@aztec/end-to-end 0.0.1-commit.d3ec352c → 0.0.1-commit.d58ff9d0

package/src/automine/contracts/fixtures/storage_proof_fetcher.ts

@@ -0,0 +1,190 @@
+/**
+ * Fetches a ERC20 balance storage proof from the Ethereum mainnet and saves it to a Prover.toml compatible JSON.
+ * The JSON can be converted to toml for use with nargo, or used directly as a JSON file when used in
+ * Aztec contracts. This script is not using any Aztec library code, so it's easily portable.
+ */
+import fs from 'fs';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+import { createPublicClient, encodeAbiParameters, fromRlp, hexToBytes, http, keccak256 } from 'viem';
+import { mainnet } from 'viem/chains';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+const RPC_URL = process.env.RPC_URL;
+const ERC20_CONTRACT = (process.env.ERC20_CONTRACT || '0xdAC17F958D2ee523a2206206994597C13D831ec7') as `0x${string}`;
+const HOLDER = (process.env.HOLDER || '0x23878914EFE38d27C4D67Ab83ed1b93A74D4086a') as `0x${string}`;
+const SLOT = BigInt(process.env.SLOT || '2');
+const BLOCK_TAG = process.env.BLOCK_NUMBER ? BigInt(process.env.BLOCK_NUMBER) : 'latest';
+const MAX_ACCOUNT_PATH = 15;
+const MAX_STORAGE_PATH = 10;
+
+function padTo(arr: number[], len: number) {
+  return [...arr, ...Array(len - arr.length).fill(0)].slice(0, len);
+}
+
+function toBytes(hex: `0x${string}`) {
+  return Array.from(hexToBytes(hex));
+}
+
+function bytesToU64s(bytes: number[]) {
+  const paddedBytes = padTo(bytes, 32);
+  return Array.from({ length: 4 }, (_, i) => {
+    let val = 0n;
+    for (let j = 0; j < 8; j++) {
+      val += BigInt(paddedBytes[i * 8 + j]) << BigInt(j * 8);
+    }
+    return val.toString();
+  });
+}
+
+function toBytesAndLen(val: bigint | number) {
+  if (val === 0n || val === 0) {
+    return { bytes: [0], length: 0 };
+  }
+  let hex = val.toString(16);
+  if (hex.length % 2) {
+    hex = '0' + hex;
+  }
+  const bytes = toBytes(`0x${hex}`);
+  return { bytes, length: bytes.length };
+}
+
+function parseNode(rlp: `0x${string}`) {
+  // Should be safe when working with branches and extensions without embedded children.
+  const decoded = fromRlp(rlp) as `0x${string}`[];
+  const node = {
+    rows: Array(16)
+      .fill(0)
+      .map(() => Array(32).fill(0)),
+    row_exist: Array(16).fill(false),
+    node_type: 0,
+  };
+
+  if (decoded.length === 17) {
+    for (let i = 0; i < 16; i++) {
+      if (decoded[i] !== '0x') {
+        node.row_exist[i] = true;
+        node.rows[i] = padTo(toBytes(decoded[i]), 32);
+      }
+    }
+  } else if (decoded.length === 2) {
+    const keyBytes = toBytes(decoded[0]);
+    const prefix = keyBytes[0];
+    if (prefix >> 4 >= 2) {
+      throw new Error('Unsupported: leaf node in proof path');
+    }
+    node.node_type = 1;
+    // Extension header format expected by the noir code: check out storage_proof types.nr.
+    node.rows[0][0] = prefix >> 4;
+    node.rows[0][8] = prefix & 0x0f;
+    node.rows[0][16] = keyBytes.length - 1;
+
+    for (let i = 1; i < keyBytes.length && i < 32; i++) {
+      node.rows[1][i - 1] = keyBytes[i];
+    }
+    node.rows[2] = padTo(toBytes(decoded[1]), 32);
+    node.row_exist[0] = node.row_exist[1] = node.row_exist[2] = true;
+  }
+  return node;
+}
+
+function parseProof(proof: `0x${string}`[], maxLen: number) {
+  const nodes = proof.slice(0, -1).slice(0, maxLen).map(parseNode);
+  while (nodes.length < maxLen) {
+    nodes.push({
+      rows: Array(16)
+        .fill(0)
+        .map(() => Array(32).fill(0)),
+      row_exist: Array(16).fill(false),
+      node_type: 0,
+    });
+  }
+  return nodes;
+}
+
+function nodeToLibFormat(node: { rows: number[][]; row_exist: boolean[]; node_type: number }) {
+  return {
+    rows: node.rows.map(bytesToU64s),
+    row_exist: node.row_exist,
+    node_type: String(node.node_type),
+  };
+}
+
+async function main() {
+  if (!RPC_URL) {
+    throw new Error('RPC_URL is not set');
+  }
+  const storageKey = keccak256(encodeAbiParameters([{ type: 'address' }, { type: 'uint256' }], [HOLDER, SLOT]));
+  console.log(`Fetching storage proof for ${ERC20_CONTRACT}, holder ${HOLDER}, slot ${SLOT}`);
+  console.log(`Storage key: ${storageKey}`);
+
+  const client = createPublicClient({
+    chain: mainnet,
+    transport: http(RPC_URL),
+  });
+
+  const [blockNumber, proof, block] = await Promise.all([
+    client.getBlockNumber(),
+    client.getProof({
+      address: ERC20_CONTRACT,
+      storageKeys: [storageKey],
+      blockNumber: BLOCK_TAG === 'latest' ? undefined : BLOCK_TAG,
+    }),
+    client.getBlock({
+      blockNumber: BLOCK_TAG === 'latest' ? undefined : BLOCK_TAG,
+    }),
+  ]);
+
+  const storageProof = proof.storageProof[0];
+  console.log(
+    `Block: ${blockNumber}, Account nodes: ${proof.accountProof.length}, Storage nodes: ${storageProof.proof.length}`,
+  );
+  console.log(`Value: ${storageProof.value}`);
+
+  // The -1 is because the last node in the proof is the leaf, which is excluded from path verification.
+  const accountPathLen = proof.accountProof.length - 1;
+  const storagePathLen = storageProof.proof.length - 1;
+  if (accountPathLen > MAX_ACCOUNT_PATH) {
+    throw new Error(
+      `Account proof path length ${accountPathLen} exceeds MAX_ACCOUNT_PATH ${MAX_ACCOUNT_PATH}. Increase the limit.`,
+    );
+  }
+  if (storagePathLen > MAX_STORAGE_PATH) {
+    throw new Error(
+      `Storage proof path length ${storagePathLen} exceeds MAX_STORAGE_PATH ${MAX_STORAGE_PATH}. Increase the limit.`,
+    );
+  }
+
+  const nonce = toBytesAndLen(proof.nonce);
+  const balance = toBytesAndLen(proof.balance);
+  const slotValue = toBytesAndLen(storageProof.value);
+
+  const data = {
+    account_nodes: parseProof(proof.accountProof, MAX_ACCOUNT_PATH).map(nodeToLibFormat),
+    account_node_length: String(accountPathLen),
+    storage_nodes: parseProof(storageProof.proof, MAX_STORAGE_PATH).map(nodeToLibFormat),
+    storage_node_length: String(storagePathLen),
+    account: {
+      nonce: padTo(nonce.bytes, 8).map(String),
+      nonce_length: String(nonce.length),
+      balance: padTo(balance.bytes, 32).map(String),
+      balance_length: String(balance.length),
+      address: toBytes(ERC20_CONTRACT).map(String),
+      storage_hash: bytesToU64s(toBytes(proof.storageHash)),
+      code_hash: bytesToU64s(toBytes(proof.codeHash)),
+    },
+    slot: {
+      value: padTo(slotValue.bytes, 32).map(String),
+      value_length: String(slotValue.length),
+    },
+    slot_key: toBytes(storageKey).map(String),
+    root: bytesToU64s(toBytes(block.stateRoot)),
+    block_number: String(blockNumber),
+  };
+
+  fs.writeFileSync(join(__dirname, 'storage_proof.json'), JSON.stringify(data, null, 2));
+  console.log('storage_proof.json generated');
+}
+
+main().catch(console.error);

package/src/automine/contracts/fixtures/storage_proof_fixture.ts

@@ -0,0 +1,173 @@
+import type { AztecAddress } from '@aztec/aztec.js/addresses';
+import { poseidon2Hash } from '@aztec/foundation/crypto/poseidon';
+import { Fr } from '@aztec/foundation/curves/bn254';
+import { EthAddress } from '@aztec/foundation/eth-address';
+import { Capsule } from '@aztec/stdlib/tx';
+
+import { readFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const FIXTURE_PATH = join(__dirname, './storage_proof.json');
+
+// Constants matching the Noir contract
+const ACCOUNT_CAPSULE_KEY_SEPARATOR = 100;
+const ACCOUNT_PROOF_CAPSULE_KEY_SEPARATOR = 101;
+const STORAGE_PROOF_CAPSULE_KEY_SEPARATOR = 102;
+const STORAGE_PROOF_NODE_CAPSULE_KEY_SEPARATOR = 103;
+const MAX_ACCOUNT_PROOF_LENGTH = 15;
+/** Node: rows [[u64;4];16] (64) + row_exist [bool;16] (16) + node_type u8 (1) = 81 fields */
+const NODE_FIELD_COUNT = 81;
+
+// --- JSON fixture types ---
+
+type JsonNode = { rows: string[][]; row_exist: boolean[]; node_type: string };
+
+type JsonAccount = {
+  nonce: string[];
+  balance: string[];
+  address: string[];
+  nonce_length: string;
+  balance_length: string;
+  storage_hash: string[];
+  code_hash: string[];
+};
+
+type StorageProofJSON = {
+  root: string[];
+  slot_key: string[];
+  account_node_length: string;
+  storage_node_length: string;
+  account_nodes: JsonNode[];
+  storage_nodes: JsonNode[];
+  account: JsonAccount;
+  slot: { value: string[]; value_length: string };
+};
+
+// --- Serialization helpers (Noir struct Serialize layout) ---
+
+function serializeNode(node: JsonNode): Fr[] {
+  const fields: Fr[] = [];
+  for (const row of node.rows) {
+    for (const val of row) {
+      fields.push(new Fr(BigInt(val)));
+    }
+  }
+  for (const exists of node.row_exist) {
+    fields.push(new Fr(exists ? 1n : 0n));
+  }
+  fields.push(new Fr(BigInt(node.node_type)));
+  return fields;
+}
+
+/** Account: nonce [u8;8] + balance [u8;32] + address [u8;20] + nonce_length u8 + balance_length u8 + storage_hash [u64;4] + code_hash [u64;4] = 70 fields */
+function serializeAccount(account: JsonAccount): Fr[] {
+  const fields: Fr[] = [];
+  for (const v of account.nonce) {
+    fields.push(new Fr(BigInt(v)));
+  }
+  for (const v of account.balance) {
+    fields.push(new Fr(BigInt(v)));
+  }
+  for (const v of account.address) {
+    fields.push(new Fr(BigInt(v)));
+  }
+  fields.push(new Fr(BigInt(account.nonce_length)));
+  fields.push(new Fr(BigInt(account.balance_length)));
+  for (const v of account.storage_hash) {
+    fields.push(new Fr(BigInt(v)));
+  }
+  for (const v of account.code_hash) {
+    fields.push(new Fr(BigInt(v)));
+  }
+  return fields;
+}
+
+function zeroNode(): Fr[] {
+  return Array(NODE_FIELD_COUNT).fill(Fr.ZERO);
+}
+
+// --- Public API ---
+
+/** Parsed + typed fixture data ready for use as contract function arguments. */
+export type StorageProofArgs = {
+  ethAddress: EthAddress;
+  slotKey: number[];
+  slotContents: { value: number[]; value_length: number };
+  root: bigint[];
+};
+
+/** Loads the storage proof fixture from disk and returns the contract args. */
+export function loadStorageProofArgs(): StorageProofArgs {
+  const fixture: StorageProofJSON = JSON.parse(readFileSync(FIXTURE_PATH, 'utf8'));
+  const addressBytes = Buffer.from(fixture.account.address.map(v => Number(v)));
+  return {
+    ethAddress: EthAddress.fromString('0x' + addressBytes.toString('hex')),
+    slotKey: fixture.slot_key.map(v => Number(v)),
+    slotContents: {
+      value: fixture.slot.value.map(v => Number(v)),
+      // eslint-disable-next-line camelcase
+      value_length: Number(fixture.slot.value_length),
+    },
+    root: fixture.root.map(v => BigInt(v)),
+  };
+}
+
+/** Builds all the capsules the StorageProofTest contract expects during private execution. */
+export async function buildStorageProofCapsules(contractAddress: AztecAddress): Promise<Capsule[]> {
+  const fixture: StorageProofJSON = JSON.parse(readFileSync(FIXTURE_PATH, 'utf8'));
+
+  const root = fixture.root.map(v => BigInt(v));
+  const slotKey = fixture.slot_key.map(v => Number(v));
+  const accountNodeLength = Number(fixture.account_node_length);
+  const storageNodeLength = Number(fixture.storage_node_length);
+  const ethAddress = EthAddress.fromBuffer(Buffer.from(fixture.account.address.map(v => Number(v))));
+
+  // Compute capsule keys (must match the Noir contract's poseidon2_hash computations)
+  const addressCapsuleKey = await poseidon2Hash([
+    new Fr(ACCOUNT_CAPSULE_KEY_SEPARATOR),
+    ...root.map(v => new Fr(v)),
+    ethAddress.toField(),
+  ]);
+
+  const accountProofCapsuleKey = await poseidon2Hash([new Fr(ACCOUNT_PROOF_CAPSULE_KEY_SEPARATOR), addressCapsuleKey]);
+
+  const storageProofCapsuleKey = await poseidon2Hash([
+    new Fr(STORAGE_PROOF_CAPSULE_KEY_SEPARATOR),
+    addressCapsuleKey,
+    ...slotKey.map(v => new Fr(v)),
+  ]);
+
+  // Build capsule data
+
+  // 1. Account data
+  const accountData = serializeAccount(fixture.account);
+
+  // 2. Account proof nodes padded to MAX_ACCOUNT_PROOF_LENGTH
+  const accountProofData: Fr[] = [new Fr(accountNodeLength)];
+  for (let i = 0; i < MAX_ACCOUNT_PROOF_LENGTH; i++) {
+    accountProofData.push(...(i < fixture.account_nodes.length ? serializeNode(fixture.account_nodes[i]) : zeroNode()));
+  }
+
+  // 3. Storage proof length (u32)
+  const storageProofLengthData = [new Fr(storageNodeLength)];
+
+  const capsules: Capsule[] = [
+    new Capsule(contractAddress, addressCapsuleKey, accountData),
+    new Capsule(contractAddress, accountProofCapsuleKey, accountProofData),
+    new Capsule(contractAddress, storageProofCapsuleKey, storageProofLengthData),
+  ];
+
+  // 4. Individual storage node capsules for private recursion.
+  for (let i = 0; i < storageNodeLength; i++) {
+    const nodeCapsuleKey = await poseidon2Hash([
+      new Fr(STORAGE_PROOF_NODE_CAPSULE_KEY_SEPARATOR),
+      storageProofCapsuleKey,
+      new Fr(i),
+    ]);
+    capsules.push(new Capsule(contractAddress, nodeCapsuleKey, serializeNode(fixture.storage_nodes[i])));
+  }
+
+  return capsules;
+}

package/src/automine/delivery/interactive_handshake_responder.ts

@@ -0,0 +1,125 @@
+import { AztecAddress, type CompleteAddress } from '@aztec/aztec.js/addresses';
+import { DomainSeparator } from '@aztec/constants';
+import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
+import { Schnorr, type SchnorrSignature } from '@aztec/foundation/crypto/schnorr';
+import { Fq, Fr } from '@aztec/foundation/curves/bn254';
+import type { GrumpkinScalar } from '@aztec/foundation/curves/grumpkin';
+import type { CustomRequest } from '@aztec/pxe/config';
+import {
+  INTERACTIVE_HANDSHAKE_REQUEST_KIND,
+  STANDARD_HANDSHAKE_REGISTRY_ADDRESS,
+} from '@aztec/standard-contracts/handshake-registry/constants';
+import { type PublicKeys, derivePublicKeyFromSecretKey } from '@aztec/stdlib/keys';
+
+/**
+ * The decoded payload of the registry's interactive-handshake signature request. Note it never carries the sender,
+ * so the recipient authorizes the handshake without learning who initiated it.
+ */
+export type InteractiveHandshakeRequest = {
+  /** The account whose authorization is being requested. */
+  recipient: AztecAddress;
+  chainId: Fr;
+  version: Fr;
+  /** The x-coordinate of the handshake's ephemeral public key (its y-coordinate is positive by construction). */
+  ephPkX: Fr;
+};
+
+/**
+ * The recipient's signed authorization for an interactive handshake. Mirrors the registry contract's
+ * `RecipientSignature` struct field for field.
+ */
+export type RecipientSignature = {
+  /** The recipient's master public keys, bound in-circuit to the recipient's address via `partialAddress`. */
+  publicKeys: PublicKeys;
+  partialAddress: Fr;
+  /** The x-coordinate of the recipient's master message-signing public key. */
+  mspkX: Fr;
+  /** Whether that key's y-coordinate is positive, so the circuit can reconstruct the point from `mspkX`. */
+  mspkYIsPositive: boolean;
+  /** The schnorr signature over the handshake message. */
+  signature: SchnorrSignature;
+};
+
+/**
+ * Parses and validates the registry's interactive-handshake signature request.
+ *
+ * @throws If the request kind is not {@link INTERACTIVE_HANDSHAKE_REQUEST_KIND}, the issuing contract is not the
+ * standard HandshakeRegistry, or the payload does not have the expected shape.
+ */
+export function parseInteractiveHandshakeRequest(request: CustomRequest): InteractiveHandshakeRequest {
+  if (!request.kind.equals(INTERACTIVE_HANDSHAKE_REQUEST_KIND)) {
+    throw new Error(`Not an interactive-handshake signature request: unexpected kind ${request.kind}`);
+  }
+  if (!request.contractAddress.equals(STANDARD_HANDSHAKE_REGISTRY_ADDRESS)) {
+    throw new Error(
+      `Interactive-handshake signature request issued by ${request.contractAddress}, expected the standard HandshakeRegistry at ${STANDARD_HANDSHAKE_REGISTRY_ADDRESS}`,
+    );
+  }
+  if (request.payload.length !== 4) {
+    throw new Error(`Interactive-handshake signature request payload has ${request.payload.length} fields, expected 4`);
+  }
+
+  const [recipient, chainId, version, ephPkX] = request.payload;
+  return { recipient: new AztecAddress(recipient), chainId, version, ephPkX };
+}
+
+/**
+ * Produces the recipient's signed authorization for an interactive handshake, signing with the master
+ * message-signing secret key.
+ */
+export async function signInteractiveHandshake(
+  request: InteractiveHandshakeRequest,
+  completeAddress: CompleteAddress,
+  masterMessageSigningSecretKey: GrumpkinScalar,
+): Promise<RecipientSignature> {
+  const mspk = await derivePublicKeyFromSecretKey(masterMessageSigningSecretKey);
+  const [mspkX, mspkYIsPositive] = mspk.toXAndSign();
+
+  const message = await computeInteractiveHandshakeSignatureMessage({
+    chainId: request.chainId,
+    version: request.version,
+    registry: STANDARD_HANDSHAKE_REGISTRY_ADDRESS,
+    ephPkX: request.ephPkX,
+  });
+  const signature = await new Schnorr().constructSignature(message, masterMessageSigningSecretKey);
+
+  return {
+    publicKeys: completeAddress.publicKeys,
+    partialAddress: completeAddress.partialAddress,
+    mspkX,
+    mspkYIsPositive,
+    signature,
+  };
+}
+
+/** Serializes a {@link RecipientSignature} to the field layout the registry's in-circuit deserialization expects. */
+export function recipientSignatureToFields(recipientSignature: RecipientSignature): Fr[] {
+  const s = Fq.fromBuffer(recipientSignature.signature.s);
+  const e = Fq.fromBuffer(recipientSignature.signature.e);
+  return [
+    ...recipientSignature.publicKeys.toFields(),
+    recipientSignature.partialAddress,
+    recipientSignature.mspkX,
+    new Fr(recipientSignature.mspkYIsPositive),
+    s.lo,
+    s.hi,
+    e.lo,
+    e.hi,
+  ];
+}
+
+/**
+ * The message an interactive-handshake authorization signs: the handshake's ephemeral key and chain context under
+ * `DomainSeparator.INTERACTIVE_HANDSHAKE_SIGNATURE`, exactly as the registry recomputes it in-circuit.
+ */
+function computeInteractiveHandshakeSignatureMessage(args: {
+  chainId: Fr;
+  version: Fr;
+  registry: AztecAddress;
+  ephPkX: Fr;
+}): Promise<Fr> {
+  return poseidon2HashWithSeparator(
+    [args.chainId, args.version, args.registry, args.ephPkX],
+    DomainSeparator.INTERACTIVE_HANDSHAKE_SIGNATURE,
+  );
+}