@aztec/stdlib 0.0.1-commit.a072138 → 0.0.1-commit.a5db02d

package/src/block/l2_block_stream/l2_tips_store_base.ts

@@ -1,14 +1,13 @@
-import { GENESIS_BLOCK_HEADER_HASH } from '@aztec/constants';
 import { BlockNumber, CheckpointNumber } from '@aztec/foundation/branded-types';
 
-import type { PublishedCheckpoint } from '../../checkpoint/published_checkpoint.js';
+import type { BlockHash } from '../block_hash.js';
 import type { L2Block } from '../l2_block.js';
 import {
   type CheckpointId,
   GENESIS_CHECKPOINT_HEADER_HASH,
   type L2BlockId,
   type L2BlockTag,
-  type L2Tips,
+  type LocalL2Tips,
 } from '../l2_block_source.js';
 import type { L2BlockStreamEvent, L2BlockStreamEventHandler, L2BlockStreamLocalDataProvider } from './interfaces.js';
 
@@ -17,6 +16,7 @@ import type { L2BlockStreamEvent, L2BlockStreamEventHandler, L2BlockStreamLocalD
  * while delegating storage operations to subclasses.
  */
 export abstract class L2TipsStoreBase implements L2BlockStreamEventHandler, L2BlockStreamLocalDataProvider {
+  constructor(protected readonly initialBlockHash: BlockHash) {}
   // Abstract storage primitives - subclasses implement these based on their backing store
 
   /** Gets the block number for a given tag. */
@@ -25,6 +25,12 @@ export abstract class L2TipsStoreBase implements L2BlockStreamEventHandler, L2Bl
   /** Sets the block number for a given tag. */
   protected abstract setTip(tag: L2BlockTag, blockNumber: BlockNumber): Promise<void>;
 
+  /** Gets the checkpoint id recorded for a given tag, if any. */
+  protected abstract getTipCheckpoint(tag: L2BlockTag): Promise<CheckpointId | undefined>;
+
+  /** Records the checkpoint id for a given tag. */
+  protected abstract setTipCheckpoint(tag: L2BlockTag, checkpoint: CheckpointId): Promise<void>;
+
   /** Gets the block hash for a given block number. */
   protected abstract getStoredBlockHash(blockNumber: BlockNumber): Promise<string | undefined>;
 
@@ -34,37 +40,19 @@ export abstract class L2TipsStoreBase implements L2BlockStreamEventHandler, L2Bl
   /** Deletes all block hashes for blocks before the given block number. */
   protected abstract deleteBlockHashesBefore(blockNumber: BlockNumber): Promise<void>;
 
-  /** Gets the checkpoint number for a given block number. */
-  protected abstract getCheckpointNumberForBlock(blockNumber: BlockNumber): Promise<CheckpointNumber | undefined>;
-
-  /** Sets the checkpoint number for a given block number. */
-  protected abstract setCheckpointNumberForBlock(
-    blockNumber: BlockNumber,
-    checkpointNumber: CheckpointNumber,
-  ): Promise<void>;
-
-  /** Deletes all block-to-checkpoint mappings for blocks before the given block number. */
-  protected abstract deleteBlockToCheckpointBefore(blockNumber: BlockNumber): Promise<void>;
-
-  /** Gets a checkpoint by its number. */
-  protected abstract getCheckpoint(checkpointNumber: CheckpointNumber): Promise<PublishedCheckpoint | undefined>;
-
-  /** Saves a checkpoint. */
-  protected abstract saveCheckpointData(checkpoint: PublishedCheckpoint): Promise<void>;
-
-  /** Deletes all checkpoints before the given checkpoint number. */
-  protected abstract deleteCheckpointsBefore(checkpointNumber: CheckpointNumber): Promise<void>;
-
   /** Runs the given function in a transaction. Memory stores can just execute immediately. */
   protected abstract runInTransaction<T>(fn: () => Promise<T>): Promise<T>;
 
   // Public interface implementation
 
-  public getL2BlockHash(number: BlockNumber): Promise<string | undefined> {
+  public async getL2BlockHash(number: BlockNumber): Promise<string | undefined> {
+    if (number === 0) {
+      return (await this.getStoredBlockHash(number)) ?? this.initialBlockHash.toString();
+    }
     return this.getStoredBlockHash(number);
   }
 
-  public getL2Tips(): Promise<L2Tips> {
+  public getL2Tips(): Promise<LocalL2Tips> {
     return this.runInTransaction(async () => {
       const [proposedBlockId, finalizedBlockId, provenBlockId, checkpointedBlockId] = await Promise.all([
         this.getBlockId('proposed'),
@@ -88,11 +76,30 @@ export abstract class L2TipsStoreBase implements L2BlockStreamEventHandler, L2Bl
     });
   }
 
+  /**
+   * Records `(number → hash)` witnesses into the block-hash index without moving any tip cursor. In tips-only mode
+   * the hash history is sparse (one anchor per tip-moving poll), so a consumer that materializes per-height state
+   * should witness those heights or its prunes are over-deep by the gap to the nearest anchor. Witnesses are compared
+   * against the source, not trusted, so they cannot cause under-deep prunes; this is always safe to call.
+   */
+  public async recordBlockHashes(blocks: L2BlockId[]): Promise<void> {
+    await this.runInTransaction(async () => {
+      for (const block of blocks) {
+        if (block.hash) {
+          await this.setBlockHash(block.number, block.hash);
+        }
+      }
+    });
+  }
+
   public async handleBlockStreamEvent(event: L2BlockStreamEvent): Promise<void> {
     switch (event.type) {
       case 'blocks-added':
         await this.handleBlocksAdded(event);
         break;
+      case 'chain-proposed':
+        await this.handleChainProposed(event);
+        break;
       case 'chain-checkpointed':
         await this.handleChainCheckpointed(event);
         break;
@@ -118,7 +125,7 @@ export abstract class L2TipsStoreBase implements L2BlockStreamEventHandler, L2Bl
   private async getBlockId(tag: L2BlockTag): Promise<L2BlockId> {
     const blockNumber = await this.getTip(tag);
     if (blockNumber === undefined || blockNumber === 0) {
-      return { number: BlockNumber.ZERO, hash: GENESIS_BLOCK_HEADER_HASH.toString() };
+      return { number: BlockNumber.ZERO, hash: this.initialBlockHash.toString() };
     }
     const blockHash = await this.getStoredBlockHash(blockNumber);
     if (!blockHash) {
@@ -130,18 +137,21 @@ export abstract class L2TipsStoreBase implements L2BlockStreamEventHandler, L2Bl
   private async getCheckpointId(tag: L2BlockTag): Promise<CheckpointId> {
     const blockNumber = await this.getTip(tag);
     if (blockNumber === undefined || blockNumber === 0) {
-      return { number: CheckpointNumber.ZERO, hash: GENESIS_CHECKPOINT_HEADER_HASH.toString() };
-    }
-    const checkpointNumber = await this.getCheckpointNumberForBlock(blockNumber);
-    if (checkpointNumber === undefined) {
-      // No checkpoint associated with this block yet
-      return { number: CheckpointNumber.ZERO, hash: GENESIS_CHECKPOINT_HEADER_HASH.toString() };
+      return this.genesisCheckpointId();
     }
-    const checkpoint = await this.getCheckpoint(checkpointNumber);
-    if (!checkpoint) {
-      throw new Error(`Checkpoint not found for checkpoint number ${checkpointNumber}`);
+    // The checkpoint id recorded for this cursor when it was last advanced is the single source of truth.
+    // The writers (handleChainCheckpointed/Proven/Finalized/Pruned) always record an id alongside any
+    // non-genesis cursor advance, so a missing id on a real block is genuine store corruption. Fail loudly
+    // rather than silently reporting checkpoint zero, which would drive a checkpoint-replay storm.
+    const storedCheckpoint = await this.getTipCheckpoint(tag);
+    if (storedCheckpoint !== undefined) {
+      return storedCheckpoint;
     }
-    return { number: checkpointNumber, hash: checkpoint.checkpoint.hash().toString() };
+    throw new Error(`No checkpoint id recorded for ${tag} tip at block ${blockNumber}; the L2 tips store is corrupted`);
+  }
+
+  private genesisCheckpointId(): CheckpointId {
+    return { number: CheckpointNumber.ZERO, hash: GENESIS_CHECKPOINT_HEADER_HASH.toString() };
   }
 
   private async handleBlocksAdded(event: L2BlockStreamEvent): Promise<void> {
@@ -157,13 +167,22 @@ export abstract class L2TipsStoreBase implements L2BlockStreamEventHandler, L2Bl
     });
   }
 
+  private async handleChainProposed(event: L2BlockStreamEvent): Promise<void> {
+    if (event.type !== 'chain-proposed') {
+      return;
+    }
+    // Records the proposed tip into the block-hash index the walk-back reads. In tips-only mode this is the sole
+    // writer of proposed-tip history, leaving one sparse anchor per tip-moving pass for reorg detection.
+    await this.runInTransaction(() => this.saveTag('proposed', event.block));
+  }
+
   private async handleChainCheckpointed(event: L2BlockStreamEvent): Promise<void> {
     if (event.type !== 'chain-checkpointed') {
       return;
     }
     await this.runInTransaction(async () => {
       await this.saveTag('checkpointed', event.block);
-      await this.saveCheckpoint(event.checkpoint);
+      await this.setTipCheckpoint('checkpointed', event.checkpoint);
     });
   }
 
@@ -172,11 +191,24 @@ export abstract class L2TipsStoreBase implements L2BlockStreamEventHandler, L2Bl
       return;
     }
     await this.runInTransaction(async () => {
+      // A prune is a rollback: the proposed tip moves to the prune target unconditionally, but checkpoint-bearing
+      // cursors may only move backward (advancing one onto an uncheckpointed block would leave it without a recorded
+      // checkpoint id, which getCheckpointId throws on).
       await this.saveTag('proposed', event.block);
-      await this.saveTag('checkpointed', event.block);
-      const storeProven = await this.getBlockId('proven');
-      if (storeProven.number > event.block.number) {
-        await this.saveTag('proven', event.block);
+
+      // Clamp each checkpoint-bearing cursor down to its OWN source tip when it leads it; the event carries a valid
+      // (block, id) pair for each. Clamping the proven cursor onto the (possibly higher) checkpointed tip instead
+      // would transiently report unproven blocks as proven. The source guarantees proven <= checkpointed, so per-tip
+      // clamping preserves the local invariant.
+      for (const { tag, sourceTip } of [
+        { tag: 'checkpointed', sourceTip: event.checkpointed },
+        { tag: 'proven', sourceTip: event.proven },
+      ] as const) {
+        const current = await this.getTip(tag);
+        if (current !== undefined && current > sourceTip.block.number) {
+          await this.saveTag(tag, sourceTip.block);
+          await this.setTipCheckpoint(tag, sourceTip.checkpoint);
+        }
       }
     });
   }
@@ -187,6 +219,7 @@ export abstract class L2TipsStoreBase implements L2BlockStreamEventHandler, L2Bl
     }
     await this.runInTransaction(async () => {
       await this.saveTag('proven', event.block);
+      await this.setTipCheckpoint('proven', event.checkpoint);
     });
   }
 
@@ -196,14 +229,16 @@ export abstract class L2TipsStoreBase implements L2BlockStreamEventHandler, L2Bl
     }
     await this.runInTransaction(async () => {
       await this.saveTag('finalized', event.block);
-      const finalizedCheckpointNumber = await this.getCheckpointNumberForBlock(event.block.number);
-
-      await this.deleteBlockHashesBefore(event.block.number);
-      await this.deleteBlockToCheckpointBefore(event.block.number);
-
-      if (finalizedCheckpointNumber !== undefined) {
-        await this.deleteCheckpointsBefore(finalizedCheckpointNumber);
-      }
+      await this.setTipCheckpoint('finalized', event.checkpoint);
+
+      // Prune block hashes below the lowest live tip. Cap the deletion bound at the lowest live tip rather
+      // than the finalized tip alone: this should always be the finalized tip, but we have hit bugs where
+      // this is not the case. Deleting the block hash for a live tip would dangle subsequent `getBlockId`
+      // lookups and lock the block stream into an error loop.
+      const tips = await Promise.all([this.getTip('proposed'), this.getTip('checkpointed'), this.getTip('proven')]);
+      const liveTipBlocks = tips.filter((t): t is BlockNumber => t !== undefined && t > 0);
+      const safeBlockBound = BlockNumber(Math.min(event.block.number, ...liveTipBlocks));
+      await this.deleteBlockHashesBefore(safeBlockBound);
     });
   }
 
@@ -213,14 +248,4 @@ export abstract class L2TipsStoreBase implements L2BlockStreamEventHandler, L2Bl
       await this.setBlockHash(block.number, block.hash);
     }
   }
-
-  private async saveCheckpoint(publishedCheckpoint: PublishedCheckpoint): Promise<void> {
-    const checkpoint = publishedCheckpoint.checkpoint;
-    const lastBlock = checkpoint.blocks.at(-1)!;
-    // Only store the mapping for the last block since tips only point to checkpoint boundaries
-    await Promise.all([
-      this.setCheckpointNumberForBlock(lastBlock.number, checkpoint.number),
-      this.saveCheckpointData(publishedCheckpoint),
-    ]);
-  }
 }

package/src/block/proposal/attestations_and_signers.ts

@@ -1,29 +1,40 @@
 import type { ViemCommitteeAttestations } from '@aztec/ethereum/contracts';
-import { hexToBuffer } from '@aztec/foundation/string';
+import { bufferToHex, hexToBuffer } from '@aztec/foundation/string';
 
 import { encodeAbiParameters, parseAbiParameters } from 'viem';
 import { z } from 'zod';
 
-import type { Signable, SignatureDomainSeparator } from '../../p2p/signature_utils.js';
+import {
+  type CoordinationSignatureContext,
+  type CoordinationSignatureType,
+  type Signable,
+  coordinationSignatureContextSchema,
+} from '../../p2p/signature_utils.js';
 import { CommitteeAttestation, EthAddress } from './committee_attestation.js';
 
 export class CommitteeAttestationsAndSigners implements Signable {
-  constructor(public attestations: CommitteeAttestation[]) {}
+  readonly primaryType: CoordinationSignatureType = 'AttestationsAndSigners';
+
+  constructor(
+    public attestations: CommitteeAttestation[],
+    public readonly signatureContext: CoordinationSignatureContext,
+  ) {}
 
   static get schema() {
     return z
       .object({
         attestations: CommitteeAttestation.schema.array(),
+        signatureContext: coordinationSignatureContextSchema,
       })
-      .transform(obj => new CommitteeAttestationsAndSigners(obj.attestations));
+      .transform(obj => new CommitteeAttestationsAndSigners(obj.attestations, obj.signatureContext));
   }
 
-  getPayloadToSign(domainSeparator: SignatureDomainSeparator): Buffer {
-    const abi = parseAbiParameters('uint8,(bytes,bytes),address[]');
+  getPayloadToSign(): Buffer {
+    // Matches the L1 abi.encode(attestations, signers) in AttestationLib.sol#getAttestationsAndSignersDigest.
+    const abi = parseAbiParameters('(bytes,bytes),address[]');
     const packed = this.getPackedAttestations();
 
     const encodedData = encodeAbiParameters(abi, [
-      domainSeparator,
       [packed.signatureIndices, packed.signaturesOrAddresses],
       this.getSigners().map(s => s.toString()),
     ]);
@@ -31,8 +42,8 @@ export class CommitteeAttestationsAndSigners implements Signable {
     return hexToBuffer(encodedData);
   }
 
-  static empty(): CommitteeAttestationsAndSigners {
-    return new CommitteeAttestationsAndSigners([]);
+  static empty(signatureContext: CoordinationSignatureContext): CommitteeAttestationsAndSigners {
+    return new CommitteeAttestationsAndSigners([], signatureContext);
   }
 
   toString() {
@@ -53,9 +64,9 @@ export class CommitteeAttestationsAndSigners implements Signable {
    * @param attestations - Array of committee attestations with addresses and signatures
    * @returns Packed attestations with bitmap and tightly packed signature/address data
    */
-  getPackedAttestations(): ViemCommitteeAttestations {
-    const length = this.attestations.length;
-    const attestations = this.attestations.map(a => a.toViem());
+  static packAttestations(attestations: CommitteeAttestation[]): ViemCommitteeAttestations {
+    const length = attestations.length;
+    const viemAttestations = attestations.map(a => a.toViem());
 
     // Calculate bitmap size (1 bit per attestation, rounded up to nearest byte)
     const bitmapSize = Math.ceil(length / 8);
@@ -63,10 +74,12 @@ export class CommitteeAttestationsAndSigners implements Signable {
 
     // Calculate total data size needed
     let totalDataSize = 0;
-    for (let i = 0; i < length; i++) {
-      const signature = attestations[i].signature;
-      // Check if signature is empty (v = 0)
-      const isEmpty = signature.v === 0;
+    for (const attestation of viemAttestations) {
+      const signature = attestation.signature;
+      // A slot is empty (a non-signing member, packed as its address) only when r, s and v are all zero
+      // — matching Signature.isEmpty() and getSigners(), so the bitmap popcount and the signers list can
+      // never disagree (which would revert propose() with SignersSizeMismatch).
+      const isEmpty = signature.v === 0 && BigInt(signature.r) === 0n && BigInt(signature.s) === 0n;
 
       if (!isEmpty) {
         totalDataSize += 65; // v (1) + r (32) + s (32)
@@ -79,21 +92,22 @@ export class CommitteeAttestationsAndSigners implements Signable {
     let dataIndex = 0;
 
     // Pack the data
-    for (let i = 0; i < length; i++) {
-      const attestation = attestations[i];
+    for (const [i, attestation] of viemAttestations.entries()) {
       const signature = attestation.signature;
 
-      // Check if signature is empty
-      const isEmpty = signature.v === 0;
+      // Empty iff r, s and v are all zero (see the size-tally loop above).
+      const isEmpty = signature.v === 0 && BigInt(signature.r) === 0n && BigInt(signature.s) === 0n;
 
       if (!isEmpty) {
         // Set bit in bitmap (bit 7-0 in each byte, left to right)
         const byteIndex = Math.floor(i / 8);
         const bitIndex = 7 - (i % 8);
-        signatureIndices[byteIndex] |= 1 << bitIndex;
+        signatureIndices[byteIndex] = (signatureIndices[byteIndex] ?? 0) | (1 << bitIndex);
 
-        // Pack signature: v + r + s
-        signaturesOrAddresses[dataIndex] = signature.v;
+        // Pack signature: v + r + s. Canonicalize a yParity recovery byte (v = 0/1) to 27/28 — it
+        // recovers to the same signer, but L1 ECDSA.recover only accepts 27/28. Any other value is left
+        // as-is so a genuinely malformed signature still fails on L1 rather than being silently rewritten.
+        signaturesOrAddresses[dataIndex] = signature.v === 0 || signature.v === 1 ? signature.v + 27 : signature.v;
         dataIndex++;
 
         // Pack r (32 bytes)
@@ -118,6 +132,10 @@ export class CommitteeAttestationsAndSigners implements Signable {
       signaturesOrAddresses: `0x${Buffer.from(signaturesOrAddresses).toString('hex')}`,
     };
   }
+
+  getPackedAttestations(): ViemCommitteeAttestations {
+    return CommitteeAttestationsAndSigners.packAttestations(this.attestations);
+  }
 }
 
 /**
@@ -130,11 +148,54 @@ export class MaliciousCommitteeAttestationsAndSigners extends CommitteeAttestati
   constructor(
     attestations: CommitteeAttestation[],
     private signers: EthAddress[],
+    signatureContext: CoordinationSignatureContext,
   ) {
-    super(attestations);
+    super(attestations, signatureContext);
   }
 
   override getSigners(): EthAddress[] {
     return this.signers;
   }
 }
+
+/**
+ * Malicious extension of CommitteeAttestationsAndSigners that rewrites every non-proposer signature slot's
+ * recovery byte to yParity form (v ∈ {0, 1}) in the packed output, after the honest `packAttestations` has
+ * already canonicalized it to v ∈ {27, 28}. Models a malicious selected proposer that hand-crafts
+ * `propose()` calldata L1 accepts but no honest node can byte-replay: each rewritten signature still
+ * recovers to the same member (r, s and the recovery parity are preserved), the bitmap bits stay set, and
+ * `getSigners()` stays consistent, so `propose()` does not revert `SignersSizeMismatch` -- yet the
+ * checkpoint can never be proven (`ECDSA.recover` rejects v ∉ {27, 28}). The proposer's own slot is left
+ * canonical so L1 `verifyProposer` (which recovers that slot) still accepts the checkpoint. For testing only.
+ */
+export class MaliciousYParityCommitteeAttestationsAndSigners extends CommitteeAttestationsAndSigners {
+  constructor(
+    attestations: CommitteeAttestation[],
+    /** Committee index of the proposer's own slot, left canonical so `propose()` passes `verifyProposer`. */
+    private proposerIndex: number,
+    signatureContext: CoordinationSignatureContext,
+  ) {
+    super(attestations, signatureContext);
+  }
+
+  override getPackedAttestations(): ViemCommitteeAttestations {
+    const packed = super.getPackedAttestations();
+    const data = hexToBuffer(packed.signaturesOrAddresses);
+
+    // Walk the packed byte-vector and rewrite every non-proposer signed slot's v-byte to yParity form. A
+    // signed slot occupies 65 bytes (v, r, s); an empty slot occupies 20 bytes (address only).
+    let offset = 0;
+    for (let i = 0; i < this.attestations.length; i++) {
+      const isSigned = !this.attestations[i].signature.isEmpty();
+      if (isSigned && i !== this.proposerIndex) {
+        // `packAttestations` canonicalized v to 27/28; rewrite back to the equivalent yParity byte (0/1),
+        // preserving the recovery parity so the signature still recovers to the same member.
+        const v = data[offset];
+        data[offset] = v >= 27 ? v - 27 : v;
+      }
+      offset += isSigned ? 65 : 20;
+    }
+
+    return { signatureIndices: packed.signatureIndices, signaturesOrAddresses: bufferToHex(data) };
+  }
+}