@coordination-network/contracts 0.0.1 → 0.1.0

package/ApprovedIssuerSet.sol

@@ -96,9 +96,9 @@ contract ApprovedIssuerSet is IApprovedIssuerSet {
     uint256 public rootDuration;
 
     /// @notice The instant at or before which no superseded root is ever acceptable again.
-    /// @dev Bumped by {retireAllIssuerKeys} on every removal of a member that ever held a key, so
-    /// removing one member closes off every root superseded in the window before removal, not just the
-    /// one root the removal directly replaces.
+    /// @dev Bumped by {retireIssuerKeyImmediately}, and by {retireAllIssuerKeys} on every removal of a
+    /// member that ever held a key, so either closes off every root superseded in the window before it,
+    /// not just the one root it directly replaces.
     uint256 public rootsInvalidatedAt;
 
     /// @dev Whether a member has ever published a live key. Set once, never cleared, so
@@ -151,6 +151,8 @@ contract ApprovedIssuerSet is IApprovedIssuerSet {
     /// @notice Publishes a member's signing key into the set.
     /// @dev Superseded keys stay in the set, so a rotation does not invalidate credentials the old key
     /// already signed. Retire the old key explicitly to end its life.
+    ///
+    /// Nothing proves the caller holds the key, so one member can publish another's first.
     /// @param memberNetworkId The publishing member.
     /// @param publicKeyX The Baby Jubjub public key's x coordinate.
     /// @param publicKeyY The Baby Jubjub public key's y coordinate.
@@ -257,7 +259,7 @@ contract ApprovedIssuerSet is IApprovedIssuerSet {
     /// @param memberNetworkId The member the key belongs to.
     /// @param leaf The commitment to retire.
     function retireIssuerKey(bytes32 memberNetworkId, uint256 leaf)
-        external
+        public
         onlyAuthAddressOrGovernance(memberNetworkId)
     {
         _detachFromMember(memberNetworkId, leaf);
@@ -279,6 +281,16 @@ contract ApprovedIssuerSet is IApprovedIssuerSet {
         emit IssuerKeyRetired(memberNetworkId, leaf, newRoot);
     }
 
+    /// @notice Retires a signing key immediately and stops every superseded root being accepted at once.
+    /// @dev Useful in cases of key theft so prevents attack using key during grace window. In-flight
+    /// proofs against old root must be rebuilt.
+    /// @param memberNetworkId The network member the key belongs to.
+    /// @param leaf The commitment to retire.
+    function retireIssuerKeyImmediately(bytes32 memberNetworkId, uint256 leaf) external {
+        rootsInvalidatedAt = block.timestamp;
+        retireIssuerKey(memberNetworkId, leaf);
+    }
+
     /// @inheritdoc IApprovedIssuerSet
     /// @dev Callable only by the registry, which invokes it while removing a member so that removal
     /// and the loss of signing power are one transaction. Two transactions would leave a window in
@@ -351,6 +363,11 @@ contract ApprovedIssuerSet is IApprovedIssuerSet {
     }
 
     /// @notice Sets how long a superseded root stays acceptable.
+    /// @dev The new duration applies to every past root, not only to roots superseded after this
+    /// call, so raising it makes older roots valid again and lowering it invalidates proofs that are
+    /// already in flight. Roots closed by {rootsInvalidatedAt} or whose stamp was deleted stay
+    /// rejected either way. It is also how long a retired key can keep backing proofs with an older
+    /// root, so it should be kept as short as verifiers can tolerate.
     /// @param newRootDuration The new window, in seconds.
     function updateRootDuration(uint256 newRootDuration) external {
         if (msg.sender != NetworkMemberRegistry(memberRegistry).owner()) revert UnauthorizedCaller();
@@ -382,9 +399,11 @@ contract ApprovedIssuerSet is IApprovedIssuerSet {
 
         // Strict, so a `rootDuration` of zero means no grace at all rather than a one-timestamp
         // window. The window runs from the moment the root stopped being current, so every root gets
-        // the same full window however long it was current.
+        // the same full window however long it was current. `supersededAt` is never in the future,
+        // so the subtraction cannot underflow, and unlike `supersededAt + rootDuration` it cannot
+        // overflow for any `rootDuration`.
         // forge-lint: disable-next-line(block-timestamp)
-        return block.timestamp < supersededAt + rootDuration;
+        return block.timestamp - supersededAt < rootDuration;
     }
 
     /// @notice The live signing keys of a member.
@@ -594,7 +613,7 @@ contract ApprovedIssuerSet is IApprovedIssuerSet {
         }
     }
 
-    /// @dev Rejects a public key that is not a Baby Jubjub point of full order.
+    /// @dev Rejects a public key that is outside the field, off the curve, or of low order.
     ///
     /// The tree would accept any field element as a leaf, so without the curve check the set could
     /// hold a commitment to a point that does not exist.
@@ -607,6 +626,12 @@ contract ApprovedIssuerSet is IApprovedIssuerSet {
     /// verify as issued by an approved member, and issuer anonymity means no verifier could say whose
     /// key to retire.
     ///
+    /// It does not reject a mixed-order key, a prime-order point plus a nonzero torsion point. The
+    /// circuit's EdDSA (noir-lang/eddsa 7e206c95) multiplies the key by 8 before verifying, so only the
+    /// holder of its prime-order part's secret can sign under such a key. The only effect is that one
+    /// secret can take several leaves, at most eight live ones, one per torsion point, possibly under
+    /// different members. The TypeScript `issuer-set` refuses to publish them.
+    ///
     /// @param publicKeyX The x coordinate.
     /// @param publicKeyY The y coordinate.
     function _assertOnCurve(uint256 publicKeyX, uint256 publicKeyY) private pure {

package/NetworkMemberGovernance.sol

@@ -18,7 +18,9 @@ import { NetworkMemberRegistry } from "./NetworkMemberRegistry.sol";
 /// Here they are one call whose behaviour is fixed in code:
 ///
 ///  - the threshold is not an input. {governanceThreshold} computes it from the Safe's live owner
-///    count, so no caller can lower it;
+///    count, so no call through this module can lower it. Direct Safe calls can, so admission and
+///    removal also refuse to run while the Safe's threshold is not {governanceThreshold} of its
+///    owners;
 ///  - removal reads the member's commitment and signer from the registry, so it cannot be pointed at
 ///    the wrong leaf or the wrong owner;
 ///  - nothing takes arbitrary calldata, so a quorum approving `admitMember` is approving an admission
@@ -78,6 +80,7 @@ contract NetworkMemberGovernance {
     error NotApproved(bytes32 memberNetworkId);
     error MemberSetTooSmall(uint256 memberCountAfter);
     error MemberCountChanged(uint256 expected, uint256 actual);
+    error ThresholdMismatch(uint256 expected, uint256 actual);
     error NotASafeOwner(address account);
     error SafeCallFailed(bytes returnData);
 
@@ -122,25 +125,28 @@ contract NetworkMemberGovernance {
     /// @notice Admits a network member: its record, its group leaf, and its seat at the Safe.
     /// @dev One call, so a quorum cannot be talked into signing a differently shaped batch, and the
     /// threshold comes from {governanceThreshold} rather than from the calldata.
-    /// @param memberNetworkId The member to admit.
+    /// @param accountKeyX The X coordinate of the member's account key.
+    /// @param accountKeyY The Y coordinate of the member's account key.
     /// @param semaphoreCommitment Its Semaphore identity commitment.
     /// @param governanceSigner The address that becomes its seat at the Safe.
     /// @param expectedMemberCount The member count this transaction was built against. Not a policy
     /// input: the threshold is still computed, and this only makes the transaction stale the moment the
     /// member set changes, so signatures cannot carry over to a set their signers never saw.
     function admitMember(
-        bytes32 memberNetworkId,
+        uint256 accountKeyX,
+        uint256 accountKeyY,
         uint256 semaphoreCommitment,
         address governanceSigner,
         uint256 expectedMemberCount
     ) external onlySafe {
-        uint256 memberCount = _checkMemberCount(expectedMemberCount);
+        uint256 memberCount = _checkSafeState(expectedMemberCount);
         uint256 threshold = governanceThreshold(memberCount + 1);
 
         _execFromSafe(
             address(REGISTRY),
             abi.encodeCall(
-                NetworkMemberRegistry.approveNetworkMember, (memberNetworkId, semaphoreCommitment, governanceSigner)
+                NetworkMemberRegistry.approveNetworkMember,
+                (accountKeyX, accountKeyY, semaphoreCommitment, governanceSigner)
             )
         );
         _execFromSafe(address(GROUP), abi.encodeCall(NetworkMemberGroup.addNetworkMember, (semaphoreCommitment)));
@@ -148,7 +154,7 @@ contract NetworkMemberGovernance {
             address(SAFE), abi.encodeCall(ISafeOwnerManager.addOwnerWithThreshold, (governanceSigner, threshold))
         );
 
-        emit NetworkMemberAdmitted(memberNetworkId, governanceSigner, threshold);
+        emit NetworkMemberAdmitted(REGISTRY.memberNetworkIdOf(accountKeyX, accountKeyY), governanceSigner, threshold);
     }
 
     /// @notice Removes a network member from all three places.
@@ -163,7 +169,7 @@ contract NetworkMemberGovernance {
         external
         onlySafe
     {
-        _checkMemberCount(expectedMemberCount);
+        _checkSafeState(expectedMemberCount);
 
         address governanceSigner = REGISTRY.governanceSignerOf(memberNetworkId);
         if (governanceSigner == address(0)) revert NotApproved(memberNetworkId);
@@ -197,13 +203,22 @@ contract NetworkMemberGovernance {
     }
 
     /// @dev Reverts unless the Safe's owner set is still the size the caller's transaction was built
-    /// against. {exitNetwork} needs no such check: it carries no signatures to go stale.
+    /// against, and its threshold is still {governanceThreshold} of that set. {exitNetwork} needs no
+    /// such check: it carries no signatures to go stale, and a member must always be able to leave.
+    ///
+    /// The Safe can change its own threshold directly, outside this contract. This cannot stop that,
+    /// but it refuses to act on a Safe that has drifted, so the drift surfaces at the next governance
+    /// action instead of persisting silently. A quorum restores it with `changeThreshold`.
     /// @param expectedMemberCount The member count the transaction assumed.
     /// @return memberCount The live member count, equal to `expectedMemberCount`.
-    function _checkMemberCount(uint256 expectedMemberCount) internal view returns (uint256 memberCount) {
+    function _checkSafeState(uint256 expectedMemberCount) internal view returns (uint256 memberCount) {
         memberCount = SAFE.getOwners().length;
 
         if (memberCount != expectedMemberCount) revert MemberCountChanged(expectedMemberCount, memberCount);
+
+        uint256 expected = governanceThreshold(memberCount);
+        uint256 threshold = SAFE.getThreshold();
+        if (threshold != expected) revert ThresholdMismatch(expected, threshold);
     }
 
     /// @dev Takes a member out of the registry, the group and the Safe's owner set, and moves the

package/NetworkMemberRegistry.sol

@@ -24,11 +24,19 @@ import { IApprovedIssuerSet } from "./interfaces/IApprovedIssuerSet.sol";
 /// without being a member. This contract records which keys belong to which member; it holds neither
 /// the group nor the owner set.
 ///
-/// The onboarding procedure is in `docs/network-member-onboarding.md`.
+/// A member's id is `keccak256(X || Y)` of its account key, a secp256k1 public key, and the key's
+/// Ethereum address is the member's auth address. Both write paths take the key rather than the id, so
+/// an id always has exactly one key behind it and no id exists that no key derives.
+///
+/// The onboarding procedure is in `docs/configuration/network-member-onboarding.md`.
 contract NetworkMemberRegistry is Ownable2Step {
     uint256 public constant META_STEALTH_ADDRESS_LENGTH = 66;
 
-    /// @notice The address that maintains a network member's record. Initialised from the networkId
+    /// @dev The secp256k1 field prime.
+    uint256 internal constant SECP256K1_P = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F;
+
+    /// @notice The address that maintains a network member's record. The Ethereum address of the account key
+    /// the member's id is derived from.
     mapping(bytes32 memberNetworkId => address authAddress) public networkMemberAuthAddress;
 
     /// @notice The network member networkId => meta-stealth address mapping.
@@ -48,7 +56,12 @@ contract NetworkMemberRegistry is Ownable2Step {
     IApprovedIssuerSet public approvedIssuerSet;
 
     event NetworkMemberJoinRequested(
-        bytes32 indexed memberNetworkId, uint256 semaphoreCommitment, address governanceSigner, string metadataURI
+        bytes32 indexed memberNetworkId,
+        uint256 accountKeyX,
+        uint256 accountKeyY,
+        uint256 semaphoreCommitment,
+        address governanceSigner,
+        string metadataURI
     );
     event NetworkMemberApproved(bytes32 indexed memberNetworkId);
     event NetworkMemberRemoved(bytes32 indexed memberNetworkId);
@@ -60,6 +73,7 @@ contract NetworkMemberRegistry is Ownable2Step {
     error NotApproved(bytes32 memberNetworkId);
     error InvalidMetaStealthAddressLength();
     error UnauthorizedCaller();
+    error AccountKeyNotOnCurve();
     error ZeroGovernanceSigner();
     error ZeroSemaphoreCommitment();
     error GovernanceSignerIsAuthAddress();
@@ -92,13 +106,22 @@ contract NetworkMemberRegistry is Ownable2Step {
         return networkMemberAuthAddress[memberNetworkId] != address(0);
     }
 
-    /// @notice Asks the approved network members to admit `memberNetworkId`. Permissionless, and
-    /// callable by anyone holding the key behind the networkId.
+    /// @notice The networkId of the member whose account key is `(accountKeyX, accountKeyY)`.
+    /// @param accountKeyX The X coordinate of the account key.
+    /// @param accountKeyY The Y coordinate of the account key.
+    /// @return The member's networkId, `keccak256(X || Y)`.
+    function memberNetworkIdOf(uint256 accountKeyX, uint256 accountKeyY) public pure returns (bytes32) {
+        return keccak256(abi.encodePacked(accountKeyX, accountKeyY));
+    }
+
+    /// @notice Asks the approved network members to admit the member with this account key.
+    /// Permissionless, and callable by anyone holding the key.
     /// @dev Stores nothing and confers nothing. It is the announcement half of the join flow: the
     /// approved members watch this event, and admission happens only if enough of them sign the
     /// governance Safe transaction that calls {approveNetworkMember}. The caller must be the auth
-    /// address the networkId encodes, so nobody can post a request on another member's behalf.
-    /// @param memberNetworkId The networkId asking to join.
+    /// address of the account key, so nobody can post a request on another member's behalf.
+    /// @param accountKeyX The X coordinate of the requester's account key, a secp256k1 public key.
+    /// @param accountKeyY The Y coordinate of the requester's account key.
     /// @param semaphoreCommitment The Semaphore identity commitment the requester wants in the group.
     /// @param governanceSigner The address the requester wants added to the governance Safe, so it can
     /// vote on later candidates. Must differ from the auth address: the auth address is a hot key that
@@ -106,12 +129,13 @@ contract NetworkMemberRegistry is Ownable2Step {
     /// @param metadataURI Where the approvers can fetch this requester's vetting material. Any URI the
     /// network has agreed on, and it may be empty. The contract neither reads nor stores it.
     function requestToJoin(
-        bytes32 memberNetworkId,
+        uint256 accountKeyX,
+        uint256 accountKeyY,
         uint256 semaphoreCommitment,
         address governanceSigner,
         string calldata metadataURI
     ) external {
-        address authAddress = address(uint160(uint256(memberNetworkId)));
+        (bytes32 memberNetworkId, address authAddress) = _memberOf(accountKeyX, accountKeyY);
 
         if (msg.sender != authAddress) revert UnauthorizedCaller();
         if (networkMemberAuthAddress[memberNetworkId] != address(0)) revert AlreadyApproved(memberNetworkId);
@@ -119,30 +143,35 @@ contract NetworkMemberRegistry is Ownable2Step {
         if (governanceSigner == address(0)) revert ZeroGovernanceSigner();
         if (governanceSigner == authAddress) revert GovernanceSignerIsAuthAddress();
 
-        emit NetworkMemberJoinRequested(memberNetworkId, semaphoreCommitment, governanceSigner, metadataURI);
+        emit NetworkMemberJoinRequested(
+            memberNetworkId, accountKeyX, accountKeyY, semaphoreCommitment, governanceSigner, metadataURI
+        );
     }
 
     /// @notice Admits a network member to the approved set.
     /// @dev Callable only by the governance Safe, so admission always carries the signatures of a
-    /// threshold of approved members. Auth address is initialised from the networkId. The companion
-    /// calls in the same Safe transaction are `NetworkMemberGroup.addNetworkMember` and the Safe's own
-    /// `addOwnerWithThreshold`.
+    /// threshold of approved members. The auth address is the address of the account key, which the Safe's
+    /// signers pin by approving its coordinates. The companion calls in the same Safe transaction are
+    /// `NetworkMemberGroup.addNetworkMember` and the Safe's own `addOwnerWithThreshold`.
     ///
     /// Requires the issuer set to already be wired, for the same reason {removeNetworkMember} does:
     /// without it a member could be admitted into a state {removeNetworkMember} can never remove it
     /// from, since that function refuses to run while the set is unwired.
-    /// @param memberNetworkId The network member to approve.
+    /// @param accountKeyX The X coordinate of the member's account key, a secp256k1 public key.
+    /// @param accountKeyY The Y coordinate of the member's account key.
     /// @param semaphoreCommitment The member's Semaphore identity commitment. Must be non-zero, which
     /// the Semaphore group requires too, so a record cannot hold a commitment the group would refuse.
     /// @param governanceSigner The member's governance signer, the owner added to the Safe alongside
     /// this call.
-    function approveNetworkMember(bytes32 memberNetworkId, uint256 semaphoreCommitment, address governanceSigner)
-        external
-        onlyOwner
-    {
+    function approveNetworkMember(
+        uint256 accountKeyX,
+        uint256 accountKeyY,
+        uint256 semaphoreCommitment,
+        address governanceSigner
+    ) external onlyOwner {
         if (address(approvedIssuerSet) == address(0)) revert IssuerSetNotWired();
 
-        address authAddress = address(uint160(uint256(memberNetworkId)));
+        (bytes32 memberNetworkId, address authAddress) = _memberOf(accountKeyX, accountKeyY);
 
         if (networkMemberAuthAddress[memberNetworkId] != address(0)) revert AlreadyApproved(memberNetworkId);
         if (semaphoreCommitment == 0) revert ZeroSemaphoreCommitment();
@@ -214,4 +243,23 @@ contract NetworkMemberRegistry is Ownable2Step {
         identity[memberNetworkId] = newMetaStealthAddress;
         emit NetworkMemberIdentityRegistered(memberNetworkId, newMetaStealthAddress);
     }
+
+    /// @dev Derives a member's id and auth address from its account key, after checking the key is a
+    /// secp256k1 point. Without the check, a pair that is no key could still be admitted as an id.
+    function _memberOf(uint256 accountKeyX, uint256 accountKeyY)
+        internal
+        pure
+        returns (bytes32 memberNetworkId, address authAddress)
+    {
+        if (
+            accountKeyX >= SECP256K1_P || accountKeyY >= SECP256K1_P
+                || mulmod(accountKeyY, accountKeyY, SECP256K1_P)
+                    != addmod(
+                        mulmod(mulmod(accountKeyX, accountKeyX, SECP256K1_P), accountKeyX, SECP256K1_P), 7, SECP256K1_P
+                    )
+        ) revert AccountKeyNotOnCurve();
+
+        memberNetworkId = memberNetworkIdOf(accountKeyX, accountKeyY);
+        authAddress = address(uint160(uint256(memberNetworkId)));
+    }
 }

package/README.md

@@ -24,14 +24,15 @@ imports them directly.
 The governance Safe is the sole writer of the first two, and admission requires a majority of the
 current members: admitting one adds its governance signer to the Safe, so the network governs itself.
 See the
-[network member onboarding and governance runbook](https://github.com/zk-kit/coordination-network/blob/main/packages/contracts/docs/network-member-onboarding.md).
+[network member onboarding and governance runbook](https://github.com/zk-kit/coordination-network/blob/main/packages/contracts/docs/configuration/network-member-onboarding.md).
 
-Deploy all three with the governance Safe as their owner, then enable the orchestrator as a Safe module
-with a quorum:
+One command deploys every contract with the governance Safe as owner, enables the orchestrator as a
+Safe module and admits the founding member. The
+[deployment runbook](https://github.com/zk-kit/coordination-network/blob/main/packages/contracts/docs/deployment/deploy-and-configure-all.md)
+covers keys and funding:
 
 ```shell
-GOVERNANCE_SAFE=0x<safe> SEMAPHORE=0x<semaphore> \
-  forge script script/DeployNetworkMemberRegistry.s.sol --rpc-url <rpc> --broadcast
+yarn deployAndConfigureAll:sepolia --private-keys "$DEPLOYER_PRIVATE_KEY" --private-keys "$OWNER_PRIVATE_KEY" --sender "$DEPLOYER"
 ```
 
 ## Installation
@@ -56,37 +57,16 @@ The same holds off chain: with per-issuer registries, which tree a holder syncs
 
 The one thing to design around is write contention. Every mutation takes the predecessor index of the affected leaf, valid only against the tree state the transaction executes in, so two members revoking in the same block collide and one reverts. In order of preference: batch with `revokeMany`, have the issuer service send revocations one at a time, or recompute the index and resubmit. A resubmit reuses the same proof, since the message does not bind the index and a revert does not burn the nullifier.
 
-## The first revocation
-
-The tree starts empty with root `0`, and the circuit canonicalises an empty-registry witness to `0`, so `isValidRoot(0)` holds and presentations verify from the first block.
-
-A replaced root keeps working for a grace window: the service stamps the moment it stopped being current and accepts it for `rootDuration` (one hour) after that, so a proof built moments before a revocation still verifies. The zero root is the exception, because the stamp lives in a mapping where `0` already means "not a past root".
-
-So the first revocation invalidates empty-tree proofs with no window at all:
-
-| Time     | Event                                                        | `isValidRoot`                |
-| -------- | ------------------------------------------------------------ | ---------------------------- |
-| 10:00:00 | a holder syncs the empty tree and proves against root `0`    | `0` accepted, it is current  |
-| 10:00:05 | the first revocation lands, root becomes `R1`, `0` unstamped | `0` rejected immediately     |
-| 11:00:00 | another holder syncs and proves against `R1`                 | `R1` accepted, it is current |
-| 11:00:05 | the second revocation lands, root becomes `R2`               | `R1` accepted until 12:00:05 |
-
-Same race, opposite outcome. It can only bite once, around the transaction that takes the tree from empty to non-empty, and anyone caught re-syncs and re-proves.
-
-Revoking one unused commitment at deployment avoids it. A commitment is `Poseidon2(revocationPubX, revocationPubY)`, so a value like `1` cannot collide with a real credential. The tree is then never empty and no proof is ever built against root `0`.
+The empty-tree root `0` gets the same grace window as any other superseded root. After the first revocation, it remains valid for `rootDuration` seconds (one hour by default), then expires. A zero-duration window rejects it immediately.
 
 ## The approved-member group
 
-`NetworkMemberGate` is only the gate. It does not create the group, admit members or hold any membership state: it is pointed at an existing Semaphore group by id at construction, and stores it in `NETWORK_MEMBER_GROUP_ID`. Creating that group and administering it are governance concerns, done on the Semaphore deployment itself and tracked separately. Everything about the proof lifecycle is likewise Semaphore's:
+`NetworkMemberGate` is only the gate. It does not create the group, admit members or hold any membership state: it is pointed at an existing Semaphore group by id at construction, and stores it in `NETWORK_MEMBER_GROUP_ID`. `NetworkMemberGroup` creates that group on the Semaphore deployment and is its admin, and the governance Safe owns `NetworkMemberGroup`. Everything about the proof lifecycle is likewise Semaphore's:
 
-- Governance, as the group admin, maintains the set on the Semaphore contract: `addMember`, `addMembers`, `removeMember`, `updateMember`.
+- Governance maintains the set through `NetworkMemberGroup.addNetworkMember` and `removeNetworkMember`, which call Semaphore's `addMember` and `removeMember`.
 - The recent-root window is the group's Merkle tree duration, one hour by default, so a proof built just before a membership change still lands. A removal therefore bites at `removal time + one hour`.
 - `validateProof` records the proof's nullifier, so the same proof cannot be submitted twice. Clients pick a fresh random scope per proof, which makes each nullifier unlinkable from the last and leaves members unrate-limited.
 
 What the gate adds is the binding, and it is structural rather than a check: the Semaphore message is never accepted from the caller. `NetworkMemberGate.NetworkMemberProof` is Semaphore's proof minus its message, and the `onlyNetworkMember(message, proof)` modifier fills that field in with the message the gated function derives from its own arguments. A proof repurposed for another payload therefore fails verification outright; there is no message field for an attacker to line up, and no comparison a future gated function could forget.
 
 The message is `keccak256(UPDATE_DOMAIN_SEPARATOR, chainId, action, networkId, metaStealthAddress)`, where the separator is `keccak256(domain string, address(this))` hashed once at deployment. The payload is what stops a proof authorising a different update; the separator and the chain id place that update at one deployment. Both matter precisely because the registry does not own its group: two registries can be pointed at the same group id, and one registry can exist at the same address on two chains with the same members and therefore the same root, so without them a proof meant for one would authorise the other.
-
-## Tests
-
-The gated-path tests verify real Semaphore proofs against a real `Semaphore` deployment. The proofs are checked in at `test/fixtures/network-member-proofs.json` and `test/fixtures/credential-revocation-proofs.json`, regenerated with `yarn workspace @coordination-network/network-member-proof generate:fixtures` and `generate:revocation-fixtures`. Every proof binds the chain id and the contract address, so the tests pin that chain id and deploy to that address.

package/SemaphorePaymaster.sol

@@ -3,10 +3,9 @@ pragma solidity ^0.8.34;
 
 import { IEntryPoint } from "@account-abstraction/contracts/interfaces/IEntryPoint.sol";
 import { BasePaymaster } from "@account-abstraction/contracts/core/BasePaymaster.sol";
-import { IPaymaster } from "@account-abstraction/contracts/interfaces/IPaymaster.sol";
 import { PackedUserOperation } from "@account-abstraction/contracts/interfaces/PackedUserOperation.sol";
 import { _packValidationData } from "@account-abstraction/contracts/core/Helpers.sol";
-import { UserOperationLib } from "@account-abstraction/contracts/core/UserOperationLib.sol";
+import { SafeCast } from "@openzeppelin/contracts/utils/math/SafeCast.sol";
 import { Semaphore } from "@semaphore-protocol/contracts/Semaphore.sol";
 import { ISemaphore } from "@semaphore-protocol/contracts/interfaces/ISemaphore.sol";
 import { ISemaphoreVerifier } from "@semaphore-protocol/contracts/interfaces/ISemaphoreVerifier.sol";
@@ -17,8 +16,6 @@ import { MIN_DEPTH, MAX_DEPTH } from "@semaphore-protocol/contracts/base/Constan
  * @notice A paymaster that validates user operations in a privacy preserving way using a single semaphore group
  */
 contract SemaphorePaymaster is BasePaymaster, Semaphore {
-    using UserOperationLib for PackedUserOperation;
-
     /**
      * The paymaster uses a single Semaphore group
      */
@@ -30,46 +27,17 @@ contract SemaphorePaymaster is BasePaymaster, Semaphore {
     uint256 private constant ENCODED_PROOF_LENGTH = 13 * 32;
 
     /**
-     * Sponsorship stops for the rest of the epoch once spend reaches this cap, bounding what a
-     * stolen identity can drain before the owner can revoke or withdraw
-     */
-    uint256 public immutable SPEND_CAP_PER_EPOCH;
-    uint256 public immutable EPOCH_DURATION;
-
-    /**
-     * Smaller than epoch cap, so exhausting the cap takes many userOps rather than one.
      * `preVerificationGas` is self declared and never refunded, so `maxCost` can be used to drain the paymaster
      */
     uint256 public immutable MAX_COST_PER_OP;
 
-    /**
-     * Enough for `_postOp` to record spend. The EntryPoint charges the paymaster even when `postOp`
-     * runs out of gas, so validation requires the limit up front
-     */
-    uint256 public constant MIN_POSTOP_GAS = 40_000;
-
-    /**
-     * Validation cannot read `block.timestamp` (banned by ERC-7562), so the epoch lives in
-     * storage and is advanced by `updateEpoch`
-     */
-    uint256 public currentEpoch;
-
-    mapping(uint256 epoch => uint256 spent) public spentInEpoch;
-
     error ZeroOwner();
 
-    constructor(
-        address _entryPoint,
-        address _verifier,
-        address _owner,
-        uint256 _spendCapPerEpoch,
-        uint256 _epochDuration,
-        uint256 _maxCostPerOp
-    ) BasePaymaster(IEntryPoint(_entryPoint)) Semaphore(ISemaphoreVerifier(_verifier)) {
-        SPEND_CAP_PER_EPOCH = _spendCapPerEpoch;
-        EPOCH_DURATION = _epochDuration;
+    constructor(address _entryPoint, address _verifier, address _owner, uint256 _maxCostPerOp)
+        BasePaymaster(IEntryPoint(_entryPoint))
+        Semaphore(ISemaphoreVerifier(_verifier))
+    {
         MAX_COST_PER_OP = _maxCostPerOp;
-        currentEpoch = block.timestamp / _epochDuration;
 
         // _transferOwnership skips zero-address guard
         if (_owner == address(0)) revert ZeroOwner();
@@ -101,11 +69,7 @@ contract SemaphorePaymaster is BasePaymaster, Semaphore {
         override
         returns (bytes memory context, uint256 validationData)
     {
-        if (maxCost > MAX_COST_PER_OP || spentInEpoch[currentEpoch] + maxCost > SPEND_CAP_PER_EPOCH) {
-            return ("", _packValidationData(true, 0, 0));
-        }
-
-        if (userOp.unpackPostOpGasLimit() < MIN_POSTOP_GAS) {
+        if (maxCost > MAX_COST_PER_OP) {
             return ("", _packValidationData(true, 0, 0));
         }
 
@@ -149,17 +113,16 @@ contract SemaphorePaymaster is BasePaymaster, Semaphore {
         // A proof could have used an old Merkle tree root.
         // https://github.com/semaphore-protocol/semaphore/issues/98
         if (proof.merkleTreeRoot != currentMerkleTreeRoot) {
-            uint256 merkleRootCreationDate = groups[GROUP_ID].merkleRootCreationDates[proof.merkleTreeRoot];
+            uint256 merkleRootSupersededDate = groups[GROUP_ID].merkleRootSupersededDates[proof.merkleTreeRoot];
             uint256 merkleTreeDuration = groups[GROUP_ID].merkleTreeDuration;
 
-            if (merkleRootCreationDate == 0) {
+            // A zero duration would otherwise make `validUntil` 0, which ERC-4337 reads as "never expires"
+            if (merkleRootSupersededDate == 0 || merkleTreeDuration == 0) {
                 return ("", _packValidationData(true, 0, 0));
             }
 
-            // merkleRootCreationDate is block.timestamp. Overflow would require owner
-            // setting very high merkleTreeDuration
-            // forge-lint: disable-next-line(unsafe-typecast)
-            validUntil = uint48(merkleRootCreationDate + merkleTreeDuration);
+            // Semaphore's window end is exclusive, `validUntil` is inclusive
+            validUntil = SafeCast.toUint48(merkleRootSupersededDate + merkleTreeDuration - 1);
         }
 
         // Call `verifier.verifyProof` directly. `this.verifyProof` reads `block.timestamp` when the
@@ -175,20 +138,7 @@ contract SemaphorePaymaster is BasePaymaster, Semaphore {
             return ("", _packValidationData(true, 0, 0));
         }
 
-        // a non empty context is what makes the EntryPoint call `postOp`
-        return (hex"01", _packValidationData(false, validUntil, 0));
-    }
-
-    function _postOp(IPaymaster.PostOpMode, bytes calldata, uint256 actualGasCost, uint256) internal override {
-        updateEpoch();
-        spentInEpoch[currentEpoch] += actualGasCost;
-    }
-
-    /**
-     * Advance to the current epoch, freeing the spend cap again.
-     */
-    function updateEpoch() public {
-        currentEpoch = block.timestamp / EPOCH_DURATION;
+        return ("", _packValidationData(false, validUntil, 0));
     }
 
     /**

package/base/NetworkMemberGate.sol

@@ -11,8 +11,9 @@ import { ISemaphore } from "@semaphore-protocol/contracts/interfaces/ISemaphore.
 /// paymaster.
 ///
 /// This contract is only the gate. It does not create the approved-member group, admit members,
-/// remove them or hold any membership state: the group is created and administered on the Semaphore
-/// deployment itself, by governance, and this contract is pointed at it by id at construction.
+/// remove them or hold any membership state: the group is created on the Semaphore deployment by
+/// `NetworkMemberGroup` and administered by governance, and this contract is pointed at it by id at
+/// construction.
 /// Everything about the proof lifecycle is likewise Semaphore's: membership, the recent-root window
 /// (the group's Merkle tree duration) and the nullifier set that stops a proof being submitted
 /// twice.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coordination-network/contracts",
-  "version": "0.0.1",
+  "version": "0.1.0",
   "description": "The coordination network's Solidity contracts: the network member registry and its governance, the identity registry, the approved-issuer set, the revocation registries and the Semaphore paymaster.",
   "license": "MIT",
   "repository": {
@@ -35,7 +35,7 @@
   "dependencies": {
     "@account-abstraction/contracts": "^0.8.0",
     "@openzeppelin/contracts": "^5.6.1",
-    "@semaphore-protocol/contracts": "^4.14.3",
+    "@semaphore-protocol/contracts": "^4.14.4",
     "@zk-kit/lean-imt-plus.sol": "0.1.1",
     "@zk-kit/lean-imt.sol": "^2.0.1",
     "poseidon-solidity": "^0.0.5"

package/revocation/README.md

@@ -83,4 +83,5 @@ yarn test:contracts
 - There is deliberately no on-chain Merkle proof verifier. Verifying a plaintext proof would reveal the commitment, and a caller willing to do that can just call `isRevoked`, which is cheaper and answers the same question. The private path is a zero-knowledge proof verified elsewhere, whose root is checked with `isValidRoot`.
 - Registries are isolated. One deployment serves many issuers, and an admin can only write to its own registry.
 - Admin transfers are two-step, so a typo cannot strand a registry.
+- `unrevoke` and `updateRevocationCommitment` are for correcting mistakes, such as a commitment revoked in error or an invalid value written to the tree. Like every write here, they are visible to anyone reading the chain. `unrevoke` shows that a commitment is no longer revoked. `updateRevocationCommitment` shows the old and new commitments together, so an observer can tell one replaced the other. Whether that link reveals anything depends on how the commitments are generated and handled in your use case. If two commitments should not appear related, use `unrevoke` and a separate `revoke` instead, spaced apart in time, since two writes landing back to back can be linked by their timing alone.
 - `test/integration/CrossLanguageRoot.t.sol` pins the contract's roots against the TypeScript package. Any drift in the hashing or the insertion rules fails a test on both sides.

package/revocation/Revocation.sol

@@ -138,8 +138,11 @@ contract Revocation is IRevocation, RevocationRegistries {
         // hours, so the seconds of drift a validator can introduce cannot meaningfully lengthen or
         // shorten it. The worst case is a proof accepted or rejected a few seconds either side of
         // its deadline, which is what the window exists to tolerate in the first place.
+        //
+        // `supersededAt` is never in the future, so the subtraction cannot underflow, and unlike
+        // `supersededAt + rootDuration` it cannot overflow for any `rootDuration`.
         // forge-lint: disable-next-line(block-timestamp)
-        return block.timestamp < supersededAt + registries[registryId].rootDuration;
+        return block.timestamp - supersededAt < registries[registryId].rootDuration;
     }
 
     /// @inheritdoc IRevocation
@@ -175,13 +178,9 @@ contract Revocation is IRevocation, RevocationRegistries {
     /// revoked credential is the one that credential's own revocation replaced, so it stops being
     /// accepted `rootDuration` seconds after that revocation.
     ///
-    /// The empty-tree root is skipped: it is not a root anybody can build a proof against.
-    ///
     /// @param registryId The id of the registry.
     /// @param oldRoot The root the mutation replaced.
     function _supersedeRoot(uint256 registryId, uint256 oldRoot) private {
-        if (oldRoot == 0) return;
-
         registries[registryId].rootSupersededAt[oldRoot] = block.timestamp;
     }
 }

package/revocation/interfaces/IRevocation.sol

@@ -59,6 +59,11 @@ interface IRevocation {
     /// proof in flight when a revocation lands is invalidated. That is the strictest setting and the
     /// one a registry with adversarial timing concerns wants, at the cost of failed presentations
     /// that an honest holder cannot avoid.
+    ///
+    /// The new duration applies to every past root of the registry, not only to roots superseded
+    /// after this call, so raising it makes older roots valid again and lowering it invalidates
+    /// proofs that are already in flight. It is also how long a revoked credential can keep
+    /// verifying with an older root, so it should be kept as short as the registry can tolerate.
     /// @param registryId The id of the registry.
     /// @param newRootDuration The new window, in seconds. Zero is allowed.
     function updateRegistryRootDuration(uint256 registryId, uint256 newRootDuration) external;