@crisp-e3/contracts 0.16.0 → 0.18.0-insecure.0

package/contracts/Mocks/MockInterfold.sol

@@ -19,6 +19,11 @@ contract MockInterfold {
   uint256 public nextE3Id;
 
   mapping(uint256 => E3) public e3s;
+  mapping(IE3Program => bool) public e3Programs;
+
+  function registerE3Program(IE3Program program) external {
+    e3Programs[program] = true;
+  }
 
   function request(address program) external {
     _request(program, 2);
@@ -30,6 +35,35 @@ contract MockInterfold {
     _request(program, numOptions);
   }
 
+  /// @notice Request an E3 with caller-supplied program params.
+  /// @dev `_request` hardcodes a TOKEN-census round. `CensusMode.ONCHAIN` needs a token, a credit
+  /// mode and a census mode that only the caller knows, and the snapshot is taken during
+  /// `validate`, so the params have to reach it here rather than being patched afterwards.
+  function requestWithParams(address program, uint256 numOptions, bytes memory params) external {
+    e3s[nextE3Id] = E3({
+      seed: 0,
+      committeeSize: IInterfold.CommitteeSize.Minimum,
+      requestBlock: 0,
+      inputWindow: [uint256(0), uint256(0)],
+      encryptionSchemeId: ENCRYPTION_SCHEME_ID,
+      e3Program: IE3Program(address(0)),
+      paramSet: 0, // Insecure512
+      customParams: params,
+      decryptionVerifier: IDecryptionVerifier(address(0)),
+      pkVerifier: IPkVerifier(address(0)),
+      committeePublicKey: committeePublicKey,
+      ciphertextOutput: bytes32(0),
+      plaintextOutput: plaintextOutput,
+      requester: address(0),
+      ciphertextCommitment: bytes32(0)
+    });
+
+    IE3Program(program).validate(nextE3Id, 0, bytes(""), bytes(""), params);
+
+    nextE3Id++;
+    numOptions; // silence unused-parameter warning; the count travels inside `params`
+  }
+
   function _request(address program, uint256 numOptions) internal {
     e3s[nextE3Id] = E3({
       seed: 0,
@@ -39,7 +73,7 @@ contract MockInterfold {
       encryptionSchemeId: ENCRYPTION_SCHEME_ID,
       e3Program: IE3Program(address(0)),
       paramSet: 0, // Insecure512
-      customParams: abi.encode(address(0), nextE3Id, numOptions, 0, 0, 0),
+      customParams: abi.encode(address(0), nextE3Id, numOptions, 0, 0, 0, 0),
       decryptionVerifier: IDecryptionVerifier(address(0)),
       pkVerifier: IPkVerifier(address(0)),
       committeePublicKey: committeePublicKey,
@@ -49,7 +83,7 @@ contract MockInterfold {
       ciphertextCommitment: bytes32(0)
     });
 
-    IE3Program(program).validate(nextE3Id, 0, bytes(""), bytes(""), abi.encode(address(0), nextE3Id, numOptions, 0, 0, 0));
+    IE3Program(program).validate(nextE3Id, 0, bytes(""), bytes(""), abi.encode(address(0), nextE3Id, numOptions, 0, 0, 0, 0));
 
     nextE3Id++;
   }
@@ -76,7 +110,7 @@ contract MockInterfold {
         encryptionSchemeId: ENCRYPTION_SCHEME_ID,
         e3Program: IE3Program(address(0)),
         paramSet: 0, // Insecure512
-        customParams: abi.encode(address(0), 0, 2, 0, 0, 0),
+        customParams: abi.encode(address(0), 0, 2, 0, 0, 0, 0),
         decryptionVerifier: IDecryptionVerifier(address(0)),
         pkVerifier: IPkVerifier(address(0)),
         committeePublicKey: committeePublicKey,

package/contracts/Mocks/MockVotesToken.sol

@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+//
+// This file is provided WITHOUT ANY WARRANTY;
+// without even the implied warranty of MERCHANTABILITY
+// or FITNESS FOR A PARTICULAR PURPOSE.
+pragma solidity ^0.8.27;
+
+import { ERC20 } from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
+import { ERC20Permit } from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Permit.sol";
+import { ERC20Votes } from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Votes.sol";
+import { Nonces } from "@openzeppelin/contracts/utils/Nonces.sol";
+
+/// @title MockVotesToken
+/// @notice An ERC20Votes token for exercising `CensusMode.ONCHAIN`.
+/// @dev `MockVotingToken` is a plain ERC20 with no `getPastVotes`, which makes it the negative
+/// case for the token probe in `CRISPProgram._initRound`. This one is the positive case.
+///
+/// Uses the timestamp clock, matching `InterfoldToken`. A round records its snapshot in whatever
+/// units the token reports, so a mock on the default block-number clock would exercise a
+/// different path from the token this mode is built for.
+contract MockVotesToken is ERC20, ERC20Permit, ERC20Votes {
+  constructor() ERC20("Mock Votes Token", "MVOTE") ERC20Permit("Mock Votes Token") {
+    _mint(msg.sender, 1e24);
+    _delegate(msg.sender, msg.sender);
+  }
+
+  function mint(address to, uint256 amount) external {
+    _mint(to, amount);
+    if (delegates(to) == address(0)) _delegate(to, to);
+  }
+
+  function clock() public view override returns (uint48) {
+    return uint48(block.timestamp);
+  }
+
+  /// @dev Declared pure per ERC-6372, so it cannot read `clock()`.
+  function CLOCK_MODE() public pure override returns (string memory) {
+    return "mode=timestamp";
+  }
+
+  function _update(address from, address to, uint256 value) internal override(ERC20, ERC20Votes) {
+    super._update(from, to, value);
+  }
+
+  function nonces(address owner) public view override(ERC20Permit, Nonces) returns (uint256) {
+    return super.nonces(owner);
+  }
+}

package/contracts/interfaces/IERC6372Clock.sol

@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+//
+// This file is provided WITHOUT ANY WARRANTY;
+// without even the implied warranty of MERCHANTABILITY
+// or FITNESS FOR A PARTICULAR PURPOSE.
+pragma solidity >=0.8.27;
+
+/// @notice The ERC-6372 clock of a token, used to record the snapshot of a round.
+/// @dev Kept separate from `IVotesToken` because it is the optional half of the token surface.
+/// A token that predates ERC-6372 still answers `getPastVotes`, so `CRISPProgram` falls back to
+/// block numbers when this call reverts rather than refusing the round.
+interface IERC6372Clock {
+  /// @notice The current timepoint, in the clock units of the token.
+  /// @return The timepoint.
+  function clock() external view returns (uint48);
+}

package/contracts/interfaces/IHonkVerifier.sol

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+//
+// This file is provided WITHOUT ANY WARRANTY;
+// without even the implied warranty of MERCHANTABILITY
+// or FITNESS FOR A PARTICULAR PURPOSE.
+pragma solidity >=0.8.27;
+
+/// @notice The subset of a generated Honk verifier that `CRISPProgram` calls.
+/// @dev Declared as an interface so the census paths can hold verifiers generated from different
+/// circuits. Every generated verifier declares a contract named `HonkVerifier`, and there is one
+/// per census mode per BFV preset under `contracts/verifiers/<preset>/`, so importing the concrete
+/// types would collide. Deployment resolves the right one by fully qualified name; see
+/// `scripts/verifiers.ts`.
+interface IHonkVerifier {
+  /// @notice Verify a folded ballot proof against its public inputs.
+  /// @dev Reverts rather than returning false when the public inputs do not match the proof.
+  /// @param proof The folded proof.
+  /// @param publicInputs The public inputs, in the order the fold circuit declares them.
+  /// @return True when the proof is valid.
+  function verify(bytes calldata proof, bytes32[] calldata publicInputs) external view returns (bool);
+}

package/contracts/interfaces/IVotesToken.sol

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+//
+// This file is provided WITHOUT ANY WARRANTY;
+// without even the implied warranty of MERCHANTABILITY
+// or FITNESS FOR A PARTICULAR PURPOSE.
+pragma solidity >=0.8.27;
+
+/// @notice The subset of an ERC20Votes token that `CensusMode.ONCHAIN` reads.
+/// @dev Required, not optional. A round that names a token which cannot answer this is rejected
+/// at request time, because every input would otherwise revert here after the fee is paid.
+interface IVotesToken {
+  /// @notice The voting power of an account at a past timepoint.
+  /// @param account The account to read.
+  /// @param timepoint The timepoint, in the ERC-6372 clock units of the token.
+  /// @return The voting power at that timepoint.
+  function getPastVotes(address account, uint256 timepoint) external view returns (uint256);
+
+  /// @notice The token's decimals, used to derive the default voting-power divisor.
+  /// @dev Optional: a token without it falls back to a divisor of 1, so the probe must not be
+  /// treated as a requirement the way `getPastVotes` is.
+  /// @return The number of decimals.
+  function decimals() external view returns (uint8);
+}