@aztec/stdlib 0.0.1-commit.b655e406 → 0.0.1-commit.b8a057fa

package/src/p2p/block_proposal.ts

@@ -1,120 +1,265 @@
-import { Buffer32 } from '@aztec/foundation/buffer';
-import { keccak256, tryRecoverAddress } from '@aztec/foundation/crypto';
+import {
+  BlockNumber,
+  BlockProposalHash,
+  type CheckpointNumber,
+  IndexWithinCheckpoint,
+  SlotNumber,
+} from '@aztec/foundation/branded-types';
+import { type BaseBuffer32, Buffer32 } from '@aztec/foundation/buffer';
+import { keccak256 } from '@aztec/foundation/crypto/keccak';
+import { Fr } from '@aztec/foundation/curves/bn254';
 import type { EthAddress } from '@aztec/foundation/eth-address';
 import { Signature } from '@aztec/foundation/eth-signature';
-import { Fr } from '@aztec/foundation/fields';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
 
+import type { TypedDataDefinition } from 'viem';
+
+import type { L2Block } from '../block/l2_block.js';
 import type { L2BlockInfo } from '../block/l2_block_info.js';
+import { MAX_TXS_PER_BLOCK } from '../deserialization/index.js';
+import { DutyType, type SigningContext } from '../ha-signing/index.js';
+import { BlockHeader } from '../tx/block_header.js';
 import { TxHash } from '../tx/index.js';
-import { Tx } from '../tx/tx.js';
-import { ConsensusPayload } from './consensus_payload.js';
+import type { Tx } from '../tx/tx.js';
 import { Gossipable } from './gossipable.js';
 import {
-  SignatureDomainSeparator,
-  getHashedSignaturePayload,
-  getHashedSignaturePayloadEthSignedMessage,
+  type CoordinationSignatureContext,
+  type CoordinationSignatureType,
+  EMPTY_COORDINATION_SIGNATURE_CONTEXT,
+  type Signable,
+  coordinationSignatureContextEquals,
+  getCoordinationSignatureTypedData,
+  readCoordinationSignatureContext,
+  recoverCoordinationSigner,
+  serializeCoordinationSignatureContext,
 } from './signature_utils.js';
+import { SignedTxs } from './signed_txs.js';
 import { TopicType } from './topic_type.js';
 
-export class BlockProposalHash extends Buffer32 {
-  constructor(hash: Buffer) {
-    super(hash);
-  }
-}
+export type { BlockProposalHash } from '@aztec/foundation/branded-types';
 
 export type BlockProposalOptions = {
-  publishFullTxs: boolean;
-  /** Whether to generate an invalid block proposal for broadcasting. Use only for testing. */
+  /**
+   * Whether to include the tx objects along with the block proposal.
+   * Dramatically increases size of the payload but eliminates failed reexecutions due to missing txs.
+   */
+  publishFullTxs?: boolean;
+  /**
+   * Whether to generate an invalid block proposal for broadcasting.
+   * Use only for testing.
+   */
   broadcastInvalidBlockProposal?: boolean;
 };
 
 /**
- * BlockProposal
- *
- * A block proposal is created by the leader of the chain proposing a sequence of transactions to
- * be included in the head of the chain
+ * A block proposal is created by the leader of the chain proposing a sequence of transactions
+ * to be included in a block within a checkpoint. This is used for non-last blocks in a slot.
+ * The last block is sent as part of a CheckpointProposal.
  */
-export class BlockProposal extends Gossipable {
+export class BlockProposal extends Gossipable implements Signable {
   static override p2pTopic = TopicType.block_proposal;
 
-  private sender: EthAddress | undefined;
+  readonly primaryType: CoordinationSignatureType = 'BlockProposal';
+
+  private cachedSender: EthAddress | undefined | null = undefined;
 
   constructor(
-    /** The payload of the message, and what the signature is over */
-    public readonly payload: ConsensusPayload,
+    /** The per-block header containing block state and global variables */
+    public readonly blockHeader: BlockHeader,
 
-    /** The signer of the BlockProposal over the header of the new block*/
-    public readonly signature: Signature,
+    /** Index of this block within the checkpoint (0-indexed) */
+    public readonly indexWithinCheckpoint: IndexWithinCheckpoint,
+
+    /** Hash of L1 to L2 messages for this checkpoint (constant across all blocks in checkpoint) */
+    public readonly inHash: Fr,
+
+    /** Archive root after this block is applied */
+    public readonly archiveRoot: Fr,
 
     /** The sequence of transactions in the block */
     public readonly txHashes: TxHash[],
 
-    // Note(md): this is placed after the txs payload in order to be backwards compatible with previous versions
-    /** The transactions in the block */
-    public readonly txs?: Tx[],
+    /** The proposer's signature over the block data */
+    public readonly signature: Signature,
+
+    /** The signing domain (chainId + rollupAddress) the signature is bound to */
+    public readonly signatureContext: CoordinationSignatureContext,
+
+    /** The signed transactions in the block (optional, for DA guarantees) */
+    public readonly signedTxs?: SignedTxs,
   ) {
     super();
   }
 
-  override generateP2PMessageIdentifier(): Promise<Buffer32> {
-    return Promise.resolve(new BlockProposalHash(keccak256(this.signature.toBuffer())));
+  override generateP2PMessageIdentifier(): Promise<BaseBuffer32> {
+    return Promise.resolve(new Buffer32(this.getPayloadHashBuffer()));
   }
 
   get archive(): Fr {
-    return this.payload.archive;
+    return this.archiveRoot;
   }
 
-  get slotNumber(): Fr {
-    return this.payload.header.slotNumber;
+  get slotNumber(): SlotNumber {
+    return this.blockHeader.getSlot();
+  }
+
+  get blockNumber(): BlockNumber {
+    return this.blockHeader.getBlockNumber();
+  }
+
+  /** Convenience getter for txs from signedTxs */
+  get txs(): Tx[] | undefined {
+    return this.signedTxs?.txs;
   }
 
   toBlockInfo(): Omit<L2BlockInfo, 'blockNumber'> {
     return {
-      slotNumber: this.slotNumber.toNumber(),
-      lastArchive: this.payload.header.lastArchiveRoot,
-      timestamp: this.payload.header.timestamp,
-      archive: this.archive,
+      slotNumber: this.slotNumber,
+      lastArchive: this.blockHeader.lastArchive.root,
+      timestamp: this.blockHeader.globalVariables.timestamp,
+      archive: this.archiveRoot,
       txCount: this.txHashes.length,
     };
   }
 
+  /**
+   * Get the payload to sign for this block proposal.
+   * The signature is over: blockHeader + indexWithinCheckpoint + inHash + archiveRoot + txHashes
+   */
+  getPayloadToSign(): Buffer {
+    return serializeToBuffer([
+      this.blockHeader,
+      this.indexWithinCheckpoint,
+      this.inHash,
+      this.archiveRoot,
+      this.txHashes.length,
+      this.txHashes,
+    ]);
+  }
+
+  private getPayloadHashBuffer(): Buffer {
+    return keccak256(this.getPayloadToSign());
+  }
+
+  /**
+   * Returns a keccak256 hash of the signed payload.
+   * Used by the attestation pool to dedup distinct signed payloads at the same
+   * (slot, indexWithinCheckpoint) regardless of archive collisions.
+   * The hash deliberately excludes the signature so non-deterministic ECDSA
+   * re-signs of the same payload do not look like equivocation.
+   */
+  getPayloadHash(): BlockProposalHash {
+    return BlockProposalHash.fromBuffer(this.getPayloadHashBuffer());
+  }
+
   static async createProposalFromSigner(
-    payload: ConsensusPayload,
+    blockHeader: BlockHeader,
+    checkpointNumber: CheckpointNumber,
+    indexWithinCheckpoint: IndexWithinCheckpoint,
+    inHash: Fr,
+    archiveRoot: Fr,
     txHashes: TxHash[],
-    // Note(md): Provided separately to tx hashes such that this function can be optional
     txs: Tx[] | undefined,
-    payloadSigner: (payload: Buffer32) => Promise<Signature>,
-  ) {
-    const hashed = getHashedSignaturePayload(payload, SignatureDomainSeparator.blockProposal);
-    const sig = await payloadSigner(hashed);
+    signatureContext: CoordinationSignatureContext,
+    proposalSigner: (typedData: TypedDataDefinition, context: SigningContext) => Promise<Signature>,
+    txsSigner?: (typedData: TypedDataDefinition, context: SigningContext) => Promise<Signature>,
+  ): Promise<BlockProposal> {
+    // Create a temporary proposal to get the payload to sign
+    const tempProposal = new BlockProposal(
+      blockHeader,
+      indexWithinCheckpoint,
+      inHash,
+      archiveRoot,
+      txHashes,
+      Signature.empty(),
+      signatureContext,
+    );
 
-    return new BlockProposal(payload, sig, txHashes, txs);
+    // Create the block signing context
+    const blockContext: SigningContext = {
+      slot: blockHeader.globalVariables.slotNumber,
+      blockNumber: blockHeader.globalVariables.blockNumber,
+      checkpointNumber,
+      blockIndexWithinCheckpoint: indexWithinCheckpoint,
+      dutyType: DutyType.BLOCK_PROPOSAL,
+    };
+
+    const typedData = getCoordinationSignatureTypedData(tempProposal);
+    const sig = await proposalSigner(typedData, blockContext);
+
+    // If txs are provided, sign them as well
+    let signedTxs: SignedTxs | undefined;
+    if (txs) {
+      const txsSigningContext: SigningContext = { dutyType: DutyType.TXS };
+      if (!txsSigner) {
+        throw new Error('signed_txs requires a typed-data signer');
+      }
+      signedTxs = await SignedTxs.createFromSigner(txs, signatureContext, typedData =>
+        txsSigner(typedData, txsSigningContext),
+      );
+    }
+
+    return new BlockProposal(
+      blockHeader,
+      indexWithinCheckpoint,
+      inHash,
+      archiveRoot,
+      txHashes,
+      sig,
+      signatureContext,
+      signedTxs,
+    );
   }
 
-  /**Get Sender
-   * Lazily evaluate the sender of the proposal; result is cached
-   * @returns The sender address, or undefined if signature recovery fails
+  /**
+   * Lazily evaluate the sender of the proposal; result is cached.
+   * If there's signedTxs, also verifies that its signing domain matches this proposal's and
+   * that the signedTxs sender matches the block proposal sender. This prevents a proposer
+   * from wrapping a foreign-chain SignedTxs bundle inside a local-chain proposal.
+   * @returns The sender address, or undefined if signature recovery fails or inner/outer mismatch
    */
   getSender(): EthAddress | undefined {
-    if (!this.sender) {
-      const hashed = getHashedSignaturePayloadEthSignedMessage(this.payload, SignatureDomainSeparator.blockProposal);
-      // Cache the sender for later use
-      this.sender = tryRecoverAddress(hashed, this.signature);
+    if (this.cachedSender === undefined) {
+      const blockSender = recoverCoordinationSigner(this, this.signature);
+
+      if (blockSender && this.signedTxs) {
+        if (!coordinationSignatureContextEquals(this.signedTxs.signatureContext, this.signatureContext)) {
+          this.cachedSender = null;
+          return undefined;
+        }
+        const txsSender = this.signedTxs.getSender();
+        if (!txsSender || !txsSender.equals(blockSender)) {
+          this.cachedSender = null;
+          return undefined;
+        }
+      }
+
+      this.cachedSender = blockSender ?? null;
     }
 
-    return this.sender;
+    return this.cachedSender ?? undefined;
   }
 
   getPayload() {
-    return this.payload.getPayloadToSign(SignatureDomainSeparator.blockProposal);
+    return this.getPayloadToSign();
   }
 
   toBuffer(): Buffer {
-    const buffer: any[] = [this.payload, this.signature, this.txHashes.length, this.txHashes];
-    if (this.txs) {
-      buffer.push(this.txs.length);
-      buffer.push(this.txs);
+    const buffer: any[] = [
+      this.blockHeader,
+      this.indexWithinCheckpoint,
+      this.inHash,
+      this.archiveRoot,
+      this.signature,
+      serializeCoordinationSignatureContext(this.signatureContext),
+      this.txHashes.length,
+      this.txHashes,
+    ];
+    if (this.signedTxs) {
+      buffer.push(1); // hasSignedTxs = true
+      buffer.push(this.signedTxs.toBuffer());
+    } else {
+      buffer.push(0); // hasSignedTxs = false
     }
     return serializeToBuffer(buffer);
   }
@@ -122,25 +267,122 @@ export class BlockProposal extends Gossipable {
   static fromBuffer(buf: Buffer | BufferReader): BlockProposal {
     const reader = BufferReader.asReader(buf);
 
-    const payload = reader.readObject(ConsensusPayload);
-    const sig = reader.readObject(Signature);
-    const txHashes = reader.readArray(reader.readNumber(), TxHash);
+    const blockHeader = reader.readObject(BlockHeader);
+    const indexWithinCheckpoint = IndexWithinCheckpoint(reader.readNumber());
+    const inHash = reader.readObject(Fr);
+    const archiveRoot = reader.readObject(Fr);
+    const signature = reader.readObject(Signature);
+    const signatureContext = readCoordinationSignatureContext(reader);
+    const txHashCount = reader.readNumber();
+    if (txHashCount > MAX_TXS_PER_BLOCK) {
+      throw new Error(`txHashes count ${txHashCount} exceeds maximum ${MAX_TXS_PER_BLOCK}`);
+    }
+    const txHashes = reader.readArray(txHashCount, TxHash);
 
     if (!reader.isEmpty()) {
-      const txs = reader.readArray(reader.readNumber(), Tx);
-      return new BlockProposal(payload, sig, txHashes, txs);
+      const hasSignedTxs = reader.readNumber();
+      if (hasSignedTxs) {
+        const signedTxs = SignedTxs.fromBuffer(reader);
+        return new BlockProposal(
+          blockHeader,
+          indexWithinCheckpoint,
+          inHash,
+          archiveRoot,
+          txHashes,
+          signature,
+          signatureContext,
+          signedTxs,
+        );
+      }
     }
 
-    return new BlockProposal(payload, sig, txHashes);
+    return new BlockProposal(
+      blockHeader,
+      indexWithinCheckpoint,
+      inHash,
+      archiveRoot,
+      txHashes,
+      signature,
+      signatureContext,
+    );
   }
 
   getSize(): number {
     return (
-      this.payload.getSize() +
+      this.blockHeader.getSize() +
+      4 /* indexWithinCheckpoint */ +
+      this.inHash.size +
+      this.archiveRoot.size +
       this.signature.getSize() +
+      4 /* chainId */ +
+      20 /* rollupAddress */ +
       4 /* txHashes.length */ +
       this.txHashes.length * TxHash.SIZE +
-      (this.txs ? 4 /* txs.length */ + this.txs.reduce((acc, tx) => acc + tx.getSize(), 0) : 0)
+      4 /* hasSignedTxs flag */ +
+      (this.signedTxs ? this.signedTxs.getSize() : 0)
+    );
+  }
+
+  static empty(): BlockProposal {
+    return new BlockProposal(
+      BlockHeader.empty(),
+      IndexWithinCheckpoint(0),
+      Fr.ZERO,
+      Fr.ZERO,
+      [],
+      Signature.empty(),
+      EMPTY_COORDINATION_SIGNATURE_CONTEXT,
+    );
+  }
+
+  static random(): BlockProposal {
+    return new BlockProposal(
+      BlockHeader.random(),
+      IndexWithinCheckpoint(Math.floor(Math.random() * 5)),
+      Fr.random(),
+      Fr.random(),
+      [TxHash.random(), TxHash.random()],
+      Signature.random(),
+      EMPTY_COORDINATION_SIGNATURE_CONTEXT,
+    );
+  }
+
+  toInspect() {
+    return {
+      blockHeader: this.blockHeader.toInspect(),
+      indexWithinCheckpoint: this.indexWithinCheckpoint,
+      inHash: this.inHash.toString(),
+      archiveRoot: this.archiveRoot.toString(),
+      signature: this.signature.toString(),
+      txHashes: this.txHashes.map(h => h.toString()),
+      chainId: this.signatureContext.chainId,
+      rollupAddress: this.signatureContext.rollupAddress.toString(),
+    };
+  }
+
+  /**
+   * Check if this proposal matches the given block.
+   * Compares the archive root and block header.
+   * @param block - The L2Block to compare against
+   * @returns True if the proposal matches the block
+   */
+  matchesBlock(block: L2Block): boolean {
+    return this.archiveRoot.equals(block.archive.root) && this.blockHeader.equals(block.header);
+  }
+
+  /**
+   * Returns a copy of this proposal without signedTxs.
+   * Used when storing proposals in attestation pool to avoid storing full tx data.
+   */
+  withoutSignedTxs(): BlockProposal {
+    return new BlockProposal(
+      this.blockHeader,
+      this.indexWithinCheckpoint,
+      this.inHash,
+      this.archiveRoot,
+      this.txHashes,
+      this.signature,
+      this.signatureContext,
     );
   }
 }

package/src/p2p/checkpoint_attestation.ts

@@ -0,0 +1,156 @@
+import { CheckpointProposalHash, type SlotNumber } from '@aztec/foundation/branded-types';
+import { type BaseBuffer32, Buffer32 } from '@aztec/foundation/buffer';
+import { normalizeSignature } from '@aztec/foundation/crypto/secp256k1-signer';
+import type { Fr } from '@aztec/foundation/curves/bn254';
+import type { EthAddress } from '@aztec/foundation/eth-address';
+import { Signature } from '@aztec/foundation/eth-signature';
+import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
+
+import { z } from 'zod';
+
+import type { ZodFor } from '../schemas/index.js';
+import { CheckpointProposal } from './checkpoint_proposal.js';
+import { ConsensusPayload } from './consensus_payload.js';
+import { Gossipable } from './gossipable.js';
+import { type CoordinationSignatureContext, recoverCoordinationSigner } from './signature_utils.js';
+import { TopicType } from './topic_type.js';
+
+/**
+ * CheckpointAttestation
+ *
+ * A validator that has attested to seeing all blocks in a checkpoint
+ * will produce a checkpoint attestation over the checkpoint header.
+ */
+export class CheckpointAttestation extends Gossipable {
+  static override p2pTopic = TopicType.checkpoint_attestation;
+
+  private cachedSender: EthAddress | undefined | null = undefined;
+  private cachedProposer: EthAddress | undefined | null = undefined;
+
+  constructor(
+    /** The payload of the message, and what the signature is over */
+    public readonly payload: ConsensusPayload,
+
+    /** The signature of the checkpoint attester */
+    public readonly signature: Signature,
+
+    /** The signature from the checkpoint proposer */
+    public readonly proposerSignature: Signature,
+  ) {
+    super();
+  }
+
+  static get schema(): ZodFor<CheckpointAttestation> {
+    return z
+      .object({
+        payload: ConsensusPayload.schema,
+        signature: Signature.schema,
+        proposerSignature: Signature.schema,
+      })
+      .transform(obj => new CheckpointAttestation(obj.payload, obj.signature, obj.proposerSignature));
+  }
+
+  override generateP2PMessageIdentifier(): Promise<BaseBuffer32> {
+    return Promise.resolve(new Buffer32(this.payload.getPayloadHash()));
+  }
+
+  get archive(): Fr {
+    return this.payload.archive;
+  }
+
+  get slotNumber(): SlotNumber {
+    return this.payload.header.slotNumber;
+  }
+
+  get signatureContext(): CoordinationSignatureContext {
+    return this.payload.signatureContext;
+  }
+
+  /**
+   * Lazily evaluate and cache the signer of the attestation
+   * @returns The signer of the attestation, or undefined if signature recovery fails
+   */
+  getSender(): EthAddress | undefined {
+    if (this.cachedSender === undefined) {
+      this.cachedSender = recoverCoordinationSigner(this.payload, this.signature) ?? null;
+    }
+    return this.cachedSender ?? undefined;
+  }
+
+  /**
+   * Lazily evaluate and cache the proposer of the checkpoint
+   * @returns The proposer of the checkpoint
+   */
+  getProposer(): EthAddress | undefined {
+    if (this.cachedProposer === undefined) {
+      // Create a temporary CheckpointProposal to recover the proposer address.
+      // We need to use CheckpointProposal because it has a different getPayloadToSign()
+      // implementation than ConsensusPayload (uses serializeToBuffer vs ABI encoding).
+      const proposal = new CheckpointProposal(
+        this.payload.header,
+        this.payload.archive,
+        this.payload.feeAssetPriceModifier,
+        this.proposerSignature,
+        this.payload.signatureContext,
+      );
+      this.cachedProposer = proposal.getSender() ?? null;
+    }
+    return this.cachedProposer ?? undefined;
+  }
+
+  /**
+   * Returns a copy with the attester signature canonicalized to v ∈ {27, 28}. Callers store attestations
+   * received from gossip verbatim; normalizing on ingress keeps a signature emitted in yParity form
+   * (v = 0/1) — whether by a malicious committee member or a peer mutating the byte in flight — from
+   * reaching the L1 bundle in a non-canonical form. Must only be called once the signature has recovered
+   * a sender (so it is non-empty and low-s); `normalizeSignature` throws on an all-zero signature.
+   */
+  withNormalizedSignature(): CheckpointAttestation {
+    return new CheckpointAttestation(this.payload, normalizeSignature(this.signature), this.proposerSignature);
+  }
+
+  getPayload(): Buffer {
+    return this.payload.getPayloadToSign();
+  }
+
+  /**
+   * Returns a keccak256 hash of the signed consensus payload.
+   * Used to dedup distinct signed payloads. Returns same hash than the corresponding proposal.
+   */
+  getPayloadHash(): CheckpointProposalHash {
+    return CheckpointProposalHash.fromBuffer(this.payload.getPayloadHash());
+  }
+
+  toBuffer(): Buffer {
+    return serializeToBuffer([this.payload, this.signature, this.proposerSignature]);
+  }
+
+  static fromBuffer(buf: Buffer | BufferReader): CheckpointAttestation {
+    const reader = BufferReader.asReader(buf);
+    return new CheckpointAttestation(
+      reader.readObject(ConsensusPayload),
+      reader.readObject(Signature),
+      reader.readObject(Signature),
+    );
+  }
+
+  static empty(): CheckpointAttestation {
+    return new CheckpointAttestation(ConsensusPayload.empty(), Signature.empty(), Signature.empty());
+  }
+
+  static random(): CheckpointAttestation {
+    return new CheckpointAttestation(ConsensusPayload.random(), Signature.random(), Signature.random());
+  }
+
+  getSize(): number {
+    return this.payload.getSize() + this.signature.getSize() + this.proposerSignature.getSize();
+  }
+
+  toInspect() {
+    return {
+      payload: this.payload.toInspect(),
+      signature: this.signature.toString(),
+      proposerSignature: this.proposerSignature.toString(),
+    };
+  }
+}