@aztec/stdlib 0.0.1-commit.c2eed6949 → 0.0.1-commit.c52d6e7

package/src/p2p/signature_utils.ts

@@ -1,37 +1,131 @@
 import { Buffer32 } from '@aztec/foundation/buffer';
 import { keccak256 } from '@aztec/foundation/crypto/keccak';
-import { makeEthSignDigest } from '@aztec/foundation/crypto/secp256k1-signer';
+import { tryRecoverAddress } from '@aztec/foundation/crypto/secp256k1-signer';
+import { EthAddress } from '@aztec/foundation/eth-address';
+import type { Signature } from '@aztec/foundation/eth-signature';
+import { type BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
 
-export enum SignatureDomainSeparator {
-  blockProposal = 0,
-  checkpointAttestation = 1,
-  attestationsAndSigners = 2,
-  checkpointProposal = 3,
-  signedTxs = 4,
-}
+import { type TypedDataDefinition, hashTypedData } from 'viem';
+import { z } from 'zod';
+
+import type { ZodFor } from '../schemas/index.js';
+
+export type CoordinationSignatureType =
+  | 'BlockProposal'
+  | 'CheckpointProposal'
+  | 'CheckpointAttestation'
+  | 'AttestationsAndSigners'
+  | 'SignedTxs';
+
+export type CoordinationSignatureContext = {
+  chainId: number;
+  rollupAddress: EthAddress;
+};
+
+export const EMPTY_COORDINATION_SIGNATURE_CONTEXT: CoordinationSignatureContext = {
+  chainId: 0,
+  rollupAddress: EthAddress.ZERO,
+};
+
+export const coordinationSignatureContextSchema: ZodFor<CoordinationSignatureContext> = z.object({
+  chainId: z.number(),
+  rollupAddress: EthAddress.schema,
+});
 
 export interface Signable {
-  getPayloadToSign(domainSeparator: SignatureDomainSeparator): Buffer;
+  readonly primaryType: CoordinationSignatureType;
+  readonly signatureContext: CoordinationSignatureContext;
+  getPayloadToSign(): Buffer;
+}
+
+export function coordinationSignatureContextEquals(
+  a: CoordinationSignatureContext,
+  b: CoordinationSignatureContext,
+): boolean {
+  return a.chainId === b.chainId && a.rollupAddress.equals(b.rollupAddress);
+}
+
+export function serializeCoordinationSignatureContext(ctx: CoordinationSignatureContext): Buffer {
+  return serializeToBuffer([ctx.chainId, ctx.rollupAddress]);
+}
+
+export function readCoordinationSignatureContext(reader: BufferReader): CoordinationSignatureContext {
+  const chainId = reader.readNumber();
+  const rollupAddress = reader.readObject(EthAddress);
+  return { chainId, rollupAddress };
 }
 
 /**
- * Get the hashed payload for the signature of the `Signable`
- * @param s - The `Signable` to sign
- * @returns The hashed payload for the signature of the `Signable`
+ * Returns true if the signable carries a context matching the node's expected context.
+ * Use this at the P2P ingress boundary to reject foreign-chain messages cheaply before
+ * performing any signature recovery.
  */
-export function getHashedSignaturePayload(s: Signable, domainSeparator: SignatureDomainSeparator): Buffer32 {
-  return Buffer32.fromBuffer(keccak256(s.getPayloadToSign(domainSeparator)));
+export function hasValidSignatureContext(signable: Signable, expected: CoordinationSignatureContext): boolean {
+  return coordinationSignatureContextEquals(signable.signatureContext, expected);
+}
+
+const COORDINATION_SIGNATURE_NAME = 'Aztec Rollup';
+const COORDINATION_SIGNATURE_VERSION = '1';
+
+const EIP712_DOMAIN_FIELDS = [
+  { name: 'name', type: 'string' },
+  { name: 'version', type: 'string' },
+  { name: 'chainId', type: 'uint256' },
+  { name: 'verifyingContract', type: 'address' },
+] as const;
+
+const COORDINATION_SIGNATURE_TYPES = {
+  EIP712Domain: EIP712_DOMAIN_FIELDS,
+  BlockProposal: [{ name: 'payloadHash', type: 'bytes32' }],
+  CheckpointProposal: [{ name: 'payloadHash', type: 'bytes32' }],
+  CheckpointAttestation: [{ name: 'payloadHash', type: 'bytes32' }],
+  AttestationsAndSigners: [{ name: 'payloadHash', type: 'bytes32' }],
+  SignedTxs: [{ name: 'payloadHash', type: 'bytes32' }],
+} as const;
+
+export function getCoordinationSignatureTypedDataForPayloadHash(
+  payloadHash: Buffer32,
+  type: CoordinationSignatureType,
+  context: CoordinationSignatureContext,
+): TypedDataDefinition {
+  return {
+    domain: {
+      name: COORDINATION_SIGNATURE_NAME,
+      version: COORDINATION_SIGNATURE_VERSION,
+      chainId: context.chainId,
+      verifyingContract: context.rollupAddress.toString() as `0x${string}`,
+    },
+    types: COORDINATION_SIGNATURE_TYPES,
+    primaryType: type,
+    message: {
+      payloadHash: payloadHash.toString() as `0x${string}`,
+    },
+  };
+}
+
+export function getCoordinationSignatureTypedData(signable: Signable): TypedDataDefinition {
+  const payloadHash = getHashedSignaturePayload(signable);
+  return getCoordinationSignatureTypedDataForPayloadHash(payloadHash, signable.primaryType, signable.signatureContext);
+}
+
+export function getHashedSignaturePayloadTypedData(signable: Signable): Buffer32 {
+  return Buffer32.fromString(hashTypedData(getCoordinationSignatureTypedData(signable)));
 }
 
 /**
- * Get the hashed payload for the signature of the `Signable` as an Ethereum signed message EIP-712
- * @param s - the `Signable` to sign
- * @returns The hashed payload for the signature of the `Signable` as an Ethereum signed message
+ * Recovers the sender of a gossiped coordination message. Deliberately lenient (allowYParityAsV): a
+ * signature whose recovery byte is in yParity form (v ∈ {0, 1}) still resolves to its sender, so the P2P
+ * layer can attribute and accept it and then canonicalize on ingress (CheckpointAttestation.
+ * withNormalizedSignature, A-1351) before it reaches the L1 bundle. This is intentionally looser than
+ * on-chain checkpoint validation (getAttestationInfoFromPayload), which recovers strictly to mirror L1's
+ * ECDSA.recover — do not unify the two. These proposal/attestation signatures are P2P-only and never reach
+ * L1 verbatim, so leniency here cannot leak a non-canonical byte onto L1.
  */
-export function getHashedSignaturePayloadEthSignedMessage(
-  s: Signable,
-  domainSeparator: SignatureDomainSeparator,
-): Buffer32 {
-  const payload = getHashedSignaturePayload(s, domainSeparator);
-  return makeEthSignDigest(payload);
+export function recoverCoordinationSigner(signable: Signable, signature: Signature): EthAddress | undefined {
+  const digest = getHashedSignaturePayloadTypedData(signable);
+  return tryRecoverAddress(digest, signature, { allowYParityAsV: true });
+}
+
+export function getHashedSignaturePayload(s: Signable): Buffer32 {
+  return Buffer32.fromBuffer(keccak256(s.getPayloadToSign()));
 }

package/src/p2p/signed_txs.ts

@@ -1,15 +1,20 @@
-import { Buffer32 } from '@aztec/foundation/buffer';
-import { tryRecoverAddress } from '@aztec/foundation/crypto/secp256k1-signer';
 import type { EthAddress } from '@aztec/foundation/eth-address';
 import { Signature } from '@aztec/foundation/eth-signature';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
 
+import type { TypedDataDefinition } from 'viem';
+
 import { MAX_TXS_PER_BLOCK } from '../deserialization/index.js';
 import { Tx } from '../tx/tx.js';
 import {
-  SignatureDomainSeparator,
-  getHashedSignaturePayload,
-  getHashedSignaturePayloadEthSignedMessage,
+  type CoordinationSignatureContext,
+  type CoordinationSignatureType,
+  EMPTY_COORDINATION_SIGNATURE_CONTEXT,
+  type Signable,
+  getCoordinationSignatureTypedData,
+  readCoordinationSignatureContext,
+  recoverCoordinationSigner,
+  serializeCoordinationSignatureContext,
 } from './signature_utils.js';
 
 /**
@@ -17,50 +22,56 @@ import {
  * The signature is over the transaction objects themselves, providing
  * data availability guarantees beyond just the transaction hashes.
  */
-export class SignedTxs {
-  private sender: EthAddress | undefined;
+export class SignedTxs implements Signable {
+  readonly primaryType: CoordinationSignatureType = 'SignedTxs';
+
+  private cachedSender: EthAddress | undefined | null = undefined;
 
   constructor(
     /** The transactions */
     public readonly txs: Tx[],
     /** The proposer's signature over the transactions */
     public readonly signature: Signature,
+    /** The signing domain (chainId + rollupAddress) the signature is bound to */
+    public readonly signatureContext: CoordinationSignatureContext,
   ) {}
 
-  /**
-   * Get the payload to sign for this signed txs.
-   */
-  getPayloadToSign(domainSeparator: SignatureDomainSeparator): Buffer {
-    return serializeToBuffer([domainSeparator, this.txs.length, this.txs]);
+  getPayloadToSign(): Buffer {
+    return serializeToBuffer([this.txs.length, this.txs]);
   }
 
   /**
-   * Lazily evaluate the sender of the signed txs; result is cached
+   * Lazily evaluate the sender of the signed txs; result is cached.
    * @returns The sender address, or undefined if signature recovery fails
    */
   getSender(): EthAddress | undefined {
-    if (!this.sender) {
-      const hashed = getHashedSignaturePayloadEthSignedMessage(this, SignatureDomainSeparator.signedTxs);
-      this.sender = tryRecoverAddress(hashed, this.signature);
+    if (this.cachedSender === undefined) {
+      this.cachedSender = recoverCoordinationSigner(this, this.signature) ?? null;
     }
-    return this.sender;
+    return this.cachedSender ?? undefined;
   }
 
   /**
-   * Create SignedTxs from a signer function
+   * Create SignedTxs from a typed-data signer function
    */
   static async createFromSigner(
     txs: Tx[],
-    payloadSigner: (payload: Buffer32) => Promise<Signature>,
+    signatureContext: CoordinationSignatureContext,
+    typedDataSigner: (typedData: TypedDataDefinition) => Promise<Signature>,
   ): Promise<SignedTxs> {
-    const tempSignedTxs = new SignedTxs(txs, Signature.empty());
-    const hashed = getHashedSignaturePayload(tempSignedTxs, SignatureDomainSeparator.signedTxs);
-    const signature = await payloadSigner(hashed);
-    return new SignedTxs(txs, signature);
+    const tempSignedTxs = new SignedTxs(txs, Signature.empty(), signatureContext);
+    const typedData = getCoordinationSignatureTypedData(tempSignedTxs);
+    const signature = await typedDataSigner(typedData);
+    return new SignedTxs(txs, signature, signatureContext);
   }
 
   toBuffer(): Buffer {
-    return serializeToBuffer([this.txs.length, this.txs, this.signature]);
+    return serializeToBuffer([
+      this.txs.length,
+      this.txs,
+      this.signature,
+      serializeCoordinationSignatureContext(this.signatureContext),
+    ]);
   }
 
   static fromBuffer(buf: Buffer | BufferReader): SignedTxs {
@@ -71,18 +82,25 @@ export class SignedTxs {
     }
     const txs = reader.readArray(txCount, Tx);
     const signature = reader.readObject(Signature);
-    return new SignedTxs(txs, signature);
+    const signatureContext = readCoordinationSignatureContext(reader);
+    return new SignedTxs(txs, signature, signatureContext);
   }
 
   getSize(): number {
-    return 4 /* txs.length */ + this.txs.reduce((acc, tx) => acc + tx.getSize(), 0) + this.signature.getSize();
+    return (
+      4 /* txs.length */ +
+      this.txs.reduce((acc, tx) => acc + tx.getSize(), 0) +
+      this.signature.getSize() +
+      4 /* chainId */ +
+      20 /* rollupAddress */
+    );
   }
 
   static empty(): SignedTxs {
-    return new SignedTxs([], Signature.empty());
+    return new SignedTxs([], Signature.empty(), EMPTY_COORDINATION_SIGNATURE_CONTEXT);
   }
 
   static random(): SignedTxs {
-    return new SignedTxs([Tx.random(), Tx.random()], Signature.random());
+    return new SignedTxs([Tx.random(), Tx.random()], Signature.random(), EMPTY_COORDINATION_SIGNATURE_CONTEXT);
   }
 }

package/src/parity/parity_base_private_inputs.ts

@@ -10,9 +10,11 @@ export class ParityBasePrivateInputs {
     public readonly msgs: Tuple<Fr, typeof NUM_MSGS_PER_BASE_PARITY>,
     /** Root of the VK tree */
     public readonly vkTreeRoot: Fr,
+    /** Prover identity committed to by the circuit, for sybil protection. */
+    public readonly proverId: Fr,
   ) {}
 
-  public static fromSlice(array: Fr[], index: number, vkTreeRoot: Fr): ParityBasePrivateInputs {
+  public static fromSlice(array: Fr[], index: number, vkTreeRoot: Fr, proverId: Fr): ParityBasePrivateInputs {
     // Can't use Tuple<Fr, typeof NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP> due to length
     if (array.length !== NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP) {
       throw new Error(
@@ -22,12 +24,12 @@ export class ParityBasePrivateInputs {
     const start = index * NUM_MSGS_PER_BASE_PARITY;
     const end = start + NUM_MSGS_PER_BASE_PARITY;
     const msgs = array.slice(start, end);
-    return new ParityBasePrivateInputs(msgs as Tuple<Fr, typeof NUM_MSGS_PER_BASE_PARITY>, vkTreeRoot);
+    return new ParityBasePrivateInputs(msgs as Tuple<Fr, typeof NUM_MSGS_PER_BASE_PARITY>, vkTreeRoot, proverId);
   }
 
   /** Serializes the inputs to a buffer. */
   toBuffer() {
-    return serializeToBuffer(this.msgs, this.vkTreeRoot);
+    return serializeToBuffer(this.msgs, this.vkTreeRoot, this.proverId);
   }
 
   /** Serializes the inputs to a hex string. */
@@ -41,7 +43,11 @@ export class ParityBasePrivateInputs {
    */
   static fromBuffer(buffer: Buffer | BufferReader) {
     const reader = BufferReader.asReader(buffer);
-    return new ParityBasePrivateInputs(reader.readArray(NUM_MSGS_PER_BASE_PARITY, Fr), Fr.fromBuffer(reader));
+    return new ParityBasePrivateInputs(
+      reader.readArray(NUM_MSGS_PER_BASE_PARITY, Fr),
+      Fr.fromBuffer(reader),
+      Fr.fromBuffer(reader),
+    );
   }
 
   /**

package/src/parity/parity_public_inputs.ts

@@ -12,6 +12,8 @@ export class ParityPublicInputs {
     public convertedRoot: Fr,
     /** Root of the VK tree */
     public vkTreeRoot: Fr,
+    /** Prover identity committed to by the circuit, for sybil protection. */
+    public proverId: Fr,
   ) {
     if (shaRoot.toBuffer()[0] != 0) {
       throw new Error(`shaRoot buffer must be 31 bytes. Got 32 bytes`);
@@ -54,7 +56,7 @@ export class ParityPublicInputs {
    * @returns The instance fields.
    */
   static getFields(fields: FieldsOf<ParityPublicInputs>) {
-    return [fields.shaRoot, fields.convertedRoot, fields.vkTreeRoot] as const;
+    return [fields.shaRoot, fields.convertedRoot, fields.vkTreeRoot, fields.proverId] as const;
   }
 
   /**
@@ -64,7 +66,12 @@ export class ParityPublicInputs {
    */
   static fromBuffer(buffer: Buffer | BufferReader) {
     const reader = BufferReader.asReader(buffer);
-    return new ParityPublicInputs(reader.readObject(Fr), reader.readObject(Fr), Fr.fromBuffer(reader));
+    return new ParityPublicInputs(
+      reader.readObject(Fr),
+      reader.readObject(Fr),
+      Fr.fromBuffer(reader),
+      Fr.fromBuffer(reader),
+    );
   }
 
   /**

package/src/proofs/chonk_proof.ts

@@ -4,16 +4,19 @@ import { times } from '@aztec/foundation/collection';
 import { randomBytes } from '@aztec/foundation/crypto/random';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { bufferSchemaFor } from '@aztec/foundation/schemas';
-import { BufferReader, numToUInt32BE, serializeToBuffer } from '@aztec/foundation/serialize';
+import { BufferReader, BufferSink } from '@aztec/foundation/serialize';
 
 /**
- * Serialization format detection for ChonkProof is size-based:
+ * Serialization format detection for ChonkProof is value-based on the leading uint32:
+ *   - EMPTY:                 [0: uint32]                              → total = 4 bytes
  *   - UNCOMPRESSED (legacy): [field_count=1632: uint32] [fields...]  → total ≈ 52KB (>= 40KB)
  *   - COMPRESSED:            [byte_count: uint32] [compressed_bytes] → total ≈ 35KB (< 40KB)
  *
- * Detection: if the first uint32 equals CHONK_PROOF_LENGTH (1632), it's legacy format
- * (field count). Otherwise, it's compressed format (byte count). The old uncompressed
- * format is never smaller than 40KB; compressed proofs are always smaller than 40KB.
+ * Detection from the first uint32: 0 means an empty proof (no fields); CHONK_PROOF_LENGTH
+ * (1632) means legacy format (field count); any other value is the compressed byte count.
+ * A real compressed proof always has a non-zero byte count, so 0 is an unambiguous sentinel
+ * for the empty case. The old uncompressed format is never smaller than 40KB; compressed
+ * proofs are always smaller than 40KB.
  */
 
 // CHONK: "Client Honk" - An UltraHonk variant with incremental folding and delayed non-native arithmetic.
@@ -32,7 +35,8 @@ export class ChonkProof {
     public fields: Fr[],
     compressedProof?: Buffer,
   ) {
-    if (fields.length !== CHONK_PROOF_LENGTH) {
+    // An empty proof (no fields) is a valid placeholder; see ChonkProof.empty().
+    if (fields.length !== 0 && fields.length !== CHONK_PROOF_LENGTH) {
       throw new Error(`Invalid ChonkProof length: ${fields.length}`);
     }
     this.compressedProof = compressedProof;
@@ -47,7 +51,7 @@ export class ChonkProof {
   }
 
   static empty() {
-    return new ChonkProof(new Array(CHONK_PROOF_LENGTH).fill(Fr.ZERO));
+    return new ChonkProof([]);
   }
 
   static random() {
@@ -77,7 +81,8 @@ export class ChonkProof {
    * Deserialize a ChonkProof from a buffer.
    * Supports both legacy (field elements) and compressed (chonk compression) formats.
    *
-   * Size-based format detection:
+   * Value-based format detection on the leading uint32:
+   *   - First uint32 == 0: empty proof (no fields), total = 4 bytes
    *   - First uint32 == CHONK_PROOF_LENGTH (1632): legacy format, read field elements
    *     Total proof data ≈ 52KB (always >= 40KB)
    *   - Otherwise: compressed format, first uint32 is byte count of compressed data
@@ -87,6 +92,11 @@ export class ChonkProof {
     const reader = BufferReader.asReader(buffer);
     const firstUint32 = reader.readNumber();
 
+    if (firstUint32 === 0) {
+      // Empty format: a zero length encodes an empty proof.
+      return ChonkProof.empty();
+    }
+
     if (firstUint32 === CHONK_PROOF_LENGTH) {
       // Legacy format: firstUint32 is the field count (1632)
       // Widen to `number` to prevent TS from narrowing to literal 1632,
@@ -133,13 +143,24 @@ export class ChonkProof {
    * If compressed bytes are available, uses the compressed format (~1.7x smaller).
    * Otherwise falls back to legacy field element format.
    */
-  public toBuffer() {
+  public toBuffer(): Buffer;
+  public toBuffer(sink: BufferSink): void;
+  public toBuffer(sink?: BufferSink): Buffer | void {
+    if (!sink) {
+      return BufferSink.serialize(this);
+    }
     if (this.compressedProof) {
       // Compressed format: [compressed_byte_count: uint32] [compressed_bytes]
-      return Buffer.concat([numToUInt32BE(this.compressedProof.length), this.compressedProof]);
+      sink.writeNumber(this.compressedProof.length);
+      sink.writeBytes(this.compressedProof);
+      return;
     }
-    // Legacy format: [field_count=1632: uint32] [fields...]
-    return serializeToBuffer(this.fields.length, this.fields);
+    // Legacy / empty format: [field_count: uint32] [fields...]. fields.length === 0 emits the empty
+    // sentinel (a lone zero uint32) that ChonkProof.fromBuffer detects; fields.length === CHONK_PROOF_LENGTH
+    // is the full legacy form. The writeFields fast path skips per-element sinkable dispatch on the 1632
+    // leaves and is a no-op when the array is empty.
+    sink.writeNumber(this.fields.length);
+    sink.writeFields(this.fields);
   }
 }
 
@@ -156,17 +177,24 @@ export class ChonkProofWithPublicInputs {
     // For recursive verification, use without public inputs via `removePublicInputs()`.
     public fieldsWithPublicInputs: Fr[],
   ) {
-    if (fieldsWithPublicInputs.length < CHONK_PROOF_LENGTH) {
+    // An empty proof (no fields) is a valid placeholder; see ChonkProofWithPublicInputs.empty().
+    if (fieldsWithPublicInputs.length !== 0 && fieldsWithPublicInputs.length < CHONK_PROOF_LENGTH) {
       throw new Error(`Invalid ChonkProofWithPublicInputs length: ${fieldsWithPublicInputs.length}`);
     }
   }
 
   public getPublicInputs() {
+    if (this.fieldsWithPublicInputs.length === 0) {
+      return [];
+    }
     const numPublicInputs = this.fieldsWithPublicInputs.length - CHONK_PROOF_LENGTH;
     return this.fieldsWithPublicInputs.slice(0, numPublicInputs);
   }
 
   public removePublicInputs() {
+    if (this.fieldsWithPublicInputs.length === 0) {
+      return new ChonkProof([], this.compressedProof);
+    }
     const numPublicInputs = this.fieldsWithPublicInputs.length - CHONK_PROOF_LENGTH;
     // Flow compressed proof bytes through so the ChonkProof can serialize efficiently
     return new ChonkProof(this.fieldsWithPublicInputs.slice(numPublicInputs), this.compressedProof);
@@ -196,8 +224,14 @@ export class ChonkProofWithPublicInputs {
     return new ChonkProofWithPublicInputs(proof);
   }
 
-  public toBuffer() {
-    return serializeToBuffer(this.fieldsWithPublicInputs.length, this.fieldsWithPublicInputs);
+  public toBuffer(): Buffer;
+  public toBuffer(sink: BufferSink): void;
+  public toBuffer(sink?: BufferSink): Buffer | void {
+    if (!sink) {
+      return BufferSink.serialize(this);
+    }
+    sink.writeNumber(this.fieldsWithPublicInputs.length);
+    sink.writeFields(this.fieldsWithPublicInputs);
   }
 
   // Called when constructing from bb proving results.

package/src/rollup/avm_proof_data.ts

@@ -1,6 +1,6 @@
-import { AVM_V2_PROOF_LENGTH_IN_FIELDS_PADDED } from '@aztec/constants';
+import { AVM_V2_PROOF_LENGTH_IN_FIELDS } from '@aztec/constants';
 
 import { AvmCircuitPublicInputs } from '../avm/avm_circuit_public_inputs.js';
 import type { ProofDataForFixedVk } from '../proofs/proof_data.js';
 
-export type AvmProofData = ProofDataForFixedVk<AvmCircuitPublicInputs, typeof AVM_V2_PROOF_LENGTH_IN_FIELDS_PADDED>;
+export type AvmProofData = ProofDataForFixedVk<AvmCircuitPublicInputs, typeof AVM_V2_PROOF_LENGTH_IN_FIELDS>;

package/src/rollup/block_headers_hash.ts

@@ -1,5 +1,7 @@
+import { DomainSeparator } from '@aztec/constants';
+import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
 import { Fr } from '@aztec/foundation/curves/bn254';
-import { computeUnbalancedPoseidonRoot } from '@aztec/foundation/trees';
+import { computeUnbalancedMerkleTreeRootAsync } from '@aztec/foundation/trees';
 
 import type { BlockHeader } from '../tx/block_header.js';
 
@@ -7,6 +9,13 @@ export async function computeBlockHeadersHash(blockHeaders: BlockHeader[]): Prom
   const blockHeaderHashes = await Promise.all(blockHeaders.map(header => header.hash()));
   // Must match the implementation in merge_block_rollups.nr, with the **unbalanced** rollup structure
   // (see validate_consecutive_block_rollups.nr > assert_rollups_filled_greedily.nr).
-  const blockHeadersHash = await computeUnbalancedPoseidonRoot(blockHeaderHashes.map(hash => hash.toBuffer()));
+  const blockHeadersHasher = async (left: Uint8Array, right: Uint8Array) =>
+    (
+      await poseidon2HashWithSeparator([Buffer.from(left), Buffer.from(right)], DomainSeparator.BLOCK_HEADERS_HASH)
+    ).toBuffer() as Buffer<ArrayBuffer>;
+  const blockHeadersHash = await computeUnbalancedMerkleTreeRootAsync(
+    blockHeaderHashes.map(hash => hash.toBuffer()),
+    blockHeadersHasher,
+  );
   return Fr.fromBuffer(blockHeadersHash);
 }

package/src/rollup/block_rollup_public_inputs.ts

@@ -119,6 +119,19 @@ export class BlockRollupPublicInputs {
     return this.toBuffer();
   }
 
+  toInspect() {
+    return {
+      previousArchiveRoot: this.previousArchive.root.toString(),
+      newArchiveRoot: this.newArchive.root.toString(),
+      blockHeadersHash: this.blockHeadersHash.toString(),
+      inHash: this.inHash.toString(),
+      outHash: this.outHash.toString(),
+      timestamp: this.timestamp.toString(),
+      accumulatedFees: this.accumulatedFees.toString(),
+      accumulatedManaUsed: this.accumulatedManaUsed.toString(),
+    };
+  }
+
   static get schema() {
     return bufferSchemaFor(BlockRollupPublicInputs);
   }

package/src/rollup/checkpoint_header.ts

@@ -52,6 +52,8 @@ export class CheckpointHeader {
     public gasFees: GasFees,
     /** Total mana used in the block, computed by the root rollup circuit */
     public totalManaUsed: Fr,
+    /** Total fees accrued across the checkpoint. */
+    public accumulatedFees: Fr,
   ) {}
 
   static get schema(): ZodFor<CheckpointHeader> {
@@ -68,6 +70,7 @@ export class CheckpointHeader {
         feeRecipient: schemas.AztecAddress,
         gasFees: GasFees.schema,
         totalManaUsed: schemas.Fr,
+        accumulatedFees: schemas.Fr,
       })
       .transform(CheckpointHeader.from);
   }
@@ -85,6 +88,7 @@ export class CheckpointHeader {
       fields.feeRecipient,
       fields.gasFees,
       fields.totalManaUsed,
+      fields.accumulatedFees,
     ] as const;
   }
 
@@ -107,6 +111,7 @@ export class CheckpointHeader {
       reader.readObject(AztecAddress),
       reader.readObject(GasFees),
       reader.readObject(Fr),
+      reader.readObject(Fr),
     );
   }
 
@@ -122,7 +127,8 @@ export class CheckpointHeader {
       this.coinbase.equals(other.coinbase) &&
       this.feeRecipient.equals(other.feeRecipient) &&
       this.gasFees.equals(other.gasFees) &&
-      this.totalManaUsed.equals(other.totalManaUsed)
+      this.totalManaUsed.equals(other.totalManaUsed) &&
+      this.accumulatedFees.equals(other.accumulatedFees)
     );
   }
 
@@ -151,6 +157,7 @@ export class CheckpointHeader {
       this.feeRecipient,
       this.gasFees,
       this.totalManaUsed,
+      this.accumulatedFees,
     ]);
   }
 
@@ -171,6 +178,7 @@ export class CheckpointHeader {
       feeRecipient: AztecAddress.ZERO,
       gasFees: GasFees.empty(),
       totalManaUsed: Fr.ZERO,
+      accumulatedFees: Fr.ZERO,
       ...fields,
     });
   }
@@ -188,6 +196,7 @@ export class CheckpointHeader {
       feeRecipient: new AztecAddress(Fr.random()),
       gasFees: GasFees.random(),
       totalManaUsed: new Fr(BigInt(Math.floor(Math.random() * 1000000))),
+      accumulatedFees: new Fr(BigInt(Math.floor(Math.random() * 1000000))),
       ...overrides,
     });
   }
@@ -204,7 +213,8 @@ export class CheckpointHeader {
       this.coinbase.isZero() &&
       this.feeRecipient.isZero() &&
       this.gasFees.isEmpty() &&
-      this.totalManaUsed.isZero()
+      this.totalManaUsed.isZero() &&
+      this.accumulatedFees.isZero()
     );
   }
 
@@ -233,6 +243,7 @@ export class CheckpointHeader {
       new AztecAddress(hexToBuffer(header.feeRecipient)),
       new GasFees(header.gasFees.feePerDaGas, header.gasFees.feePerL2Gas),
       new Fr(header.totalManaUsed),
+      new Fr(header.accumulatedFees),
     );
   }
 
@@ -260,6 +271,7 @@ export class CheckpointHeader {
         feePerL2Gas: this.gasFees.feePerL2Gas,
       },
       totalManaUsed: this.totalManaUsed.toBigInt(),
+      accumulatedFees: this.accumulatedFees.toBigInt(),
     };
   }
 
@@ -276,6 +288,7 @@ export class CheckpointHeader {
       feeRecipient: this.feeRecipient.toString(),
       gasFees: this.gasFees.toInspect(),
       totalManaUsed: this.totalManaUsed.toBigInt(),
+      accumulatedFees: this.accumulatedFees.toBigInt(),
     };
   }
 
@@ -292,6 +305,7 @@ export class CheckpointHeader {
   feeRecipient: ${this.feeRecipient.toString()},
   gasFees: { da:${this.gasFees.feePerDaGas}, l2:${this.gasFees.feePerL2Gas} },
   totalManaUsed: ${this.totalManaUsed.toBigInt()},
+  accumulatedFees: ${this.accumulatedFees.toBigInt()},
 }`;
   }
 }