@aztec/stdlib 5.0.0-rc.1 → 5.0.0

package/src/kernel/private_kernel_reset_dimensions.ts

@@ -68,14 +68,24 @@ export const privateKernelResetDimensionNames: DimensionName[] = [
   'PRIVATE_LOG_SILOING',
 ];
 
-export interface DimensionConfig {
-  variants: number[];
-  standalone: number[];
+export interface ResetCatalogEntry {
+  name: string;
+  dimensions: number[];
+  // Measured gate count (circuit_size) of the compiled variant. Used by the selector to pick the
+  // cheapest variant that covers the requested dimensions, e.g. if the required dimensions are
+  // `6 - 2 - 2` then a variant with capacity `8 - 2 - 2` might be cheaper than one with capacity
+  // `6 - 4 - 4`.
   cost: number;
 }
 
 // Must match the config in noir-projects/noir-protocol-circuits/private_kernel_reset_config.json
 export interface PrivateKernelResetDimensionsConfig {
-  dimensions: { [K in DimensionName]: DimensionConfig };
-  specialCases: number[][];
+  // Variants used for mid-tx resets that prevent overflow. Never the last kernel in the chain.
+  inner: ResetCatalogEntry[];
+  // Variants used as the terminal kernel for the rollup-bound private-only path. Each runs
+  // final-reset siloing and tail finalisation in one proof.
+  finalTail: ResetCatalogEntry[];
+  // Terminal variants for the public-bound path (transactions with public function calls). Runs
+  // final-reset siloing and tail-to-public partitioning by revertibility in one proof.
+  finalTailToPublic: ResetCatalogEntry[];
 }

package/src/kernel/private_kernel_reset_tail_circuit_private_inputs.ts

@@ -0,0 +1,69 @@
+import type {
+  MAX_KEY_VALIDATION_REQUESTS_PER_TX,
+  MAX_NOTE_HASH_READ_REQUESTS_PER_TX,
+  MAX_NULLIFIERS_PER_TX,
+  MAX_NULLIFIER_READ_REQUESTS_PER_TX,
+} from '@aztec/constants';
+import { bigintToUInt64BE, serializeToBuffer } from '@aztec/foundation/serialize';
+
+import type { UInt64 } from '../types/shared.js';
+import type { PrivateKernelResetHints } from './hints/private_kernel_reset_hints.js';
+import type { PaddedSideEffectAmounts, PaddedSideEffects } from './padded_side_effects.js';
+import { kernelStateIsForPublic } from './private_kernel_circuit_public_inputs.js';
+import type { PrivateKernelData } from './private_kernel_data.js';
+import { PrivateKernelResetCircuitPrivateInputsVariants } from './private_kernel_reset_circuit_private_inputs.js';
+import type { PrivateKernelResetDimensions } from './private_kernel_reset_dimensions.js';
+
+/**
+ * Input to a terminal reset+tail circuit. `isForPublic()` selects the rollup-bound (`reset_tail`)
+ * or public-bound (`reset_tail_to_public`) family.
+ */
+export class PrivateKernelResetTailCircuitPrivateInputs {
+  constructor(
+    public previousKernel: PrivateKernelData,
+    public paddedSideEffects: PaddedSideEffects,
+    public hints: PrivateKernelResetHints<
+      typeof MAX_NOTE_HASH_READ_REQUESTS_PER_TX,
+      typeof MAX_NOTE_HASH_READ_REQUESTS_PER_TX,
+      typeof MAX_NULLIFIER_READ_REQUESTS_PER_TX,
+      typeof MAX_NULLIFIER_READ_REQUESTS_PER_TX,
+      typeof MAX_KEY_VALIDATION_REQUESTS_PER_TX,
+      typeof MAX_NULLIFIERS_PER_TX
+    >,
+    public dimensions: PrivateKernelResetDimensions,
+    public paddedSideEffectAmounts: PaddedSideEffectAmounts,
+    public expirationTimestampUpperBound: UInt64,
+  ) {}
+
+  isForPublic() {
+    return kernelStateIsForPublic(this.previousKernel.publicInputs);
+  }
+
+  /**
+   * Returns a dimension-trimmed view of the reset portion of these inputs (without the tail
+   * fields). The prover uses this to feed witness generation of the variant matching the chosen
+   * dimensions.
+   */
+  trimResetToSizes() {
+    const hints = this.hints.trimToSizes(
+      this.dimensions.NOTE_HASH_PENDING_READ,
+      this.dimensions.NOTE_HASH_SETTLED_READ,
+      this.dimensions.NULLIFIER_PENDING_READ,
+      this.dimensions.NULLIFIER_SETTLED_READ,
+      this.dimensions.KEY_VALIDATION,
+      this.dimensions.TRANSIENT_DATA_SQUASHING,
+    );
+    return new PrivateKernelResetCircuitPrivateInputsVariants(this.previousKernel, this.paddedSideEffects, hints);
+  }
+
+  toBuffer() {
+    return serializeToBuffer(
+      this.previousKernel,
+      this.paddedSideEffects,
+      this.hints,
+      this.dimensions,
+      this.paddedSideEffectAmounts,
+      bigintToUInt64BE(this.expirationTimestampUpperBound),
+    );
+  }
+}

package/src/kernel/private_log_data.ts

@@ -85,7 +85,10 @@ export class ScopedPrivateLogData {
 
   static fromFields(fields: Fr[] | FieldReader) {
     const reader = FieldReader.asReader(fields);
-    return new ScopedPrivateLogData(reader.readObject(PrivateLogData), AztecAddress.fromField(reader.readField()));
+    return new ScopedPrivateLogData(
+      reader.readObject(PrivateLogData),
+      AztecAddress.fromFieldUnsafe(reader.readField()),
+    );
   }
 
   isEmpty() {

package/src/keys/derivation.ts

@@ -1,4 +1,4 @@
-import { DEFAULT_FBPK_M_HASH, DEFAULT_MSPK_M_HASH, DomainSeparator } from '@aztec/constants';
+import { DomainSeparator } from '@aztec/constants';
 import { Grumpkin } from '@aztec/foundation/crypto/grumpkin';
 import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
 import { sha512ToGrumpkinScalar } from '@aztec/foundation/crypto/sha512';
@@ -11,8 +11,11 @@ import { PublicKey, hashPublicKey } from './public_key.js';
 import { PublicKeys } from './public_keys.js';
 import { getKeyGenerator } from './utils.js';
 
-export function computeAppNullifierHidingKey(masterNullifierHidingKey: GrumpkinScalar, app: AztecAddress): Promise<Fr> {
-  return computeAppSecretKey(masterNullifierHidingKey, app, 'n'); // 'n' is the key prefix for nullifier hiding key
+export function computeAppNullifierHidingKey(
+  masterNullifierHidingSecretKey: GrumpkinScalar,
+  app: AztecAddress,
+): Promise<Fr> {
+  return computeAppSecretKey(masterNullifierHidingSecretKey, app, 'n'); // 'n' is the key prefix for nullifier hiding key
 }
 
 export function computeAppSecretKey(skM: GrumpkinScalar, app: AztecAddress, keyPrefix: KeyPrefix): Promise<Fr> {
@@ -27,7 +30,7 @@ export async function computeOvskApp(ovsk: GrumpkinScalar, app: AztecAddress): P
   return GrumpkinScalar.fromBuffer(ovskAppFr.toBuffer());
 }
 
-export function deriveMasterNullifierHidingKey(secretKey: Fr): GrumpkinScalar {
+export function deriveMasterNullifierHidingSecretKey(secretKey: Fr): GrumpkinScalar {
   return sha512ToGrumpkinScalar([secretKey, DomainSeparator.NHK_M]);
 }
 
@@ -39,9 +42,12 @@ export function deriveMasterOutgoingViewingSecretKey(secretKey: Fr): GrumpkinSca
   return sha512ToGrumpkinScalar([secretKey, DomainSeparator.OVSK_M]);
 }
 
-export function deriveSigningKey(secretKey: Fr): GrumpkinScalar {
-  // TODO(#5837): come up with a standard signing key derivation scheme instead of using ivsk_m as signing keys here
-  return sha512ToGrumpkinScalar([secretKey, DomainSeparator.IVSK_M]);
+export function deriveMasterMessageSigningSecretKey(secretKey: Fr): GrumpkinScalar {
+  return sha512ToGrumpkinScalar([secretKey, DomainSeparator.MSSK_M]);
+}
+
+export function deriveMasterFallbackSecretKey(secretKey: Fr): GrumpkinScalar {
+  return sha512ToGrumpkinScalar([secretKey, DomainSeparator.FBSK_M]);
 }
 
 export function computePreaddress(publicKeysHash: Fr, partialAddress: Fr) {
@@ -85,52 +91,91 @@ export async function computeAddressSecret(preaddress: Fr, ivsk: Fq) {
 }
 
 export function derivePublicKeyFromSecretKey(secretKey: Fq): Promise<PublicKey> {
+  // 0 * G is the point at infinity. The WASM encodes infinity with an out-of-field x coordinate that Point cannot
+  // deserialize, so return the point directly instead of calling into it.
+  if (secretKey.isZero()) {
+    return Promise.resolve(PublicKey.INFINITY);
+  }
   return Grumpkin.mul(Grumpkin.generator, secretKey);
 }
 
+/**
+ * The six master secret keys that fully define an account's privacy keys.
+ */
+export type MasterSecretKeys = {
+  masterNullifierHidingSecretKey: GrumpkinScalar;
+  masterIncomingViewingSecretKey: GrumpkinScalar;
+  masterOutgoingViewingSecretKey: GrumpkinScalar;
+  masterTaggingSecretKey: GrumpkinScalar;
+  masterMessageSigningSecretKey: GrumpkinScalar;
+  masterFallbackSecretKey: GrumpkinScalar;
+};
+
 /**
  * Computes secret and public keys and public keys hash from a secret key.
  * @param secretKey - The secret key to derive keys from.
  * @returns The derived keys.
  */
-export async function deriveKeys(secretKey: Fr) {
+export function deriveKeys(secretKey: Fr) {
   // First we derive master secret/hiding keys -  we use sha512 here because this derivation will never take place
   // in a circuit
-  const masterNullifierHidingKey = deriveMasterNullifierHidingKey(secretKey);
-  const masterIncomingViewingSecretKey = deriveMasterIncomingViewingSecretKey(secretKey);
-  const masterOutgoingViewingSecretKey = deriveMasterOutgoingViewingSecretKey(secretKey);
-  const masterTaggingSecretKey = sha512ToGrumpkinScalar([secretKey, DomainSeparator.TSK_M]);
+  return deriveKeysFromMasterSecretKeys({
+    masterNullifierHidingSecretKey: deriveMasterNullifierHidingSecretKey(secretKey),
+    masterIncomingViewingSecretKey: deriveMasterIncomingViewingSecretKey(secretKey),
+    masterOutgoingViewingSecretKey: deriveMasterOutgoingViewingSecretKey(secretKey),
+    masterTaggingSecretKey: sha512ToGrumpkinScalar([secretKey, DomainSeparator.TSK_M]),
+    masterMessageSigningSecretKey: deriveMasterMessageSigningSecretKey(secretKey),
+    masterFallbackSecretKey: deriveMasterFallbackSecretKey(secretKey),
+  });
+}
 
-  // Then we derive master public keys
-  const masterNullifierPublicKey = await derivePublicKeyFromSecretKey(masterNullifierHidingKey);
+/**
+ * Derives the master public keys and the {@link PublicKeys} struct from a set of master secret keys.
+ * @param secretKeys - The master secret keys to derive public keys from.
+ * @returns The provided secret keys alongside the derived public keys.
+ */
+export async function deriveKeysFromMasterSecretKeys(secretKeys: MasterSecretKeys) {
+  const {
+    masterNullifierHidingSecretKey,
+    masterIncomingViewingSecretKey,
+    masterOutgoingViewingSecretKey,
+    masterTaggingSecretKey,
+    masterMessageSigningSecretKey,
+    masterFallbackSecretKey,
+  } = secretKeys;
+
+  const masterNullifierHidingPublicKey = await derivePublicKeyFromSecretKey(masterNullifierHidingSecretKey);
   const masterIncomingViewingPublicKey = await derivePublicKeyFromSecretKey(masterIncomingViewingSecretKey);
   const masterOutgoingViewingPublicKey = await derivePublicKeyFromSecretKey(masterOutgoingViewingSecretKey);
   const masterTaggingPublicKey = await derivePublicKeyFromSecretKey(masterTaggingSecretKey);
+  const masterMessageSigningPublicKey = await derivePublicKeyFromSecretKey(masterMessageSigningSecretKey);
+  const masterFallbackPublicKey = await derivePublicKeyFromSecretKey(masterFallbackSecretKey);
 
   // The non-owner-visible PublicKeys carries hashes for npk/ovpk/tpk/mspk/fbpk and the raw
-  // point only for ivpk_m. The npk/ovpk/tpk raw points are also returned alongside so the key
-  // store can persist them under `${account}-{n|ov|t}pk_m` (only their hashes live in publicKeys).
+  // point only for ivpk_m. The npk/ovpk/tpk/mspk/fbpk raw points are also returned alongside so the key
+  // store can persist them under `${account}-{n|ov|t|ms|fb}pk_m` (only their hashes live in publicKeys).
   // The ivpk_m point isn't returned separately because it already lives in publicKeys.ivpkM.
-  //
-  // TODO: There isn't a derivation path for the message signing(msk) and fallback(fbk) keys yet. So we just use the the
-  // default values for now.
   const publicKeys = new PublicKeys(
-    await hashPublicKey(masterNullifierPublicKey),
+    await hashPublicKey(masterNullifierHidingPublicKey),
     masterIncomingViewingPublicKey,
     await hashPublicKey(masterOutgoingViewingPublicKey),
     await hashPublicKey(masterTaggingPublicKey),
-    new Fr(DEFAULT_MSPK_M_HASH),
-    new Fr(DEFAULT_FBPK_M_HASH),
+    await hashPublicKey(masterMessageSigningPublicKey),
+    await hashPublicKey(masterFallbackPublicKey),
   );
 
   return {
-    masterNullifierHidingKey,
+    masterNullifierHidingSecretKey,
     masterIncomingViewingSecretKey,
     masterOutgoingViewingSecretKey,
     masterTaggingSecretKey,
-    masterNullifierPublicKey,
+    masterMessageSigningSecretKey,
+    masterFallbackSecretKey,
+    masterNullifierHidingPublicKey,
     masterOutgoingViewingPublicKey,
     masterTaggingPublicKey,
+    masterMessageSigningPublicKey,
+    masterFallbackPublicKey,
     publicKeys,
   };
 }

package/src/logs/app_tagging_secret.ts

@@ -9,6 +9,7 @@ import { AztecAddress } from '../aztec-address/index.js';
 import type { CompleteAddress } from '../contract/complete_address.js';
 import { computeAddressSecret, computePreaddress } from '../keys/derivation.js';
 import { AppTaggingSecretKind } from './app_tagging_secret_kind.js';
+import { appSiloEcdhSharedSecretPoint } from './shared_secret_derivation.js';
 
 const AppTaggingSecretKindSchema = z.union([
   z.literal(AppTaggingSecretKind.UNCONSTRAINED),
@@ -30,17 +31,49 @@ export class AppTaggingSecret {
   ) {}
 
   /**
-   * Derives shared tagging secret and from that, the app address and recipient derives the directional app tagging
-   * secret. Returns undefined if `externalAddress` is an invalid address.
+   * Derives an app-siloed, recipient-directional tagging secret from a shared tagging secret point.
    *
-   * @param localAddress - The complete address of entity A in the shared tagging secret derivation scheme
-   * @param localIvsk - The incoming viewing secret key of entity A
-   * @param externalAddress - The address of entity B in the shared tagging secret derivation scheme
+   * App-silos the point via {@link appSiloEcdhSharedSecretPoint}, then directs the result to `recipient`:
+   * `h([s_app, recipient])`. The directional step stops a symmetric shared secret (ECDH against an address, or an
+   * arbitrary registered point) from colliding bidirectionally, so two parties never share a tag sequence.
+   *
+   * The point is obtained either via {@link computeSharedTaggingSecret} (an ECDH key exchange against a sender) or
+   * registered directly as a pre-shared secret.
+   *
+   * @param taggingSecretPoint - The shared tagging secret point (ECDH output, or a directly registered pre-shared secret)
    * @param app - Contract address to silo the secret to
    * @param recipient - Recipient of the log. Defines the "direction of the secret".
    * @returns The secret that can be used along with an index to compute a tag to be included in a log.
    */
-  static async computeUnconstrained(
+  static async computeDirectional(
+    taggingSecretPoint: Point,
+    app: AztecAddress,
+    recipient: AztecAddress,
+  ): Promise<AppTaggingSecret> {
+    const appSiloedSecret = await appSiloEcdhSharedSecretPoint(taggingSecretPoint, app);
+    const directionalAppTaggingSecret = await poseidon2Hash([appSiloedSecret, recipient]);
+
+    return new AppTaggingSecret(directionalAppTaggingSecret, app);
+  }
+
+  /**
+   * Derives the bare app-siloed tagging secret from a shared secret point via {@link appSiloEcdhSharedSecretPoint},
+   * under the given delivery-mode kind.
+   */
+  static async computeAppSiloed(
+    taggingSecretPoint: Point,
+    app: AztecAddress,
+    kind: AppTaggingSecretKind,
+  ): Promise<AppTaggingSecret> {
+    return new AppTaggingSecret(await appSiloEcdhSharedSecretPoint(taggingSecretPoint, app), app, kind);
+  }
+
+  /**
+   * Derives the tagging secret for `(externalAddress, recipient, app)` by performing an ECDH key exchange against
+   * `externalAddress` to obtain the shared point, then siloing and directing it via {@link computeDirectional}.
+   * Returns undefined if `externalAddress` is not a valid address.
+   */
+  static async computeViaEcdh(
     localAddress: CompleteAddress,
     localIvsk: Fq,
     externalAddress: AztecAddress,
@@ -52,36 +85,24 @@ export class AppTaggingSecret {
       return undefined;
     }
 
-    const appTaggingSecret = await poseidon2Hash([taggingSecretPoint.x, taggingSecretPoint.y, app]);
-    const directionalAppTaggingSecret = await poseidon2Hash([appTaggingSecret, recipient]);
-
-    return new AppTaggingSecret(directionalAppTaggingSecret, app);
+    return AppTaggingSecret.computeDirectional(taggingSecretPoint, app, recipient);
   }
 
   toString(): string {
-    // TODO(F-680): Migrate stored tagging keys and remove the legacy unconstrained format.
-    if (this.kind === AppTaggingSecretKind.UNCONSTRAINED) {
-      return `${this.secret.toString()}:${this.app.toString()}`;
-    }
     return `${this.kind}:${this.secret.toString()}:${this.app.toString()}`;
   }
 
   static fromString(str: string): AppTaggingSecret {
     const parts = str.split(':');
-    if (parts.length === 2) {
-      // TODO(F-680): Remove legacy two-part parsing after stored tagging keys are migrated.
-      const [secretStr, appStr] = parts;
-      return new AppTaggingSecret(Fr.fromString(secretStr), AztecAddress.fromString(appStr));
-    }
-    if (parts.length === 3) {
-      const [kindStr, secretStr, appStr] = parts;
-      return new AppTaggingSecret(
-        Fr.fromString(secretStr),
-        AztecAddress.fromString(appStr),
-        appTaggingSecretKindFromString(kindStr),
-      );
+    if (parts.length !== 3) {
+      throw new Error(`Invalid AppTaggingSecret string: ${str}`);
     }
-    throw new Error(`Invalid AppTaggingSecret string: ${str}`);
+    const [kindStr, secretStr, appStr] = parts;
+    return new AppTaggingSecret(
+      Fr.fromString(secretStr),
+      AztecAddress.fromStringUnsafe(appStr),
+      appTaggingSecretKindFromString(kindStr),
+    );
   }
 }
 
@@ -111,18 +132,17 @@ function appTaggingSecretKindFromString(kind: string): AppTaggingSecretKind {
   }
 }
 
-// Returns shared tagging secret computed with Diffie-Hellman key exchange, or undefined if `externalAddress` is an
-// invalid address.
-async function computeSharedTaggingSecret(
+/**
+ * Computes the shared tagging secret point between a local address (i.e. one for which the privacy keys are known) and
+ * an external one via a Diffie-Hellman key exchange.
+ *
+ * Returns undefined if `externalAddress` is an invalid address.
+ */
+export async function computeSharedTaggingSecret(
   localAddress: CompleteAddress,
   localIvsk: Fq,
   externalAddress: AztecAddress,
 ): Promise<Point | undefined> {
-  // Given A (local complete address) -> B (external address) and h == preaddress
-  // Compute shared secret as S = (h_A + local_ivsk_A) * Addr_Point_B
-
-  const knownPreaddress = await computePreaddress(await localAddress.publicKeys.hash(), localAddress.partialAddress);
-
   // An invalid address has no corresponding address point
   if (!(await externalAddress.isValid())) {
     return undefined;
@@ -130,8 +150,11 @@ async function computeSharedTaggingSecret(
 
   const externalAddressPoint = await externalAddress.toAddressPoint();
 
-  // Beware! h_a + local_ivsk_a (also known as the address secret) can lead to an address point with a negative
-  // y-coordinate, since there's two possible candidates computeAddressSecret takes care of selecting the one that
-  // leads to a positive y-coordinate, which is the only valid address point
-  return Grumpkin.mul(externalAddressPoint, await computeAddressSecret(knownPreaddress, localIvsk));
+  const localPreaddress = await computePreaddress(await localAddress.publicKeys.hash(), localAddress.partialAddress);
+  const localAddressSecret = await computeAddressSecret(localPreaddress, localIvsk);
+
+  // For a given local address A and external address B, the shared tagging secret S is (h_A + ivsk_A) * Addr_Point_B
+  // (conceptually, in reality we don't use h_A + ivsk_A directly but rather the actual address secret, which is the
+  // same but with an optional sign adjustment to prevent A's address point from having a negative y-coordinate).
+  return Grumpkin.mul(externalAddressPoint, localAddressSecret);
 }

package/src/logs/contract_class_log.ts

@@ -138,15 +138,6 @@ export class ContractClassLog {
     );
   }
 
-  static fromFields(fields: Fr[] | FieldReader) {
-    const reader = FieldReader.asReader(fields);
-    return new ContractClassLog(
-      reader.readObject(AztecAddress),
-      reader.readObject(ContractClassLogFields),
-      reader.readU32(),
-    );
-  }
-
   getEmittedFields() {
     return this.fields.getEmittedFields(this.emittedLength);
   }

package/src/logs/index.ts

@@ -5,13 +5,11 @@ export * from './tagging_index_range.js';
 export * from './contract_class_log.js';
 export * from './public_log.js';
 export * from './private_log.js';
-export * from './pending_tagged_log.js';
 export * from './log_result.js';
 export * from './log_cursor.js';
 export * from './logs_query.js';
 export * from './query_all_logs_by_tags.js';
 export * from './shared_secret_derivation.js';
-export * from './message_context.js';
 export * from './debug_log.js';
 export * from './debug_log_store.js';
 export * from './tag.js';

package/src/logs/shared_secret_derivation.ts

@@ -2,16 +2,28 @@ import { DomainSeparator } from '@aztec/constants';
 import { Grumpkin } from '@aztec/foundation/crypto/grumpkin';
 import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
 import type { Fr } from '@aztec/foundation/curves/bn254';
-import type { GrumpkinScalar } from '@aztec/foundation/curves/grumpkin';
+import type { GrumpkinScalar, Point } from '@aztec/foundation/curves/grumpkin';
 
 import type { AztecAddress } from '../aztec-address/index.js';
 import type { PublicKey } from '../keys/public_key.js';
 
 /**
- * Derives an app-siloed ECDH shared secret.
+ * Derives the raw ECDH shared secret point `S = secretKey * publicKey`.
  *
- * Computes the raw ECDH shared secret `S = secretKey * publicKey`, then app-silos it:
- * `s_app = h(DOM_SEP__APP_SILOED_ECDH_SHARED_SECRET, S.x, S.y, contractAddress)`
+ * @throws If the publicKey is zero.
+ */
+export function deriveEcdhSharedSecretPoint(secretKey: GrumpkinScalar, publicKey: PublicKey): Promise<Point> {
+  if (publicKey.isZero()) {
+    throw new Error(
+      `Attempting to derive a shared secret with a zero public key. You have probably passed a zero public key in your Noir code somewhere thinking that the note won't be broadcast... but it was.`,
+    );
+  }
+  return Grumpkin.mul(publicKey, secretKey);
+}
+
+/**
+ * Derives an app-siloed ECDH shared secret from keys: ECDHs `S = secretKey * publicKey` via
+ * {@link deriveEcdhSharedSecretPoint}, then app-silos it via {@link appSiloEcdhSharedSecretPoint}.
  *
  * @param secretKey - The secret key used to derive shared secret.
  * @param publicKey - The public key used to derive shared secret.
@@ -19,19 +31,23 @@ import type { PublicKey } from '../keys/public_key.js';
  * @returns The app-siloed shared secret as a Field.
  * @throws If the publicKey is zero.
  */
-export async function deriveAppSiloedSharedSecret(
+export async function appSiloEcdhSharedSecret(
   secretKey: GrumpkinScalar,
   publicKey: PublicKey,
   contractAddress: AztecAddress,
 ): Promise<Fr> {
-  if (publicKey.isZero()) {
-    throw new Error(
-      `Attempting to derive a shared secret with a zero public key. You have probably passed a zero public key in your Noir code somewhere thinking that the note won't be broadcast... but it was.`,
-    );
-  }
-  const rawSharedSecret = await Grumpkin.mul(publicKey, secretKey);
-  return poseidon2HashWithSeparator(
-    [rawSharedSecret.x, rawSharedSecret.y, contractAddress],
-    DomainSeparator.APP_SILOED_ECDH_SHARED_SECRET,
-  );
+  const rawSharedSecret = await deriveEcdhSharedSecretPoint(secretKey, publicKey);
+  return appSiloEcdhSharedSecretPoint(rawSharedSecret, contractAddress);
+}
+
+/**
+ * App-silos a shared secret point: `s_app = h(DOM_SEP__APP_SILOED_ECDH_SHARED_SECRET, S.x, S.y, app)`.
+ *
+ * Mirrors `compute_app_siloed_shared_secret` in aztec-nr.
+ *
+ * @param point - The raw shared secret point `S`.
+ * @param app - The contract address to silo to.
+ */
+export function appSiloEcdhSharedSecretPoint(point: Point, app: AztecAddress): Promise<Fr> {
+  return poseidon2HashWithSeparator([point.x, point.y, app], DomainSeparator.APP_SILOED_ECDH_SHARED_SECRET);
 }

package/src/messaging/l1_to_l2_message.ts

@@ -1,4 +1,5 @@
-import type { L1_TO_L2_MSG_TREE_HEIGHT } from '@aztec/constants';
+import { DomainSeparator, type L1_TO_L2_MSG_TREE_HEIGHT } from '@aztec/constants';
+import { poseidon2HashWithSeparator } from '@aztec/foundation/crypto/poseidon';
 import { sha256ToField } from '@aztec/foundation/crypto/sha256';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { BufferReader, serializeToBuffer } from '@aztec/foundation/serialize';
@@ -7,7 +8,7 @@ import { SiblingPath } from '@aztec/foundation/trees';
 
 import type { AztecAddress } from '../aztec-address/index.js';
 import type { BlockParameter } from '../block/block_parameter.js';
-import { computeL1ToL2MessageNullifier } from '../hash/hash.js';
+import { siloNullifier } from '../hash/hash.js';
 import type { AztecNode } from '../interfaces/aztec-node.js';
 import { MerkleTreeId } from '../trees/merkle_tree_id.js';
 import { L1Actor } from './l1_actor.js';
@@ -74,28 +75,65 @@ export class L1ToL2Message {
   }
 }
 
-// This functionality is not on the node because we do not want to pass the node the secret, and give the node the ability to derive a valid nullifer for an L1 to L2 message.
-export async function getNonNullifiedL1ToL2MessageWitness(
+/**
+ * The unsiloed nullifier a message consumer derives, together with the contract address needed to silo it.
+ */
+export interface UnsiloedMessageNullifier {
+  contractAddress: AztecAddress;
+  nullifier: Fr;
+}
+
+/**
+ * Computes the unsiloed nullifier that the fee juice contract (and any consumer following the same scheme) derives when
+ * consuming an L1 to L2 message.
+ *
+ * This is not a general-purpose utility: other contracts may derive the secret hash and hence the nullifier
+ * differently. The result is unsiloed — callers silo it (with the consuming contract's address) before looking it up
+ * in the nullifier tree.
+ */
+export function computeFeeJuiceMessageNullifier(messageHash: Fr, secret: Fr): Promise<Fr> {
+  return poseidon2HashWithSeparator([messageHash, secret], DomainSeparator.MESSAGE_NULLIFIER);
+}
+
+/**
+ * Fetches the membership witness of an L1 to L2 message. When `unsiloedNullifier` is provided, the message is
+ * additionally required to be un-nullified.
+ */
+export async function getL1ToL2MessageWitness(
   node: AztecNode,
-  contractAddress: AztecAddress,
   messageHash: Fr,
-  secret: Fr,
+  unsiloedNullifier?: UnsiloedMessageNullifier,
   referenceBlock: BlockParameter = 'latest',
 ): Promise<[bigint, SiblingPath<typeof L1_TO_L2_MSG_TREE_HEIGHT>]> {
-  const messageNullifier = await computeL1ToL2MessageNullifier(contractAddress, messageHash, secret);
-
-  const [l1ToL2Response, nullifierResponse] = await Promise.all([
-    node.getL1ToL2MessageMembershipWitness(referenceBlock, messageHash),
-    node.findLeavesIndexes(referenceBlock, MerkleTreeId.NULLIFIER_TREE, [messageNullifier]),
-  ]);
+  // Both requests are dispatched before awaiting so they run concurrently.
+  const l1ToL2ResponsePromise = node.getL1ToL2MessageMembershipWitness(referenceBlock, messageHash);
+  const nullifierResponsePromise = unsiloedNullifier
+    ? siloNullifier(unsiloedNullifier.contractAddress, unsiloedNullifier.nullifier).then(siloed =>
+        node.findLeavesIndexes(referenceBlock, MerkleTreeId.NULLIFIER_TREE, [siloed]),
+      )
+    : undefined;
 
+  const l1ToL2Response = await l1ToL2ResponsePromise;
   if (!l1ToL2Response) {
     throw new Error(`No L1 to L2 message found for message hash ${messageHash.toString()}`);
   }
 
-  if (nullifierResponse[0] !== undefined) {
+  const nullifierResponse = await nullifierResponsePromise;
+  if (nullifierResponse?.[0] !== undefined) {
     throw new Error(`No non-nullified L1 to L2 message found for message hash ${messageHash.toString()}`);
   }
 
   return l1ToL2Response;
 }
+
+// This functionality is not on the node because we do not want to pass the node the secret, and give the node the ability to derive a valid nullifer for an L1 to L2 message.
+export async function getNonNullifiedL1ToL2MessageWitness(
+  node: AztecNode,
+  contractAddress: AztecAddress,
+  messageHash: Fr,
+  secret: Fr,
+  referenceBlock: BlockParameter = 'latest',
+): Promise<[bigint, SiblingPath<typeof L1_TO_L2_MSG_TREE_HEIGHT>]> {
+  const nullifier = await computeFeeJuiceMessageNullifier(messageHash, secret);
+  return getL1ToL2MessageWitness(node, messageHash, { contractAddress, nullifier }, referenceBlock);
+}

package/src/p2p/attestation_utils.ts

@@ -1,3 +1,4 @@
+import { normalizeSignature } from '@aztec/foundation/crypto/secp256k1-signer';
 import type { EthAddress } from '@aztec/foundation/eth-address';
 
 import { CommitteeAttestation } from '../block/index.js';
@@ -18,9 +19,15 @@ export function orderAttestations(
   for (const attestation of attestations) {
     const sender = attestation.getSender();
     if (sender) {
+      // Canonicalize the recovery byte to v ∈ {27, 28} before it reaches the L1 bundle. A committee
+      // member (or a peer mutating the byte in flight) can emit an equivalent signature in yParity form
+      // (v = 0/1); left as-is it makes `packAttestations` (empty iff v === 0) and `getSigners` (empty iff
+      // r,s,v all zero) disagree, reverting `propose()` with SignersSizeMismatch, and a v = 1 byte would
+      // later revert epoch proving in ECDSA.recover. `sender` recovered, so the signature is non-empty
+      // and low-s, and normalizeSignature preserves the recovered address.
       attestationMap.set(
         sender.toString(),
-        CommitteeAttestation.fromAddressAndSignature(sender, attestation.signature),
+        CommitteeAttestation.fromAddressAndSignature(sender, normalizeSignature(attestation.signature)),
       );
     }
   }