@aztec/stdlib 0.0.1-commit.2f68f620 → 0.0.1-commit.321f6a9

package/src/messaging/l1_to_l2_message.ts

@@ -1,4 +1,5 @@
-import type { L1_TO_L2_MSG_TREE_HEIGHT } from '@aztec/constants';
+import { DomainSeparator, type L1_TO_L2_MSG_TREE_HEIGHT } from '@aztec/constants';
+import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
 import { sha256ToField } from '@aztec/foundation/crypto/sha256';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
@@ -7,7 +8,7 @@ import { SiblingPath } from '@aztec/foundation/trees';
 
 import type { AztecAddress } from '../aztec-address/index.js';
 import type { BlockParameter } from '../block/block_parameter.js';
-import { computeL1ToL2MessageNullifier } from '../hash/hash.js';
+import { siloNullifier } from '../hash/hash.js';
 import type { AztecNode } from '../interfaces/aztec-node.js';
 import { MerkleTreeId } from '../trees/merkle_tree_id.js';
 import { L1Actor } from './l1_actor.js';
@@ -74,28 +75,65 @@ export class L1ToL2Message {
   }
 }
 
-// This functionality is not on the node because we do not want to pass the node the secret, and give the node the ability to derive a valid nullifer for an L1 to L2 message.
-export async function getNonNullifiedL1ToL2MessageWitness(
+/**
+ * The unsiloed nullifier a message consumer derives, together with the contract address needed to silo it.
+ */
+export interface UnsiloedMessageNullifier {
+  contractAddress: AztecAddress;
+  nullifier: Fr;
+}
+
+/**
+ * Computes the unsiloed nullifier that the fee juice contract (and any consumer following the same scheme) derives when
+ * consuming an L1 to L2 message.
+ *
+ * This is not a general-purpose utility: other contracts may derive the secret hash and hence the nullifier
+ * differently. The result is unsiloed — callers silo it (with the consuming contract's address) before looking it up
+ * in the nullifier tree.
+ */
+export function computeFeeJuiceMessageNullifier(messageHash: Fr, secret: Fr): Promise<Fr> {
+  return poseidon2HashWithSeparator([messageHash, secret], DomainSeparator.MESSAGE_NULLIFIER);
+}
+
+/**
+ * Fetches the membership witness of an L1 to L2 message. When `unsiloedNullifier` is provided, the message is
+ * additionally required to be un-nullified.
+ */
+export async function getL1ToL2MessageWitness(
   node: AztecNode,
-  contractAddress: AztecAddress,
   messageHash: Fr,
-  secret: Fr,
+  unsiloedNullifier?: UnsiloedMessageNullifier,
   referenceBlock: BlockParameter = 'latest',
 ): Promise<[bigint, SiblingPath<typeof L1_TO_L2_MSG_TREE_HEIGHT>]> {
-  const messageNullifier = await computeL1ToL2MessageNullifier(contractAddress, messageHash, secret);
-
-  const [l1ToL2Response, nullifierResponse] = await Promise.all([
-    node.getL1ToL2MessageMembershipWitness(referenceBlock, messageHash),
-    node.findLeavesIndexes(referenceBlock, MerkleTreeId.NULLIFIER_TREE, [messageNullifier]),
-  ]);
+  // Both requests are dispatched before awaiting so they run concurrently.
+  const l1ToL2ResponsePromise = node.getL1ToL2MessageMembershipWitness(referenceBlock, messageHash);
+  const nullifierResponsePromise = unsiloedNullifier
+    ? siloNullifier(unsiloedNullifier.contractAddress, unsiloedNullifier.nullifier).then(siloed =>
+        node.findLeavesIndexes(referenceBlock, MerkleTreeId.NULLIFIER_TREE, [siloed]),
+      )
+    : undefined;
 
+  const l1ToL2Response = await l1ToL2ResponsePromise;
   if (!l1ToL2Response) {
     throw new Error(`No L1 to L2 message found for message hash ${messageHash.toString()}`);
   }
 
-  if (nullifierResponse[0] !== undefined) {
+  const nullifierResponse = await nullifierResponsePromise;
+  if (nullifierResponse?.[0] !== undefined) {
     throw new Error(`No non-nullified L1 to L2 message found for message hash ${messageHash.toString()}`);
   }
 
   return l1ToL2Response;
 }
+
+// This functionality is not on the node because we do not want to pass the node the secret, and give the node the ability to derive a valid nullifer for an L1 to L2 message.
+export async function getNonNullifiedL1ToL2MessageWitness(
+  node: AztecNode,
+  contractAddress: AztecAddress,
+  messageHash: Fr,
+  secret: Fr,
+  referenceBlock: BlockParameter = 'latest',
+): Promise<[bigint, SiblingPath<typeof L1_TO_L2_MSG_TREE_HEIGHT>]> {
+  const nullifier = await computeFeeJuiceMessageNullifier(messageHash, secret);
+  return getL1ToL2MessageWitness(node, messageHash, { contractAddress, nullifier }, referenceBlock);
+}

package/src/noir/index.ts

@@ -2,6 +2,7 @@ import type {
   ABIParameter,
   ABIParameterVisibility,
   AbiErrorType,
+  AbiNamedValue,
   AbiType,
   AbiValue,
   DebugFileMap,
@@ -73,7 +74,7 @@ export interface NoirCompiledContract {
   /** The events of the contract */
   outputs: {
     structs: Record<string, AbiType[]>;
-    globals: Record<string, AbiValue[]>;
+    globals: Record<string, (AbiNamedValue | AbiValue)[]>;
   };
   /** The map of file ID to the source code and path of the file. */
   file_map: DebugFileMap;

package/src/p2p/attestation_utils.ts

@@ -1,3 +1,4 @@
+import { normalizeSignature } from '@aztec/foundation/crypto/secp256k1-signer';
 import type { EthAddress } from '@aztec/foundation/eth-address';
 
 import { CommitteeAttestation } from '../block/index.js';
@@ -18,9 +19,15 @@ export function orderAttestations(
   for (const attestation of attestations) {
     const sender = attestation.getSender();
     if (sender) {
+      // Canonicalize the recovery byte to v ∈ {27, 28} before it reaches the L1 bundle. A committee
+      // member (or a peer mutating the byte in flight) can emit an equivalent signature in yParity form
+      // (v = 0/1); left as-is it makes `packAttestations` (empty iff v === 0) and `getSigners` (empty iff
+      // r,s,v all zero) disagree, reverting `propose()` with SignersSizeMismatch, and a v = 1 byte would
+      // later revert epoch proving in ECDSA.recover. `sender` recovered, so the signature is non-empty
+      // and low-s, and normalizeSignature preserves the recovered address.
       attestationMap.set(
         sender.toString(),
-        CommitteeAttestation.fromAddressAndSignature(sender, attestation.signature),
+        CommitteeAttestation.fromAddressAndSignature(sender, normalizeSignature(attestation.signature)),
       );
     }
   }

package/src/p2p/checkpoint_attestation.ts

@@ -1,5 +1,6 @@
 import { CheckpointProposalHash, type SlotNumber } from '@aztec/foundation/branded-types';
 import { type BaseBuffer32, Buffer32 } from '@aztec/foundation/buffer';
+import { normalizeSignature } from '@aztec/foundation/crypto/secp256k1-signer';
 import type { Fr } from '@aztec/foundation/curves/bn254';
 import type { EthAddress } from '@aztec/foundation/eth-address';
 import { Signature } from '@aztec/foundation/eth-signature';
@@ -97,6 +98,17 @@ export class CheckpointAttestation extends Gossipable {
     return this.cachedProposer ?? undefined;
   }
 
+  /**
+   * Returns a copy with the attester signature canonicalized to v ∈ {27, 28}. Callers store attestations
+   * received from gossip verbatim; normalizing on ingress keeps a signature emitted in yParity form
+   * (v = 0/1) — whether by a malicious committee member or a peer mutating the byte in flight — from
+   * reaching the L1 bundle in a non-canonical form. Must only be called once the signature has recovered
+   * a sender (so it is non-empty and low-s); `normalizeSignature` throws on an all-zero signature.
+   */
+  withNormalizedSignature(): CheckpointAttestation {
+    return new CheckpointAttestation(this.payload, normalizeSignature(this.signature), this.proposerSignature);
+  }
+
   getPayload(): Buffer {
     return this.payload.getPayloadToSign();
   }

package/src/p2p/signature_utils.ts

@@ -112,6 +112,15 @@ export function getHashedSignaturePayloadTypedData(signable: Signable): Buffer32
   return Buffer32.fromString(hashTypedData(getCoordinationSignatureTypedData(signable)));
 }
 
+/**
+ * Recovers the sender of a gossiped coordination message. Deliberately lenient (allowYParityAsV): a
+ * signature whose recovery byte is in yParity form (v ∈ {0, 1}) still resolves to its sender, so the P2P
+ * layer can attribute and accept it and then canonicalize on ingress (CheckpointAttestation.
+ * withNormalizedSignature, A-1351) before it reaches the L1 bundle. This is intentionally looser than
+ * on-chain checkpoint validation (getAttestationInfoFromPayload), which recovers strictly to mirror L1's
+ * ECDSA.recover — do not unify the two. These proposal/attestation signatures are P2P-only and never reach
+ * L1 verbatim, so leniency here cannot leak a non-canonical byte onto L1.
+ */
 export function recoverCoordinationSigner(signable: Signable, signature: Signature): EthAddress | undefined {
   const digest = getHashedSignaturePayloadTypedData(signable);
   return tryRecoverAddress(digest, signature, { allowYParityAsV: true });

package/src/rollup/avm_proof_data.ts

@@ -1,6 +1,6 @@
-import { AVM_V2_PROOF_LENGTH_IN_FIELDS_PADDED } from '@aztec/constants';
+import { AVM_V2_PROOF_LENGTH_IN_FIELDS } from '@aztec/constants';
 
 import { AvmCircuitPublicInputs } from '../avm/avm_circuit_public_inputs.js';
 import type { ProofDataForFixedVk } from '../proofs/proof_data.js';
 
-export type AvmProofData = ProofDataForFixedVk<AvmCircuitPublicInputs, typeof AVM_V2_PROOF_LENGTH_IN_FIELDS_PADDED>;
+export type AvmProofData = ProofDataForFixedVk<AvmCircuitPublicInputs, typeof AVM_V2_PROOF_LENGTH_IN_FIELDS>;

package/src/rollup/checkpoint_header.ts

@@ -52,6 +52,8 @@ export class CheckpointHeader {
     public gasFees: GasFees,
     /** Total mana used in the block, computed by the root rollup circuit */
     public totalManaUsed: Fr,
+    /** Total fees accrued across the checkpoint. */
+    public accumulatedFees: Fr,
   ) {}
 
   static get schema(): ZodFor<CheckpointHeader> {
@@ -68,6 +70,7 @@ export class CheckpointHeader {
         feeRecipient: schemas.AztecAddress,
         gasFees: GasFees.schema,
         totalManaUsed: schemas.Fr,
+        accumulatedFees: schemas.Fr,
       })
       .transform(CheckpointHeader.from);
   }
@@ -85,6 +88,7 @@ export class CheckpointHeader {
       fields.feeRecipient,
       fields.gasFees,
       fields.totalManaUsed,
+      fields.accumulatedFees,
     ] as const;
   }
 
@@ -107,6 +111,7 @@ export class CheckpointHeader {
       reader.readObject(AztecAddress),
       reader.readObject(GasFees),
       reader.readObject(Fr),
+      reader.readObject(Fr),
     );
   }
 
@@ -122,7 +127,8 @@ export class CheckpointHeader {
       this.coinbase.equals(other.coinbase) &&
       this.feeRecipient.equals(other.feeRecipient) &&
       this.gasFees.equals(other.gasFees) &&
-      this.totalManaUsed.equals(other.totalManaUsed)
+      this.totalManaUsed.equals(other.totalManaUsed) &&
+      this.accumulatedFees.equals(other.accumulatedFees)
     );
   }
 
@@ -151,6 +157,7 @@ export class CheckpointHeader {
       this.feeRecipient,
       this.gasFees,
       this.totalManaUsed,
+      this.accumulatedFees,
     ]);
   }
 
@@ -171,6 +178,7 @@ export class CheckpointHeader {
       feeRecipient: AztecAddress.ZERO,
       gasFees: GasFees.empty(),
       totalManaUsed: Fr.ZERO,
+      accumulatedFees: Fr.ZERO,
       ...fields,
     });
   }
@@ -188,6 +196,7 @@ export class CheckpointHeader {
       feeRecipient: new AztecAddress(Fr.random()),
       gasFees: GasFees.random(),
       totalManaUsed: new Fr(BigInt(Math.floor(Math.random() * 1000000))),
+      accumulatedFees: new Fr(BigInt(Math.floor(Math.random() * 1000000))),
       ...overrides,
     });
   }
@@ -204,7 +213,8 @@ export class CheckpointHeader {
       this.coinbase.isZero() &&
       this.feeRecipient.isZero() &&
       this.gasFees.isEmpty() &&
-      this.totalManaUsed.isZero()
+      this.totalManaUsed.isZero() &&
+      this.accumulatedFees.isZero()
     );
   }
 
@@ -233,6 +243,7 @@ export class CheckpointHeader {
       new AztecAddress(hexToBuffer(header.feeRecipient)),
       new GasFees(header.gasFees.feePerDaGas, header.gasFees.feePerL2Gas),
       new Fr(header.totalManaUsed),
+      new Fr(header.accumulatedFees),
     );
   }
 
@@ -260,6 +271,7 @@ export class CheckpointHeader {
         feePerL2Gas: this.gasFees.feePerL2Gas,
       },
       totalManaUsed: this.totalManaUsed.toBigInt(),
+      accumulatedFees: this.accumulatedFees.toBigInt(),
     };
   }
 
@@ -276,6 +288,7 @@ export class CheckpointHeader {
       feeRecipient: this.feeRecipient.toString(),
       gasFees: this.gasFees.toInspect(),
       totalManaUsed: this.totalManaUsed.toBigInt(),
+      accumulatedFees: this.accumulatedFees.toBigInt(),
     };
   }
 
@@ -292,6 +305,7 @@ export class CheckpointHeader {
   feeRecipient: ${this.feeRecipient.toString()},
   gasFees: { da:${this.gasFees.feePerDaGas}, l2:${this.gasFees.feePerL2Gas} },
   totalManaUsed: ${this.totalManaUsed.toBigInt()},
+  accumulatedFees: ${this.accumulatedFees.toBigInt()},
 }`;
   }
 }

package/src/stats/stats.ts

@@ -86,12 +86,16 @@ export type ClientCircuitName =
   | 'private-kernel-init'
   | 'private-kernel-init-2'
   | 'private-kernel-init-3'
+  | 'private-kernel-init-4'
+  | 'private-kernel-init-5'
   | 'private-kernel-inner'
   | 'private-kernel-inner-2'
   | 'private-kernel-inner-3'
+  | 'private-kernel-inner-4'
+  | 'private-kernel-inner-5'
   | 'private-kernel-reset'
-  | 'private-kernel-tail'
-  | 'private-kernel-tail-to-public'
+  | 'private-kernel-reset-tail'
+  | 'private-kernel-reset-tail-to-public'
   | 'hiding-kernel-to-rollup'
   | 'hiding-kernel-to-public'
   | 'app-circuit';

package/src/tests/factories.ts

@@ -6,7 +6,7 @@ import {
 } from '@aztec/blob-lib/testing';
 import {
   ARCHIVE_HEIGHT,
-  AVM_V2_PROOF_LENGTH_IN_FIELDS_PADDED,
+  AVM_V2_PROOF_LENGTH_IN_FIELDS,
   CHONK_PROOF_LENGTH,
   CONTRACT_CLASS_LOG_SIZE_IN_FIELDS,
   L1_TO_L2_MSG_SUBTREE_ROOT_SIBLING_PATH_LENGTH,
@@ -26,6 +26,7 @@ import {
   MAX_PRIVATE_CALL_STACK_LENGTH_PER_CALL,
   MAX_PRIVATE_LOGS_PER_CALL,
   MAX_PRIVATE_LOGS_PER_TX,
+  MAX_PROCESSABLE_L2_GAS,
   MAX_PROTOCOL_CONTRACTS,
   MAX_PUBLIC_DATA_UPDATE_REQUESTS_PER_TX,
   MAX_TOTAL_PUBLIC_DATA_UPDATE_REQUESTS_PER_TX,
@@ -229,7 +230,12 @@ export function makeTxContext(seed: number = 1): TxContext {
  * Creates a default instance of gas settings. No seed value is used to ensure we allocate a sensible amount of gas for testing.
  */
 export function makeGasSettings() {
-  return GasSettings.fallback({ maxFeesPerGas: new GasFees(10, 10) });
+  return GasSettings.fallback({
+    // Arbitrary daGas pinned to the pre-existing fixture value so avm_inputs.testdata.bin (consumed by
+    // the C++ vm2 tests) stays byte-stable; teardown derives to the same values the old fallback produced.
+    gasLimits: new Gas(196_608, MAX_PROCESSABLE_L2_GAS),
+    maxFeesPerGas: new GasFees(10, 10),
+  });
 }
 
 /**
@@ -648,6 +654,7 @@ export function makePrivateCircuitPublicInputs(seed = 0): PrivateCircuitPublicIn
     anchorBlockHeader: makeBlockHeader(seed + 0xd00),
     txContext: makeTxContext(seed + 0x1400),
     isFeePayer: false,
+    txRequestSalt: fr(seed + 0x1500),
   });
 }
 
@@ -659,7 +666,7 @@ export function makeGlobalVariables(seed = 1, overrides: Partial<FieldsOf<Global
     slotNumber: SlotNumber(seed + 3),
     timestamp: BigInt(seed + 4),
     coinbase: EthAddress.fromField(new Fr(seed + 5)),
-    feeRecipient: AztecAddress.fromField(new Fr(seed + 6)),
+    feeRecipient: AztecAddress.fromFieldUnsafe(new Fr(seed + 6)),
     gasFees: new GasFees(seed + 7, seed + 8),
     ...compact(overrides),
   });
@@ -709,7 +716,7 @@ export function makeBytes(size = 32, fill = 1): Buffer {
  * @returns An aztec address.
  */
 export function makeAztecAddress(seed = 1): AztecAddress {
-  return AztecAddress.fromField(fr(seed));
+  return AztecAddress.fromFieldUnsafe(fr(seed));
 }
 
 function makeBlockConstantData(seed = 1, globalVariables?: GlobalVariables) {
@@ -872,6 +879,7 @@ export function makeCheckpointHeader(seed = 0, overrides: Partial<FieldsOf<Check
     feeRecipient: makeAztecAddress(seed + 0x600),
     gasFees: makeGasFees(seed + 0x700),
     totalManaUsed: fr(seed + 0x800),
+    accumulatedFees: fr(seed + 0x850),
     ...overrides,
   });
 }
@@ -1117,11 +1125,7 @@ export function makePublicTxBaseRollupPrivateInputs(seed = 0) {
     makePublicChonkVerifierPublicInputs,
     RECURSIVE_ROLLUP_HONK_PROOF_LENGTH,
   );
-  const avmProofData = makeProofDataForFixedVk(
-    seed + 0x100,
-    makeAvmCircuitPublicInputs,
-    AVM_V2_PROOF_LENGTH_IN_FIELDS_PADDED,
-  );
+  const avmProofData = makeProofDataForFixedVk(seed + 0x100, makeAvmCircuitPublicInputs, AVM_V2_PROOF_LENGTH_IN_FIELDS);
   const hints = makePublicBaseRollupHints(seed + 0x200);
 
   return PublicTxBaseRollupPrivateInputs.from({
@@ -1701,10 +1705,6 @@ export function makeL2Tips(
       block: { number: bn, hash },
       checkpoint: { number: cpn, hash: cph },
     },
-    proposedCheckpoint: {
-      block: { number: bn, hash },
-      checkpoint: { number: cpn, hash: cph },
-    },
     proven: {
       block: { number: bn, hash },
       checkpoint: { number: cpn, hash: cph },

package/src/tests/mocks.ts

@@ -1,7 +1,9 @@
 import {
   MAX_ENQUEUED_CALLS_PER_TX,
   MAX_NULLIFIERS_PER_TX,
+  MAX_PROCESSABLE_L2_GAS,
   MAX_TOTAL_PUBLIC_DATA_UPDATE_REQUESTS_PER_TX,
+  MAX_TX_DA_GAS,
   MAX_TX_LIFETIME,
   PRIVATE_TX_L2_GAS_OVERHEAD,
   PUBLIC_TX_L2_GAS_OVERHEAD,
@@ -110,7 +112,7 @@ export const mockTx = async (
     publicCalldataSize = 2,
     feePayer,
     chonkProof = ChonkProof.random(),
-    gasLimits,
+    gasLimits = new Gas(MAX_TX_DA_GAS, MAX_PROCESSABLE_L2_GAS),
     maxFeesPerGas = new GasFees(10, 10),
     maxPriorityFeesPerGas,
     gasUsed = Gas.empty(),
@@ -212,7 +214,10 @@ export async function mockProcessedTx({
   db,
   chainId = Fr.ZERO,
   version = Fr.ZERO,
-  gasSettings = GasSettings.fallback({ maxFeesPerGas: new GasFees(10, 10) }),
+  gasSettings = GasSettings.fallback({
+    gasLimits: new Gas(MAX_TX_DA_GAS, MAX_PROCESSABLE_L2_GAS),
+    maxFeesPerGas: new GasFees(10, 10),
+  }),
   vkTreeRoot = Fr.ZERO,
   protocolContracts = makeProtocolContracts(seed + 0x100),
   globalVariables = GlobalVariables.empty(),