0.9);
+  const flags =
+    maxGas < budget
+      ? `--bls-key-derivation-v${version} --bls-key-derivation-max-gas ${maxGas}`
+      : `--bls-key-derivation-v${version}`;
+  throw new Error(
+    `Registering these validators could fail: the GSE at ${gse.address} gives each proof-of-possession check ` +
+      `${gasLimit} gas, and the BLS keys of these attesters are estimated to need more: ` +
+      `${overLimit.map(({ attester, estimatedGas }) => `${attester} (estimated at ${estimatedGas} gas)`).join(', ')}. ` +
+      `To replace their BLS keys and keep their ETH keys, regenerate them with validator-keys new, the same mnemonic ` +
+      `or IKM and indices, and ${flags}.`,
+  );
+}
+
 /**
  * Main staker command function
  */
@@ -293,6 +347,8 @@ export async function generateStakerJson(options: StakerOptions, log: LogFn): Pr
     return;
   }
 
+  await assertWithinProofOfPossessionGasLimit(gse, allOutputs);
+
   // Write a single JSON file with all staker outputs
   const stakerOutputPath = join(outputDir, `${keystoreBaseName}_staker_output.json`);
   writeFileSync(stakerOutputPath, prettyPrintJSON(allOutputs), 'utf-8');

package/src/config/chain_l2_config.ts

@@ -1,3 +1,4 @@
+/* eslint-disable no-restricted-properties -- this module sets variables of the Node.js process */
 import type { NetworkNames } from '@aztec-labs/foundation/config';
 import { createLogger } from '@aztec-labs/foundation/log';
 import { type ConsensusEnvVar, checkConsensusEnvOverrides } from '@aztec-labs/stdlib/config';

package/src/config/enrich_env.ts

@@ -1,3 +1,4 @@
+/* eslint-disable no-restricted-properties -- this module sets variables of the Node.js process */
 import { EthAddress } from '@aztec-labs/aztec.js/addresses';
 import type { EnvVar } from '@aztec-labs/foundation/config';
 

package/src/config/get_l1_config.ts

@@ -2,6 +2,7 @@ import { getPublicClient } from '@aztec-labs/ethereum/client';
 import { RegistryContract } from '@aztec-labs/ethereum/contracts';
 import type { L1ContractAddresses } from '@aztec-labs/ethereum/l1-contract-addresses';
 import { getL1ContractsConfig } from '@aztec-labs/ethereum/queries';
+import { getEnv } from '@aztec-labs/foundation/config/env';
 import { EthAddress } from '@aztec-labs/foundation/eth-address';
 
 export async function getL1Config(
@@ -22,7 +23,7 @@ export async function getL1Config(
 }
 
 export async function getL1RollupAddressFromEnv(l1RpcUrls: string[], l1ChainId: number) {
-  const registryAddress = process.env.REGISTRY_CONTRACT_ADDRESS;
+  const registryAddress = getEnv().REGISTRY_CONTRACT_ADDRESS;
   if (!registryAddress || !EthAddress.isAddress(registryAddress)) {
     throw new Error(`Failed to extract registry address`);
   }

package/src/config/network_config.ts

@@ -1,4 +1,5 @@
 import { type NetworkConfig, NetworkConfigMapSchema, type NetworkNames } from '@aztec-labs/foundation/config';
+import { getEnv } from '@aztec-labs/foundation/config/env';
 import { readFile } from 'fs/promises';
 import { join } from 'path';
 
@@ -23,7 +24,7 @@ export async function getNetworkConfig(
   cacheDir?: string,
 ): Promise<NetworkConfig | undefined> {
   // Try with the primary URL (env var or default)
-  const configLocation = process.env.NETWORK_CONFIG_LOCATION || DEFAULT_CONFIG_URL;
+  const configLocation = getEnv().NETWORK_CONFIG_LOCATION || DEFAULT_CONFIG_URL;
 
   let primaryError: Error | undefined;
   let config: NetworkConfig | undefined;
@@ -119,7 +120,8 @@ export async function enrichEnvironmentWithNetworkConfig(networkName: NetworkNam
     return; // No remote config for local development
   }
 
-  const cacheDir = process.env.DATA_DIRECTORY ? join(process.env.DATA_DIRECTORY, 'cache') : undefined;
+  const { DATA_DIRECTORY } = getEnv();
+  const cacheDir = DATA_DIRECTORY ? join(DATA_DIRECTORY, 'cache') : undefined;
   const networkConfig = await getNetworkConfig(networkName, cacheDir);
 
   if (!networkConfig) {

package/src/utils/aztec.ts

@@ -15,6 +15,7 @@ import { type LogFn, createLogger } from '@aztec-labs/foundation/log';
 import type { NoirPackageConfig } from '@aztec-labs/foundation/noir';
 import { protocolContractsHash } from '@aztec-labs/protocol-contracts';
 import TOML from '@iarna/toml';
+import { Buffer } from 'buffer';
 import { readFile } from 'fs/promises';
 import type { HDAccount, Hex, PrivateKeyAccount } from 'viem';
 

package/src/utils/commands.ts

@@ -1,3 +1,4 @@
+import { getEnv } from '@aztec-labs/foundation/config/env';
 import { Fr } from '@aztec-labs/foundation/curves/bn254';
 import { GrumpkinScalar } from '@aztec-labs/foundation/curves/grumpkin';
 import { EthAddress } from '@aztec-labs/foundation/eth-address';
@@ -8,6 +9,7 @@ import { AztecAddress } from '@aztec-labs/stdlib/aztec-address';
 import { PublicKeys } from '@aztec-labs/stdlib/keys';
 import { LogCursor, Tag } from '@aztec-labs/stdlib/logs';
 import { TxHash } from '@aztec-labs/stdlib/tx/tx-hash';
+import { Buffer } from 'buffer';
 import { type Command, CommanderError, InvalidArgumentError, Option } from 'commander';
 import { lookup } from 'dns/promises';
 import { rename, writeFile } from 'fs/promises';
@@ -24,7 +26,7 @@ export const getLocalhost = () =>
     .catch(() => 'localhost');
 
 export const LOCALHOST = await getLocalhost();
-export const { ETHEREUM_HOSTS = `http://${LOCALHOST}:8545`, PRIVATE_KEY, MNEMONIC, API_KEY, CLI_VERSION } = process.env;
+export const { ETHEREUM_HOSTS = `http://${LOCALHOST}:8545`, PRIVATE_KEY, MNEMONIC, API_KEY, CLI_VERSION } = getEnv();
 
 export function addOptions(program: Command, options: Option[]) {
   options.forEach(option => program.addOption(option));

package/src/utils/encoding.ts

@@ -1,5 +1,6 @@
 import { Fr } from '@aztec-labs/foundation/curves/bn254';
 import type { ABIParameter, AbiType, StructType } from '@aztec-labs/stdlib/abi';
+import { Buffer } from 'buffer';
 
 /**
  * Parses a hex string into an ABI struct type.