@crisp-e3/contracts 0.15.0 → 0.17.0

package/contracts/CRISPProgram.sol

@@ -10,10 +10,14 @@ import { Ownable } from "@openzeppelin/contracts/access/Ownable.sol";
 import { IE3Program } from "@interfold/contracts/contracts/interfaces/IE3Program.sol";
 import { IInterfold } from "@interfold/contracts/contracts/interfaces/IInterfold.sol";
 import { E3 } from "@interfold/contracts/contracts/interfaces/IE3.sol";
+import { Risc0ComputeProof } from "@interfold/contracts/contracts/lib/Risc0ComputeProof.sol";
 import { LazyIMTData, InternalLazyIMT } from "@zk-kit/lazy-imt.sol/InternalLazyIMT.sol";
-import { HonkVerifier } from "./CRISPVerifier.sol";
+import { EIP712 } from "@openzeppelin/contracts/utils/cryptography/EIP712.sol";
+import { IHonkVerifier } from "./interfaces/IHonkVerifier.sol";
+import { IVotesToken } from "./interfaces/IVotesToken.sol";
+import { IERC6372Clock } from "./interfaces/IERC6372Clock.sol";
 
-contract CRISPProgram is IE3Program, Ownable {
+contract CRISPProgram is IE3Program, Ownable, EIP712 {
   using InternalLazyIMT for LazyIMTData;
 
   /// @notice Enum to represent credit modes
@@ -42,7 +46,12 @@ contract CRISPProgram is IE3Program, Ownable {
     /// @notice Derived from token balances by the coordinator. The default.
     TOKEN,
     /// @notice Supplied by the requester via `getCensus(uint256 e3Id) returns (address[])`.
-    BY_REQUESTER
+    BY_REQUESTER,
+    /// @notice Read from the token by this contract, one input at a time. No list is enumerated
+    /// and no root is posted, so there is no census producer to trust. `publishInput` calls
+    /// `getPastVotes` for the slot and passes the result to the circuit as a public input, which
+    /// is why this mode uses the `crisp_onchain` verifier rather than the `crisp` one.
+    ONCHAIN
   }
 
   /// @notice Struct to store all data related to a voting round
@@ -54,6 +63,16 @@ contract CRISPProgram is IE3Program, Ownable {
     uint256 numOptions;
     CreditMode creditMode;
     CensusMode censusMode;
+    /// @notice The token that voting power is read from. Only used by `CensusMode.ONCHAIN`.
+    address token;
+    /// @notice The smallest voting power that may cast an input. Only used by
+    /// `CensusMode.ONCHAIN`, where eligibility is checked per input instead of by a census.
+    uint256 minVotingPower;
+    /// @notice Credits given to each eligible voter under `CreditMode.CONSTANT`.
+    uint256 credits;
+    /// @notice The timepoint that voting power is read at, in the ERC-6372 clock units of the
+    /// token. Recorded when the round is requested, so it is the same for every input.
+    uint48 snapshot;
   }
 
   // Constants
@@ -74,7 +93,17 @@ contract CRISPProgram is IE3Program, Ownable {
   IInterfold public interfold;
   IRiscZeroVerifier public risc0Verifier;
   bytes32 public imageId;
-  HonkVerifier private immutable honkVerifier;
+  /// @notice Verifies ballots for the census modes that prove membership of a Merkle tree.
+  IHonkVerifier private immutable honkVerifier;
+  /// @notice Verifies ballots for `CensusMode.ONCHAIN`, whose circuit has no Merkle inputs and
+  /// takes voting power as a public input instead.
+  IHonkVerifier private immutable onchainHonkVerifier;
+
+  /// @notice The EIP-712 type of the message a voter signs to authorise one ballot.
+  /// @dev The digest binds the signature to the round, the slot, and this exact ciphertext. The
+  /// chain id and this contract address come from the EIP-712 domain, so a signature cannot be
+  /// replayed onto another round, another slot, another ballot, or another deployment.
+  bytes32 private constant BALLOT_TYPEHASH = keccak256("Ballot(uint256 e3Id,address slot,bytes32 ciphertextCommitment)");
 
   // Mappings
   mapping(uint256 e3Id => RoundData) e3Data;
@@ -93,6 +122,16 @@ contract CRISPProgram is IE3Program, Ownable {
   /// @notice A requester-supplied census names who may vote, not how much each vote weighs, so it
   /// only has meaning when every voter carries the same credits.
   error CensusModeRequiresConstantCredits();
+  /// @notice `CensusMode.ONCHAIN` reads voting power from a token, so it cannot run without one
+  /// that answers `getPastVotes`.
+  error CensusModeRequiresToken();
+  /// @notice An `ONCHAIN` round with constant credits must grant a non-zero allowance, or it
+  /// bounds every ballot to zero and can only accept masks.
+  error InvalidCredits();
+  /// @notice The slot holds less voting power than the round requires, so it cannot be written to.
+  /// @dev Raised for mask inputs as well as real votes. Under `CensusMode.ONCHAIN` this check
+  /// replaces the Merkle membership proof that gates both branches in the other modes.
+  error SlotNotEligible();
   error InvalidCensusMode();
   error SlotIsEmpty();
   error MerkleRootNotSet();
@@ -100,6 +139,7 @@ contract CRISPProgram is IE3Program, Ownable {
   error InputDeadlinePassed(uint256 e3Id, uint256 deadline);
   error KeyNotPublished(uint256 e3Id);
   error E3NotAcceptingInputs(uint256 e3Id);
+  error InvalidComputeContext();
 
   // Events
   event InputPublished(uint256 indexed e3Id, bytes encryptedVote, uint256 index);
@@ -109,17 +149,38 @@ contract CRISPProgram is IE3Program, Ownable {
   /// @param _risc0Verifier The RISC Zero verifier address
   /// @param _honkVerifier The honk verifier address
   /// @param _imageId The image ID for the guest program
-  constructor(IInterfold _interfold, IRiscZeroVerifier _risc0Verifier, HonkVerifier _honkVerifier, bytes32 _imageId) Ownable(msg.sender) {
+  constructor(
+    IInterfold _interfold,
+    IRiscZeroVerifier _risc0Verifier,
+    IHonkVerifier _honkVerifier,
+    IHonkVerifier _onchainHonkVerifier,
+    bytes32 _imageId
+  ) Ownable(msg.sender) EIP712("CRISP", "1") {
     if (address(_interfold) == address(0)) revert InterfoldAddressZero();
     if (address(_risc0Verifier) == address(0)) revert Risc0VerifierAddressZero();
     if (address(_honkVerifier) == address(0)) revert InvalidHonkVerifier();
+    if (address(_onchainHonkVerifier) == address(0)) revert InvalidHonkVerifier();
 
     interfold = _interfold;
     risc0Verifier = _risc0Verifier;
     honkVerifier = _honkVerifier;
+    onchainHonkVerifier = _onchainHonkVerifier;
     imageId = _imageId;
   }
 
+  /// @notice The digest a voter signs to authorise one ballot.
+  /// @dev Computed for every input, and for mask inputs as well as real votes. The circuit ignores
+  /// it on the mask branch, but the contract must not skip it: a digest that were computed only
+  /// for real votes would let an observer tell the two apart on-chain, which is exactly what mask
+  /// inputs exist to prevent.
+  /// @param e3Id The E3 the ballot belongs to.
+  /// @param slot The slot address the ballot is written to.
+  /// @param ciphertextCommitment The commitment to the ballot ciphertext.
+  /// @return The EIP-712 digest.
+  function ballotDigest(uint256 e3Id, address slot, bytes32 ciphertextCommitment) public view returns (bytes32) {
+    return _hashTypedDataV4(keccak256(abi.encode(BALLOT_TYPEHASH, e3Id, slot, ciphertextCommitment)));
+  }
+
   /// @notice Sets the Merkle root for an E3 program. Can only be set once.
   /// @param _e3Id The E3 program ID
   /// @param _root The Merkle root to set.
@@ -172,7 +233,7 @@ contract CRISPProgram is IE3Program, Ownable {
     paramsHash = round.paramsHash;
     numOptions = round.numOptions;
     creditMode = round.creditMode;
-    inputRoot = round.votes._root(TREE_DEPTH);
+    inputRoot = round.votes._root();
     numberOfVotes = round.votes.numberOfLeaves;
   }
 
@@ -197,34 +258,9 @@ contract CRISPProgram is IE3Program, Ownable {
     if (msg.sender != address(interfold) && msg.sender != owner()) revert CallerNotAuthorized();
     if (e3Data[e3Id].paramsHash != bytes32(0)) revert E3AlreadyInitialized();
 
-    // Scoped so the decoded values do not outlive their use: `validate` is close enough to the
-    // stack limit that holding all six of them alongside the parameters exceeds it.
-    {
-      // One decode, every field required. `censusMode` is read as a uint and range-checked rather
-      // than decoded straight into the enum, so an unrecognised value gives a named error instead
-      // of a bare panic.
-      (, , uint256 numOptions, CreditMode creditMode, , uint256 rawCensusMode) = abi.decode(
-        customParams,
-        (address, uint256, uint256, CreditMode, uint256, uint256)
-      );
-      // The circuit asserts `num_options <= MAX_OPTIONS`, so a round configured above it accepts no
-      // ballot at all. Reject at request time rather than stranding a round nobody can vote in.
-      if (numOptions < 2 || numOptions > MAX_VOTE_OPTIONS) revert InvalidNumOptions();
-      if (rawCensusMode > uint256(type(CensusMode).max)) revert InvalidCensusMode();
-
-      // Rejected here rather than by the coordinator, so a combination that can never work costs
-      // nothing: this reverts in the same transaction that requests the E3, before any fee is paid.
-      if (CensusMode(rawCensusMode) == CensusMode.BY_REQUESTER && creditMode != CreditMode.CONSTANT) {
-        revert CensusModeRequiresConstantCredits();
-      }
-
-      // we need to know the number of options for decoding the tally
-      e3Data[e3Id].numOptions = numOptions;
-      // we want to save the credit mode so it can be verified on chain by everyone
-      e3Data[e3Id].creditMode = creditMode;
-      // recorded so anyone can verify which electorate the round was requested against
-      e3Data[e3Id].censusMode = CensusMode(rawCensusMode);
-    }
+    // Delegated to its own frame rather than scoped inline: `validate` is close enough to the
+    // stack limit that holding the six decoded values alongside the parameters exceeds it.
+    _initRound(e3Id, customParams);
 
     e3Data[e3Id].paramsHash = keccak256(e3ProgramParams);
 
@@ -234,6 +270,79 @@ contract CRISPProgram is IE3Program, Ownable {
     return ENCRYPTION_SCHEME_ID;
   }
 
+  /// @notice Decode the round configuration and record it.
+  /// @dev One decode, every field required. `censusMode` is read as a uint and range-checked
+  /// rather than decoded straight into the enum, so an unrecognised value gives a named error
+  /// instead of a bare panic.
+  /// @param e3Id The E3 being configured.
+  /// @param customParams The ABI-encoded round configuration.
+  function _initRound(uint256 e3Id, bytes calldata customParams) internal {
+    (address token, uint256 minVotingPower, uint256 numOptions, CreditMode creditMode, uint256 credits, uint256 rawCensusMode) = abi.decode(
+      customParams,
+      (address, uint256, uint256, CreditMode, uint256, uint256)
+    );
+
+    // The circuit asserts `num_options <= MAX_OPTIONS`, so a round configured above it accepts no
+    // ballot at all. Reject at request time rather than stranding a round nobody can vote in.
+    if (numOptions < 2 || numOptions > MAX_VOTE_OPTIONS) revert InvalidNumOptions();
+    if (rawCensusMode > uint256(type(CensusMode).max)) revert InvalidCensusMode();
+
+    // Rejected here rather than by the coordinator, so a combination that can never work costs
+    // nothing: this reverts in the same transaction that requests the E3, before any fee is paid.
+    if (CensusMode(rawCensusMode) == CensusMode.BY_REQUESTER && creditMode != CreditMode.CONSTANT) {
+      revert CensusModeRequiresConstantCredits();
+    }
+
+    // ONCHAIN reads every voter's power from this token, so a round without one accepts no ballot
+    // at all. Same reasoning as the numOptions bound: fail before the fee is paid.
+    if (CensusMode(rawCensusMode) == CensusMode.ONCHAIN && token == address(0)) {
+      revert CensusModeRequiresToken();
+    }
+
+    // An ONCHAIN round hands `credits` to the circuit as the voting-power bound, so zero credits
+    // bound every ballot to zero: only a mask would be accepted, and the round would tally
+    // nothing. Checked for ONCHAIN only — the Merkle modes take the bound from the census leaf,
+    // where `credits` never reaches the circuit and the contract has nothing to check.
+    if (CensusMode(rawCensusMode) == CensusMode.ONCHAIN && creditMode == CreditMode.CONSTANT && credits == 0) {
+      revert InvalidCredits();
+    }
+
+    RoundData storage round = e3Data[e3Id];
+    // we need to know the number of options for decoding the tally
+    round.numOptions = numOptions;
+    // we want to save the credit mode so it can be verified on chain by everyone
+    round.creditMode = creditMode;
+    // recorded so anyone can verify which electorate the round was requested against
+    round.censusMode = CensusMode(rawCensusMode);
+    round.token = token;
+    round.minVotingPower = minVotingPower;
+    round.credits = credits;
+
+    // The snapshot is taken here rather than supplied by the requester. This function runs in the
+    // transaction that requests the E3, so `clock() - 1` is the last finalized timepoint of the
+    // round, and a requester cannot name a timepoint that suits it. Recording it once also makes
+    // every input of the round read the same electorate.
+    if (CensusMode(rawCensusMode) == CensusMode.ONCHAIN) {
+      // Checked before any call is attempted. A call to an address with no code succeeds and
+      // returns nothing, so `clock()` fails while decoding the empty return data rather than
+      // inside the call — and a decode failure is not what `try/catch` is there to catch. An EOA
+      // would otherwise be refused by a bare panic instead of a named error.
+      if (token.code.length == 0) revert CensusModeRequiresToken();
+
+      uint48 snapshot = _previousTimepoint(token);
+
+      // Probe the exact call every input will make. `_previousTimepoint` swallows a missing
+      // `clock()` and falls back to block numbers, which is right for a token that predates
+      // ERC-6372 but also lets an address that is not a votes token pass validation — and then
+      // every `publishInput` reverts inside `getPastVotes`, after the fee is paid.
+      try IVotesToken(token).getPastVotes(address(0), snapshot) returns (uint256) {} catch {
+        revert CensusModeRequiresToken();
+      }
+
+      round.snapshot = snapshot;
+    }
+  }
+
   /// @inheritdoc IE3Program
   function publishInput(uint256 e3Id, bytes memory data) external {
     E3 memory e3 = interfold.getE3(e3Id);
@@ -254,9 +363,6 @@ contract CRISPProgram is IE3Program, Ownable {
       revert E3NotAcceptingInputs(e3Id);
     }
 
-    // We need to ensure that the CRISP admin set the merkle root of the census.
-    if (e3Data[e3Id].merkleRoot == 0) revert MerkleRootNotSet();
-
     if (data.length == 0) revert EmptyInputData();
 
     (bytes memory noirProof, address slotAddress, bytes32 encryptedVoteCommitment, bytes memory encryptedVote) = abi.decode(
@@ -264,26 +370,81 @@ contract CRISPProgram is IE3Program, Ownable {
       (bytes, address, bytes32, bytes)
     );
 
+    // The two census families differ here and nowhere else. A Merkle round proves membership
+    // inside the circuit against a posted root. An ONCHAIN round reads the power from the token
+    // and gives it to the circuit, so the eligibility check has to happen here instead.
+    (bytes32 eligibility, IHonkVerifier verifier) = _eligibility(e3Id, slotAddress);
+
     (uint40 voteIndex, bytes32 previousEncryptedVoteCommitment) = _processVote(e3Id, slotAddress, encryptedVoteCommitment);
 
     // Set the public inputs for the proof. Order must match Noir circuit.
-    bytes32[] memory noirPublicInputs = new bytes32[](7);
+    bytes32[] memory noirPublicInputs = new bytes32[](9);
     noirPublicInputs[0] = previousEncryptedVoteCommitment;
-    noirPublicInputs[1] = bytes32(e3Data[e3Id].merkleRoot);
-    noirPublicInputs[2] = bytes32(uint256(uint160(slotAddress)));
-    noirPublicInputs[3] = bytes32(uint256(previousEncryptedVoteCommitment == bytes32(0) ? 1 : 0));
-    noirPublicInputs[4] = bytes32(e3Data[e3Id].numOptions);
-    noirPublicInputs[5] = encryptedVoteCommitment;
-    noirPublicInputs[6] = e3.committeePublicKey;
+    // A Keccak digest does not fit in one field element, so it enters the circuit as its two
+    // 16-byte halves. The circuit rebuilds the 32 bytes with `digest_from_halves`.
+    {
+      uint256 digest = uint256(ballotDigest(e3Id, slotAddress, encryptedVoteCommitment));
+      noirPublicInputs[1] = bytes32(digest >> 128);
+      noirPublicInputs[2] = bytes32(digest & type(uint128).max);
+    }
+    noirPublicInputs[3] = bytes32(uint256(uint160(slotAddress)));
+    noirPublicInputs[4] = eligibility;
+    noirPublicInputs[5] = bytes32(uint256(previousEncryptedVoteCommitment == bytes32(0) ? 1 : 0));
+    noirPublicInputs[6] = bytes32(e3Data[e3Id].numOptions);
+    noirPublicInputs[7] = encryptedVoteCommitment;
+    noirPublicInputs[8] = e3.committeePublicKey;
 
     // Check if the ciphertext was encrypted correctly
-    if (!honkVerifier.verify(noirProof, noirPublicInputs)) {
+    if (!verifier.verify(noirProof, noirPublicInputs)) {
       revert InvalidNoirProof();
     }
 
     emit InputPublished(e3Id, encryptedVote, voteIndex);
   }
 
+  /// @notice Resolve the eligibility public input and the verifier for a round.
+  /// @dev Returns the value that occupies index 4 of the circuit public inputs. The `crisp` and
+  /// `crisp_onchain` circuits agree on every other position, so this one value and the verifier
+  /// address are the whole difference between the two paths.
+  /// @param e3Id The E3 the input belongs to.
+  /// @param slotAddress The slot the input is written to.
+  /// @return eligibility The Merkle root of the census, or the voting power of the slot.
+  /// @return verifier The verifier that matches the circuit of this round.
+  function _eligibility(uint256 e3Id, address slotAddress) internal view returns (bytes32 eligibility, IHonkVerifier verifier) {
+    RoundData storage round = e3Data[e3Id];
+
+    if (round.censusMode != CensusMode.ONCHAIN) {
+      // We need to ensure that the CRISP admin set the merkle root of the census.
+      if (round.merkleRoot == 0) revert MerkleRootNotSet();
+      return (bytes32(round.merkleRoot), honkVerifier);
+    }
+
+    uint256 power = IVotesToken(round.token).getPastVotes(slotAddress, round.snapshot);
+
+    // A slot with no power is never writable, whatever the round configured. Without this floor a
+    // round with `minVotingPower == 0` would let anyone mask any address, including addresses that
+    // never held the token.
+    uint256 threshold = round.minVotingPower == 0 ? 1 : round.minVotingPower;
+    if (power < threshold) revert SlotNotEligible();
+
+    // Eligibility comes from the power at the snapshot. The weight the circuit enforces comes from
+    // the credit mode, so a CONSTANT round gives every eligible slot the same credits.
+    return (bytes32(round.creditMode == CreditMode.CONSTANT ? round.credits : power), onchainHonkVerifier);
+  }
+
+  /// @notice The last finalized timepoint of a token, in its ERC-6372 clock units.
+  /// @dev Falls back to block numbers when the token has no `clock()`, which matches the default
+  /// ERC20Votes clock.
+  /// @param token The token to read the clock of.
+  /// @return The timepoint before the current one.
+  function _previousTimepoint(address token) internal view returns (uint48) {
+    try IERC6372Clock(token).clock() returns (uint48 current) {
+      return current == 0 ? 0 : current - 1;
+    } catch {
+      return uint48(block.number - 1);
+    }
+  }
+
   /// @notice Decode the tally from the plaintext output
   /// @param e3Id The E3 program ID
   /// @return votes - an array of vote counts for each option
@@ -342,17 +503,25 @@ contract CRISPProgram is IE3Program, Ownable {
     bytes32 ciphertextCommitment,
     bytes memory proof
   ) external view override returns (bool) {
+    E3 memory e3 = interfold.getE3(e3Id);
     bytes32 paramsHash = getParamsHash(e3Id);
+    bytes32 inputRoot = bytes32(e3Data[e3Id].votes._root());
+    Risc0ComputeProof.Proof memory computeProof = Risc0ComputeProof.decode(proof);
+    if (computeProof.paramsHash != paramsHash || computeProof.inputRoot != inputRoot) revert InvalidComputeContext();
+
+    bytes memory journal = Risc0ComputeProof.journal(
+      bytes32(block.chainid),
+      bytes32(uint256(uint160(address(interfold)))),
+      bytes32(e3Id),
+      e3.encryptionSchemeId,
+      e3.committeePublicKey,
+      ciphertextOutputHash,
+      ciphertextCommitment,
+      paramsHash,
+      inputRoot
+    );
 
-    bytes32 inputRoot = bytes32(e3Data[e3Id].votes._root(TREE_DEPTH));
-    bytes memory journal = new bytes(528); // (32 + 1) * 4 * 4
-
-    _encodeLengthPrefixAndHash(journal, 0, ciphertextOutputHash);
-    _encodeLengthPrefixAndHash(journal, 132, ciphertextCommitment);
-    _encodeLengthPrefixAndHash(journal, 264, paramsHash);
-    _encodeLengthPrefixAndHash(journal, 396, inputRoot);
-
-    risc0Verifier.verify(proof, imageId, sha256(journal));
+    risc0Verifier.verify(computeProof.seal, imageId, sha256(journal));
     return true;
   }
 
@@ -381,19 +550,6 @@ contract CRISPProgram is IE3Program, Ownable {
     }
   }
 
-  /// @notice Encode length prefix and hash
-  /// @param journal The journal to encode into
-  /// @param startIndex The start index in the journal
-  /// @param hashVal The hash value to encode
-  function _encodeLengthPrefixAndHash(bytes memory journal, uint256 startIndex, bytes32 hashVal) internal pure {
-    journal[startIndex] = 0x20;
-    startIndex += 4;
-
-    for (uint256 i = 0; i < 32; i++) {
-      journal[startIndex + i * 4] = hashVal[i];
-    }
-  }
-
   /// @notice Decode bytes to uint64 array
   /// @param data The bytes to decode (must be multiple of 8)
   /// @return result Array of uint64 values