@aztec/simulator 0.0.1-commit.b655e406 → 0.0.1-commit.b8a057fa

package/src/public/fuzzing/avm_fuzzer_simulator.ts

@@ -0,0 +1,303 @@
+import {
+  MAX_ENQUEUED_CALLS_PER_TX,
+  MAX_L2_TO_L1_MSGS_PER_TX,
+  MAX_NOTE_HASHES_PER_TX,
+  MAX_NULLIFIERS_PER_TX,
+  MAX_PRIVATE_LOGS_PER_TX,
+  MAX_PROTOCOL_CONTRACTS,
+} from '@aztec/constants';
+import { padArrayEnd } from '@aztec/foundation/collection';
+import { Fr } from '@aztec/foundation/curves/bn254';
+import { AvmTxHint, type PublicTxResult } from '@aztec/stdlib/avm';
+import { AztecAddress } from '@aztec/stdlib/aztec-address';
+import { contractClassPublicFromPlainObject, contractInstanceWithAddressFromPlainObject } from '@aztec/stdlib/contract';
+import {
+  PartialPrivateTailPublicInputsForPublic,
+  PrivateKernelTailCircuitPublicInputs,
+  PrivateToPublicAccumulatedData,
+  PublicCallRequest,
+} from '@aztec/stdlib/kernel';
+import { PrivateLog } from '@aztec/stdlib/logs';
+import { ScopedL2ToL1Message } from '@aztec/stdlib/messaging';
+import { ChonkProof } from '@aztec/stdlib/proofs';
+import { MerkleTreeId, type MerkleTreeWriteOperations, PublicDataTreeLeaf } from '@aztec/stdlib/trees';
+import {
+  BlockHeader,
+  GlobalVariables,
+  HashedValues,
+  ProtocolContracts,
+  Tx,
+  TxConstantData,
+  TxContext,
+  TxHash,
+} from '@aztec/stdlib/tx';
+import type { NativeWorldStateService } from '@aztec/world-state';
+
+import { BaseAvmSimulationTester } from '../avm/testing/base_avm_simulation_tester.js';
+import { AvmSimulatorPool } from '../avm_simulator_pool.js';
+import { SimpleContractDataSource } from '../fixtures/simple_contract_data_source.js';
+import { PublicContractsDB } from '../public_db_sources.js';
+import { PublicTxSimulator } from '../public_tx_simulator/public_tx_simulator.js';
+
+/**
+ * Request structure for fuzzer simulation communication from C++.
+ * Matches the C++ FuzzerSimulationRequest struct
+ */
+export class FuzzerSimulationRequest {
+  constructor(
+    public readonly wsDataDir: string,
+    public readonly wsMapSizeKb: number,
+    public readonly tx: AvmTxHint,
+    public readonly globals: GlobalVariables,
+    public readonly contractClasses: any[], // Raw, processed by addContractClassFromCpp
+    public readonly contractInstances: [any, any][], // Raw pairs [address, instance]
+    public readonly publicDataWrites: any[], // Raw public data tree writes to apply before simulation
+    public readonly noteHashes: any[], // Raw note hashes to apply before simulation
+    public readonly protocolContracts: ProtocolContracts, // Protocol contracts mapping from C++
+  ) {}
+
+  static fromPlainObject(obj: any): FuzzerSimulationRequest {
+    if (obj instanceof FuzzerSimulationRequest) {
+      return obj;
+    }
+    return new FuzzerSimulationRequest(
+      obj.wsDataDir,
+      obj.wsMapSizeKb,
+      AvmTxHint.fromPlainObject(obj.tx),
+      GlobalVariables.fromPlainObject(obj.globals),
+      obj.contractClasses,
+      obj.contractInstances,
+      obj.publicDataWrites ?? [],
+      obj.noteHashes ?? [],
+      ProtocolContracts.fromPlainObject(obj.protocolContracts),
+    );
+  }
+}
+
+/**
+ * Creates a TypeScript Tx object from a deserialized C++ Tx (AvmTxHint-like structure).
+ * This allows simulating fuzzer-generated transactions with the C++ public tx simulator.
+ */
+async function createTxFromHint(cppTx: AvmTxHint): Promise<Tx> {
+  // Create TxHash from the C++ tx hash string
+  if (!cppTx.hash) {
+    throw new Error(`cppTx.hash is undefined. Keys: ${Object.keys(cppTx || {}).join(', ')}`);
+  }
+  const txHash = TxHash.fromString(cppTx.hash);
+
+  // Extract PublicCallRequest instances from enqueued calls
+  const setupCallRequests = cppTx.setupEnqueuedCalls.map(call => call.request);
+  const paddedSetupCalls = padArrayEnd(setupCallRequests, PublicCallRequest.empty(), MAX_ENQUEUED_CALLS_PER_TX);
+
+  const appLogicCallRequests = cppTx.appLogicEnqueuedCalls.map(call => call.request);
+  const paddedAppLogicCalls = padArrayEnd(appLogicCallRequests, PublicCallRequest.empty(), MAX_ENQUEUED_CALLS_PER_TX);
+
+  // Build non-revertible accumulated data from C++ tx
+  const emptyNonRevertible = PrivateToPublicAccumulatedData.empty();
+  const nonRevertibleAccumulatedData = new PrivateToPublicAccumulatedData(
+    padArrayEnd(cppTx.nonRevertibleAccumulatedData.noteHashes, Fr.ZERO, MAX_NOTE_HASHES_PER_TX),
+    padArrayEnd(cppTx.nonRevertibleAccumulatedData.nullifiers, Fr.ZERO, MAX_NULLIFIERS_PER_TX),
+    padArrayEnd(
+      cppTx.nonRevertibleAccumulatedData.l2ToL1Messages,
+      ScopedL2ToL1Message.empty(),
+      MAX_L2_TO_L1_MSGS_PER_TX,
+    ),
+    padArrayEnd(cppTx.nonRevertibleContractDeploymentData.privateLogs, PrivateLog.empty(), MAX_PRIVATE_LOGS_PER_TX),
+    emptyNonRevertible.contractClassLogsHashes,
+    paddedSetupCalls,
+  );
+
+  // Build revertible accumulated data from C++ tx
+  const emptyRevertible = PrivateToPublicAccumulatedData.empty();
+  const revertibleAccumulatedData = new PrivateToPublicAccumulatedData(
+    padArrayEnd(cppTx.revertibleAccumulatedData.noteHashes, Fr.ZERO, MAX_NOTE_HASHES_PER_TX),
+    padArrayEnd(cppTx.revertibleAccumulatedData.nullifiers, Fr.ZERO, MAX_NULLIFIERS_PER_TX),
+    padArrayEnd(cppTx.revertibleAccumulatedData.l2ToL1Messages, ScopedL2ToL1Message.empty(), MAX_L2_TO_L1_MSGS_PER_TX),
+    padArrayEnd(cppTx.revertibleContractDeploymentData.privateLogs, PrivateLog.empty(), MAX_PRIVATE_LOGS_PER_TX),
+    emptyRevertible.contractClassLogsHashes,
+    paddedAppLogicCalls,
+  );
+
+  // Build teardown call request (if exists)
+  const teardownCallRequest = cppTx.teardownEnqueuedCall?.request ?? PublicCallRequest.empty();
+
+  // Create forPublic structure
+  const forPublic = new PartialPrivateTailPublicInputsForPublic(
+    nonRevertibleAccumulatedData,
+    revertibleAccumulatedData,
+    teardownCallRequest,
+  );
+
+  // Build TxContext - gasSettings is already a proper GasSettings after AvmTxHint.fromPlainObject
+  const txContext = new TxContext(
+    Fr.ZERO, // chainId - this is fine because simulation actually reads from globalVariables not here
+    Fr.ZERO, // version - this is fine because simulation actually reads from globalVariables not here
+    cppTx.gasSettings,
+  );
+
+  // Build TxConstantData
+  const constants = new TxConstantData(
+    BlockHeader.empty(), // anchorBlockHeader (unused in simulation)
+    txContext,
+    Fr.ZERO, // vkTreeRoot - not needed for public simulation
+    Fr.ZERO, // protocolContractsHash - not needed for public simulation
+  );
+
+  const data = new PrivateKernelTailCircuitPublicInputs(
+    constants,
+    cppTx.gasUsedByPrivate,
+    cppTx.feePayer,
+    0n, // expirationTimestamp
+    forPublic,
+    undefined, // forRollup - not needed for public simulation
+  );
+
+  // Build publicFunctionCalldata from all enqueued calls
+  // Calldata is already Fr[] after AvmTxHint.fromPlainObject
+  const publicFunctionCalldata: HashedValues[] = [];
+
+  // Add setup calls
+  for (const call of cppTx.setupEnqueuedCalls || []) {
+    publicFunctionCalldata.push(await HashedValues.fromCalldata(call.calldata));
+  }
+
+  // Add app logic calls
+  for (const call of cppTx.appLogicEnqueuedCalls || []) {
+    publicFunctionCalldata.push(await HashedValues.fromCalldata(call.calldata));
+  }
+
+  // Add teardown call if present
+  if (cppTx.teardownEnqueuedCall) {
+    publicFunctionCalldata.push(await HashedValues.fromCalldata(cppTx.teardownEnqueuedCall.calldata));
+  }
+
+  // Extract contract class log fields from ContractDeploymentData
+  const contractClassLogFields = [
+    ...cppTx.nonRevertibleContractDeploymentData.contractClassLogs.map(log => log.fields),
+    ...cppTx.revertibleContractDeploymentData.contractClassLogs.map(log => log.fields),
+  ];
+
+  // Create the Tx
+  return new Tx(
+    txHash,
+    data,
+    ChonkProof.empty(), // No real proof needed for simulation
+    contractClassLogFields,
+    publicFunctionCalldata,
+  );
+}
+
+/**
+ * A simulator class for the AVM fuzzer that extends BaseAvmSimulationTester.
+ * It provides methods for registering contracts from C++ msgpack data and simulating transactions.
+ * The simulation itself runs on the production C++ AVM simulator, so the fuzzer compares brillig
+ * execution against the real AVM rather than a TS reference.
+ */
+export class AvmFuzzerSimulator extends BaseAvmSimulationTester {
+  private simulator: PublicTxSimulator;
+
+  constructor(
+    merkleTrees: MerkleTreeWriteOperations,
+    contractDataSource: SimpleContractDataSource,
+    globals: GlobalVariables,
+    private avmSimulator: AvmSimulatorPool,
+    contractsDB: PublicContractsDB,
+    forkId: number,
+  ) {
+    super(contractDataSource, merkleTrees);
+    // collectPublicInputs and collectCallMetadata are required so the C++ result carries the end
+    // tree snapshots and app-logic return values that the fuzzer bin reports back to the harness.
+    this.simulator = new PublicTxSimulator(
+      avmSimulator,
+      globals,
+      contractsDB,
+      forkId,
+      {
+        skipFeeEnforcement: false,
+        collectDebugLogs: false,
+        collectHints: false,
+        collectPublicInputs: true,
+        collectStatistics: false,
+        collectCallMetadata: true,
+      },
+      undefined,
+    );
+  }
+
+  /**
+   * Static factory method to create an AvmFuzzerSimulator.
+   */
+  public static async create(
+    worldStateService: NativeWorldStateService,
+    globals: GlobalVariables,
+  ): Promise<AvmFuzzerSimulator> {
+    const contractDataSource = new SimpleContractDataSource();
+    const merkleTrees = await worldStateService.fork();
+    const forkId = merkleTrees.getRevision().forkId;
+    const avmSimulator = await AvmSimulatorPool.spawn({ wsdbIpcPath: worldStateService.getIpcPath() });
+    const contractsDB = new PublicContractsDB(contractDataSource);
+    return new AvmFuzzerSimulator(merkleTrees, contractDataSource, globals, avmSimulator, contractsDB, forkId);
+  }
+
+  /** Tear down the AVM simulator pool (AVM processes and CDB server). */
+  public async close(): Promise<void> {
+    await this.avmSimulator[Symbol.asyncDispose]();
+  }
+
+  /**
+   * Simulate a transaction from a C++ AvmTxHint.
+   */
+  public async simulate(txHint: AvmTxHint): Promise<PublicTxResult> {
+    // Compute fee from gas limits and max fees per gas (upper bound on fee)
+    const totalFee =
+      BigInt(txHint.gasSettings.gasLimits.daGas) * txHint.gasSettings.maxFeesPerGas.feePerDaGas +
+      BigInt(txHint.gasSettings.gasLimits.l2Gas) * txHint.gasSettings.maxFeesPerGas.feePerL2Gas;
+
+    await this.setFeePayerBalance(txHint.feePayer, new Fr(totalFee));
+
+    const tx = await createTxFromHint(txHint);
+    return await this.simulator.simulate(tx);
+  }
+
+  /**
+   * Add a contract class from C++ raw msgpack data.
+   */
+  public async addContractClassFromCpp(rawClass: any): Promise<void> {
+    const contractClass = contractClassPublicFromPlainObject(rawClass);
+    await this.contractDataSource.addContractClass(contractClass);
+  }
+
+  /**
+   * Add a contract instance from C++ raw msgpack data.
+   * This also inserts the contract address nullifier into the nullifier tree,
+   * unless the address is a protocol canonical address (1-11).
+   */
+  public async addContractInstanceFromCpp(rawAddress: any, rawInstance: any): Promise<void> {
+    const address = AztecAddress.fromPlainObject(rawAddress);
+    const instance = contractInstanceWithAddressFromPlainObject(address, rawInstance);
+    // Protocol canonical addresses (1-11) should not have nullifiers inserted
+    const isProtocolCanonicalAddress = address.toBigInt() <= MAX_PROTOCOL_CONTRACTS && address.toBigInt() >= 1n;
+    await this.addContractInstance(instance, /* skipNullifierInsertion */ isProtocolCanonicalAddress);
+  }
+
+  /**
+   * Apply public data tree writes from C++ raw msgpack data.
+   * This is used to pre-populate the public data tree before simulation (e.g., for bytecode upgrades).
+   */
+  public async applyPublicDataWrites(rawWrites: any[]): Promise<void> {
+    for (const rawWrite of rawWrites) {
+      const leaf = PublicDataTreeLeaf.fromPlainObject(rawWrite);
+      await this.merkleTrees.sequentialInsert(MerkleTreeId.PUBLIC_DATA_TREE, [leaf.toBuffer()]);
+    }
+  }
+
+  /**
+   * Apply note hashes from C++ raw msgpack data.
+   * This is used to pre-populate the note hash tree before simulation.
+   */
+  public async applyNoteHashes(rawNoteHashes: any[]): Promise<void> {
+    const paddingLeaves = MAX_NOTE_HASHES_PER_TX - (rawNoteHashes.length % MAX_NOTE_HASHES_PER_TX);
+    const paddedNoteHashes = [...rawNoteHashes, ...Array(paddingLeaves).fill(Fr.ZERO)];
+    await this.merkleTrees.appendLeaves(MerkleTreeId.NOTE_HASH_TREE, paddedNoteHashes);
+  }
+}

package/src/public/fuzzing/avm_simulator_bin.ts

@@ -0,0 +1,173 @@
+import { Fr } from '@aztec/foundation/curves/bn254';
+import { EthAddress } from '@aztec/foundation/eth-address';
+import {
+  AvmCircuitPublicInputs,
+  type AvmTxHint,
+  PublicTxEffect,
+  deserializeFromMessagePack,
+  serializeWithMessagePack,
+} from '@aztec/stdlib/avm';
+import { GlobalVariables, TreeSnapshots } from '@aztec/stdlib/tx';
+import { NativeWorldStateService } from '@aztec/world-state';
+
+import { createInterface } from 'readline';
+
+import { AvmFuzzerSimulator, FuzzerSimulationRequest } from './avm_fuzzer_simulator.js';
+
+/** Write data to stdout, letting Node handle buffering. */
+function writeOutput(data: string): Promise<void> {
+  return new Promise<void>((resolve, reject) => {
+    process.stdout.write(data, err => {
+      if (err) {
+        reject(err);
+      } else {
+        resolve();
+      }
+    });
+  });
+}
+
+// This cache holds opened world states to avoid reopening them for each invocation.
+// It's a map so that in the future we could support multiple world states (if we had multiple fuzzers).
+const worldStateCache = new Map<string, NativeWorldStateService>();
+
+async function openExistingWorldState(dataDir: string, mapSizeKb: number): Promise<NativeWorldStateService> {
+  const cached = worldStateCache.get(dataDir);
+  if (cached) {
+    return cached;
+  }
+
+  const ws = await NativeWorldStateService.new(EthAddress.ZERO, dataDir, {
+    archiveTreeMapSizeKb: mapSizeKb,
+    nullifierTreeMapSizeKb: mapSizeKb,
+    noteHashTreeMapSizeKb: mapSizeKb,
+    messageTreeMapSizeKb: mapSizeKb,
+    publicDataTreeMapSizeKb: mapSizeKb,
+  });
+
+  worldStateCache.set(dataDir, ws);
+  return ws;
+}
+
+async function simulateWithFuzzer(
+  dataDir: string,
+  mapSizeKb: number,
+  txHint: AvmTxHint,
+  globals: GlobalVariables,
+  rawContractClasses: any[], // Replace these when we are moving contract classes to TS
+  rawContractInstances: [any, any][], // Replace these when we are moving contract instances to TS
+  rawPublicDataWrites: any[], // Public data tree writes to apply before simulation
+  rawNoteHashes: any[], // Note hashes to apply before simulation
+): Promise<{
+  reverted: boolean;
+  output: Fr[];
+  revertReason?: string;
+  publicInputs: AvmCircuitPublicInputs;
+  publicTxEffect: PublicTxEffect;
+}> {
+  const worldStateService = await openExistingWorldState(dataDir, mapSizeKb);
+
+  const simulator = await AvmFuzzerSimulator.create(worldStateService, globals);
+
+  await simulator.applyNoteHashes(rawNoteHashes);
+
+  // Register contract classes from C++ (must happen before public data writes to match C++ order)
+  for (const rawClass of rawContractClasses) {
+    await simulator.addContractClassFromCpp(rawClass);
+  }
+
+  // Register contract instances from C++
+  for (const [rawAddress, rawInstance] of rawContractInstances) {
+    await simulator.addContractInstanceFromCpp(rawAddress, rawInstance);
+  }
+
+  // Apply public data writes after contract registration (e.g., for bytecode upgrades)
+  // This must happen last to match C++ setup_fuzzer_state ordering
+  await simulator.applyPublicDataWrites(rawPublicDataWrites);
+
+  const result = await simulator.simulate(txHint);
+
+  const output = result
+    .getAppLogicReturnValues()
+    .flatMap((rv: { values?: Fr[] } | undefined) => rv?.values?.filter((v: Fr | null | undefined) => v != null) ?? []);
+
+  return {
+    reverted: !result.revertCode.isOK(),
+    output,
+    revertReason: result.findRevertReason()?.message,
+    publicInputs: result.publicInputs!,
+    publicTxEffect: result.publicTxEffect,
+  };
+}
+
+async function execute(base64Line: string): Promise<void> {
+  try {
+    // Decode base64 and deserialize the entire request from msgpack
+    const buffer = Buffer.from(base64Line.trim(), 'base64');
+    const rawRequest = deserializeFromMessagePack(buffer);
+    const request = FuzzerSimulationRequest.fromPlainObject(rawRequest);
+
+    // Run the simulation on the C++ AVM simulator
+    const result = await simulateWithFuzzer(
+      request.wsDataDir,
+      request.wsMapSizeKb,
+      request.tx,
+      request.globals,
+      request.contractClasses,
+      request.contractInstances,
+      request.publicDataWrites,
+      request.noteHashes,
+    );
+
+    // Serialize the result to msgpack and encode it in base64 for output
+    const resultBuffer = serializeWithMessagePack({
+      reverted: result.reverted,
+      output: result.output,
+      revertReason: result.revertReason ?? '',
+      endTreeSnapshots: result.publicInputs.endTreeSnapshots,
+      publicTxEffect: result.publicTxEffect,
+    });
+    const base64Response = resultBuffer.toString('base64') + '\n';
+    await writeOutput(base64Response);
+  } catch (error: any) {
+    // If we error, treat as reverted
+    const errorResult = serializeWithMessagePack({
+      reverted: true,
+      output: [] as Fr[],
+      revertReason: `Unexpected Error ${error.message}`,
+      endTreeSnapshots: TreeSnapshots.empty(),
+      publicTxEffect: PublicTxEffect.empty(),
+    });
+    await writeOutput(errorResult.toString('base64') + '\n');
+  }
+}
+
+function mainLoop() {
+  const rl = createInterface({ input: process.stdin, terminal: false });
+
+  // Process lines sequentially to avoid race conditions in responses
+  const lineQueue: string[] = [];
+  let processing = false;
+
+  async function processQueue() {
+    if (processing || lineQueue.length === 0) {
+      return;
+    }
+    processing = true;
+    while (lineQueue.length > 0) {
+      const line = lineQueue.shift()!;
+      await execute(line);
+    }
+    processing = false;
+  }
+
+  rl.on('line', (line: string) => {
+    if (line.trim()) {
+      lineQueue.push(line);
+      void processQueue();
+    }
+  });
+  rl.on('close', () => process.exit(0));
+}
+
+void mainLoop();

package/src/public/index.ts

@@ -1,10 +1,16 @@
+export { AvmSimulatorPool, type AvmSimulatorPoolOptions } from './avm_simulator_pool.js';
+export type { PublicContractsDBInterface } from './db_interfaces.js';
 export { PublicContractsDB } from './public_db_sources.js';
 export { GuardedMerkleTreeOperations } from './public_processor/guarded_merkle_tree.js';
 export { PublicProcessor, PublicProcessorFactory } from './public_processor/public_processor.js';
+export type { AvmContractsDBContext, AvmSimulator } from './avm_simulator.js';
 export {
   PublicTxSimulator,
-  type PublicTxSimulatorConfig,
+  MeasuredPublicTxSimulator,
+  createPublicTxSimulatorForBlockBuilding,
+  DumpingPublicTxSimulator,
+  type PublicTxSimulatorInterface,
   TelemetryPublicTxSimulator,
-  type PublicTxResult,
 } from './public_tx_simulator/index.js';
+export type { PublicTxResult, PublicSimulatorConfig as PublicTxSimulatorConfig } from '@aztec/stdlib/avm';
 export { getCallRequestsWithCalldataByPhase } from './utils.js';