@crisp-e3/contracts 0.17.0 → 0.18.0

package/README.md

@@ -39,7 +39,7 @@ pnpm deploy:contracts:full     # also deploy Interfold stack (no ZK unless ENABL
 
 This is the main logic of CRISP - an interfold program for secure voting.
 
-It exposes two main functions:
+It exposes three main functions:
 
 - `validate` - that is called when a new E3 instance is requested on Interfold
   (`Interfold.request`).
@@ -47,10 +47,15 @@ It exposes two main functions:
   (`Interfold.publishCiphertextOutput`). This function ensures that the ciphertext output is valid.
   CRISP uses Risc0 as the compute provider for running the FHE program, thus the proof will be a
   Risc0 proof.
-- `validateInput` - validate the input data that is submitted to the E3 instance. It is called by
-  the Interfold contract when a new input is published (`Interfold.publishInput`). In CRISP, the
-  data providers (the ones submitting the inputs) are the voters, and the input submitted is the
-  vote itself. The logic checks that gating conditions are satisfied and that the ciphertext is
-  constructed correctly using
-  [Greco](https://github.com/gnosisguild/interfold/tree/main/circuits/crates/libs/greco). See the
-  Greco [paper](https://eprint.iacr.org/2024/594).
+- `publishInput` - accepts an input for the E3 instance. Data providers call it on this contract
+  directly. In CRISP, the data providers are the voters and the input is the vote itself. The
+  function checks the stage and the input window, resolves the voter's eligibility from the census,
+  and verifies a Noir proof over nine public inputs, which is what establishes that the ciphertext
+  was encrypted correctly under the committee public key
+  (`examples/CRISP/packages/crisp-contracts/contracts/CRISPProgram.sol:493-554`, paths from the
+  repository root). The verifier is the one the round's census selects: `CRISPVerifier.sol` for a
+  census posted as a Merkle root, `CRISPOnchainVerifier.sol` for one read from token balances on
+  chain. Both files declare a contract named `HonkVerifier`, which is why they are named by file.
+  The Greco relations that proof checks are built by
+  `crates/zk-helpers/src/circuits/threshold/user_data_encryption/` and proved by the circuits under
+  `circuits/bin/threshold/`. See the Greco [paper](https://eprint.iacr.org/2024/594).

package/contracts/CRISPProgram.sol

@@ -12,11 +12,16 @@ import { IInterfold } from "@interfold/contracts/contracts/interfaces/IInterfold
 import { E3 } from "@interfold/contracts/contracts/interfaces/IE3.sol";
 import { Risc0ComputeProof } from "@interfold/contracts/contracts/lib/Risc0ComputeProof.sol";
 import { LazyIMTData, InternalLazyIMT } from "@zk-kit/lazy-imt.sol/InternalLazyIMT.sol";
+import { SNARK_SCALAR_FIELD } from "@zk-kit/lazy-imt.sol/Constants.sol";
 import { EIP712 } from "@openzeppelin/contracts/utils/cryptography/EIP712.sol";
 import { IHonkVerifier } from "./interfaces/IHonkVerifier.sol";
 import { IVotesToken } from "./interfaces/IVotesToken.sol";
 import { IERC6372Clock } from "./interfaces/IERC6372Clock.sol";
 
+interface IInterfoldProgramRegistry {
+  function e3Programs(IE3Program e3Program) external view returns (bool);
+}
+
 contract CRISPProgram is IE3Program, Ownable, EIP712 {
   using InternalLazyIMT for LazyIMTData;
 
@@ -59,6 +64,30 @@ contract CRISPProgram is IE3Program, Ownable, EIP712 {
     uint256 merkleRoot;
     bytes32 paramsHash;
     mapping(address slot => uint40 index) voteSlots;
+    /// @notice The proven ciphertext commitment of every input, keyed by slot and tree index.
+    /// @dev Keyed by both so a parent lookup for the wrong slot returns zero and is refused: it
+    /// costs no more storage than a single-key map and removes a separate same-slot check.
+    ///
+    /// A history rather than one commitment per slot. An input names the entry it extends, and
+    /// this contract cannot tell whether the bytes published with an entry deserialize to the
+    /// ciphertext its commitment describes — only the Secure Process can, once the input window
+    /// closes. Keeping only the newest commitment would therefore let anyone leave a slot whose
+    /// head nobody but they can open, and a slot that cannot be masked is a slot whose every later
+    /// input is provably its owner voting again. With the history, an entry like that is simply
+    /// never extended: the next input names the same parent, and masking continues.
+    mapping(address slot => mapping(uint40 index => bytes32 commitment)) inputCommitment;
+    /// @notice Leaves already appended to this round's input tree.
+    /// @dev A replay guard, not a uniqueness requirement on ballots. The proof constrains the
+    /// commitment, not who submits it, so anyone who observes a published input can resubmit the
+    /// identical calldata: the proof still verifies and {_processVote} appends again. The tally
+    /// does not change — the replay names the same parent as the original, which is no longer the
+    /// head, so the Secure Process drops it — but the tree is fixed-depth, so enough replays reach
+    /// capacity and every later input reverts, denying the round.
+    ///
+    /// Keyed by the leaf rather than the proof because the leaf is exactly what an append adds.
+    /// Two genuinely distinct inputs differ in bytes, commitment, slot or parent, so they differ
+    /// here; only a byte-identical resubmission collides.
+    mapping(uint256 leaf => bool) appendedLeaf;
     LazyIMTData votes;
     uint256 numOptions;
     CreditMode creditMode;
@@ -73,6 +102,9 @@ contract CRISPProgram is IE3Program, Ownable, EIP712 {
     /// @notice The timepoint that voting power is read at, in the ERC-6372 clock units of the
     /// token. Recorded when the round is requested, so it is the same for every input.
     uint48 snapshot;
+    /// @notice Divides raw token voting power into the units the ballot is encoded in. Only used
+    /// by `CensusMode.ONCHAIN`. Never zero for such a round.
+    uint256 votingPowerDivisor;
   }
 
   // Constants
@@ -89,6 +121,9 @@ contract CRISPProgram is IE3Program, Ownable, EIP712 {
   /// (`circuits/lib/src/constants.nr`). A round above this accepts no ballot, because every
   /// vote proof fails. Must stay aligned with the SDK constant of the same name.
   uint256 constant MAX_VOTE_OPTIONS = 10;
+  /// @notice Largest `decimals` a divisor can be derived from: `10 ** 77` is the last power of ten
+  /// that fits in a uint256.
+  uint8 constant MAX_DERIVABLE_DECIMALS = 78;
   // State variables
   IInterfold public interfold;
   IRiscZeroVerifier public risc0Verifier;
@@ -112,6 +147,9 @@ contract CRISPProgram is IE3Program, Ownable, EIP712 {
   error CallerNotAuthorized();
   error E3AlreadyInitialized();
   error InterfoldAddressZero();
+  error InterfoldAlreadyBound();
+  error InterfoldNotContract();
+  error ProgramNotRegistered();
   error Risc0VerifierAddressZero();
   error InvalidHonkVerifier();
   error EmptyInputData();
@@ -133,6 +171,24 @@ contract CRISPProgram is IE3Program, Ownable, EIP712 {
   /// replaces the Merkle membership proof that gates both branches in the other modes.
   error SlotNotEligible();
   error InvalidCensusMode();
+
+  /// @notice A token reports more decimals than a divisor can be derived from.
+  /// @dev `10 ** (decimals - 1)` must fit in a uint256. Pass an explicit divisor for such a token.
+  error UnsupportedTokenDecimals(uint8 decimals);
+
+  /// @notice An ONCHAIN round's floor is below one ballot unit.
+  /// @dev `minVotingPower` must be at least the divisor, so every slot that clears the floor
+  /// carries at least one unit of weight. Below that, a slot could be eligible to write yet scale
+  /// to zero — able to publish, but unable to carry any weight, which is disenfranchisement that
+  /// nothing on-chain would report.
+  error MinVotingPowerBelowScale();
+  /// @notice An input names a parent this slot never wrote to.
+  /// @dev Includes an index belonging to another slot, which the per-slot commitment map reads as
+  /// absent. Name no parent instead when there is nothing to extend.
+  error UnknownParentInput(uint40 parentIndex);
+
+  /// @notice Thrown when an input identical to one already published is submitted again.
+  error InputAlreadyPublished(uint256 leaf);
   error SlotIsEmpty();
   error MerkleRootNotSet();
   error InvalidNumOptions();
@@ -142,32 +198,60 @@ contract CRISPProgram is IE3Program, Ownable, EIP712 {
   error InvalidComputeContext();
 
   // Events
-  event InputPublished(uint256 indexed e3Id, bytes encryptedVote, uint256 index);
-
-  /// @notice Initialize the contract, binding it to a specified RISC Zero verifier.
-  /// @param _interfold The interfold address
+  event InterfoldBound(address indexed interfold);
+
+  /// @notice A ciphertext input was accepted for a round.
+  /// @dev Carries the slot and the commitment as well as the bytes. Both are already public — the
+  /// slot is a plaintext `publishInput` argument and `getSlotIndex` exposes it — so emitting them
+  /// leaks nothing and saves every consumer from parsing transaction calldata. The Secure Process
+  /// needs the commitment to check that the published bytes are the ciphertext that was proven.
+  event InputPublished(
+    uint256 indexed e3Id,
+    address indexed slotAddress,
+    bytes32 encryptedVoteCommitment,
+    bytes encryptedVote,
+    uint256 index,
+    uint40 parentIndexPlusOne
+  );
+
+  /// @notice Initialize the contract without an Interfold controller.
+  /// @dev The owner binds the controller after Interfold registers this program.
+  /// @param _initialOwner The account that can configure and bind this program.
   /// @param _risc0Verifier The RISC Zero verifier address
   /// @param _honkVerifier The honk verifier address
   /// @param _imageId The image ID for the guest program
   constructor(
-    IInterfold _interfold,
+    address _initialOwner,
     IRiscZeroVerifier _risc0Verifier,
     IHonkVerifier _honkVerifier,
     IHonkVerifier _onchainHonkVerifier,
     bytes32 _imageId
-  ) Ownable(msg.sender) EIP712("CRISP", "1") {
-    if (address(_interfold) == address(0)) revert InterfoldAddressZero();
+  ) Ownable(_initialOwner) EIP712("CRISP", "1") {
     if (address(_risc0Verifier) == address(0)) revert Risc0VerifierAddressZero();
     if (address(_honkVerifier) == address(0)) revert InvalidHonkVerifier();
     if (address(_onchainHonkVerifier) == address(0)) revert InvalidHonkVerifier();
 
-    interfold = _interfold;
     risc0Verifier = _risc0Verifier;
     honkVerifier = _honkVerifier;
     onchainHonkVerifier = _onchainHonkVerifier;
     imageId = _imageId;
   }
 
+  /// @notice Bind this program to its permanent Interfold controller.
+  /// @dev Interfold must register this program before the owner calls this function.
+  /// @param _interfold The Interfold controller that registered this program.
+  function bindInterfold(IInterfold _interfold) external onlyOwner {
+    if (address(interfold) != address(0)) revert InterfoldAlreadyBound();
+    if (address(_interfold) == address(0)) revert InterfoldAddressZero();
+    if (address(_interfold).code.length == 0) revert InterfoldNotContract();
+    if (!IInterfoldProgramRegistry(address(_interfold)).e3Programs(IE3Program(address(this)))) {
+      revert ProgramNotRegistered();
+    }
+
+    interfold = _interfold;
+    emit InterfoldBound(address(_interfold));
+  }
+
   /// @notice The digest a voter signs to authorise one ballot.
   /// @dev Computed for every input, and for mask inputs as well as real votes. The circuit ignores
   /// it on the mask branch, but the contract must not skip it: a digest that were computed only
@@ -192,12 +276,19 @@ contract CRISPProgram is IE3Program, Ownable, EIP712 {
   }
 
   /// @notice Set the Image ID for the guest program
+  /// @dev This value is application state, not protocol state. Interfold snapshots the protocol
+  /// ciphertext verifier for each E3 at request time, and that verifier's own `imageId` is
+  /// immutable, so changing this value cannot replace a computation the protocol already accepted.
+  /// It can still break an E3 that is in flight: `verify` would then check the receipt against a
+  /// guest that did not produce it, the round would fail as a compute timeout, and
+  /// `FailurePayerLib` bills that to the requester. Change it only between rounds.
   /// @param _imageId The new image ID.
   function setImageId(bytes32 _imageId) external onlyOwner {
     imageId = _imageId;
   }
 
   /// @notice Set the RISC Zero verifier.
+  /// @dev Carries the same in-flight risk as `setImageId`. Change it only between rounds.
   /// @param _risc0Verifier The new RISC Zero verifier address
   function setRisc0Verifier(IRiscZeroVerifier _risc0Verifier) external onlyOwner {
     if (address(_risc0Verifier) == address(0)) revert Risc0VerifierAddressZero();
@@ -237,6 +328,36 @@ contract CRISPProgram is IE3Program, Ownable, EIP712 {
     numberOfVotes = round.votes.numberOfLeaves;
   }
 
+  /// @notice The divisor applied to raw token voting power for a `CensusMode.ONCHAIN` round.
+  /// @dev A client must divide by exactly this before proving, because the contract passes the
+  /// scaled value to the circuit as public input 4 and the proof is checked against it. Zero for
+  /// rounds that are not ONCHAIN, where no scaling happens.
+  /// @param e3Id The E3 to look up.
+  /// @return The divisor recorded at validation.
+  function votingPowerDivisorOf(uint256 e3Id) external view returns (uint256) {
+    return e3Data[e3Id].votingPowerDivisor;
+  }
+
+  /// @notice The voting power a slot may spend in an ONCHAIN round, in ballot units.
+  /// @dev The value `publishInput` will hand the circuit as public input 4, computed by the same
+  /// contract that will check the proof. A client must prove against exactly this: recomputing it
+  /// off-chain means re-deriving the snapshot, the divisor and the rounding, and any drift only
+  /// shows up as an opaque verifier failure. Returns 0 for a round that is not ONCHAIN, where the
+  /// bound comes from the census leaf instead.
+  ///
+  /// Does not apply the eligibility floor — it answers "how much weight", not "may this slot
+  /// write". `publishInput` still enforces the floor.
+  /// @param e3Id The round.
+  /// @param slot The slot address.
+  /// @return The spendable voting power, in ballot units.
+  function votingPowerOf(uint256 e3Id, address slot) external view returns (uint256) {
+    RoundData storage round = e3Data[e3Id];
+    if (round.censusMode != CensusMode.ONCHAIN) return 0;
+    if (round.creditMode == CreditMode.CONSTANT) return round.credits;
+
+    return IVotesToken(round.token).getPastVotes(slot, round.snapshot) / round.votingPowerDivisor;
+  }
+
   /// @notice The census source a round was requested with.
   /// @dev A separate getter rather than a sixth return value on `getRoundData`, whose tuple is
   /// already consumed by the server and the SDK — widening it would break them for a field most
@@ -277,10 +398,15 @@ contract CRISPProgram is IE3Program, Ownable, EIP712 {
   /// @param e3Id The E3 being configured.
   /// @param customParams The ABI-encoded round configuration.
   function _initRound(uint256 e3Id, bytes calldata customParams) internal {
-    (address token, uint256 minVotingPower, uint256 numOptions, CreditMode creditMode, uint256 credits, uint256 rawCensusMode) = abi.decode(
-      customParams,
-      (address, uint256, uint256, CreditMode, uint256, uint256)
-    );
+    (
+      address token,
+      uint256 minVotingPower,
+      uint256 numOptions,
+      CreditMode creditMode,
+      uint256 credits,
+      uint256 rawCensusMode,
+      uint256 votingPowerDivisor
+    ) = abi.decode(customParams, (address, uint256, uint256, CreditMode, uint256, uint256, uint256));
 
     // The circuit asserts `num_options <= MAX_OPTIONS`, so a round configured above it accepts no
     // ballot at all. Reject at request time rather than stranding a round nobody can vote in.
@@ -340,6 +466,26 @@ contract CRISPProgram is IE3Program, Ownable, EIP712 {
       }
 
       round.snapshot = snapshot;
+
+      // Derived only after the code check above. `decimals()` on a codeless address returns empty
+      // data, and the failure happens while decoding rather than inside the call, which `try` does
+      // not catch — deriving any earlier would refuse an EOA with a bare panic instead of the
+      // named error the check above raises.
+      uint256 divisor = votingPowerDivisor == 0 ? _defaultVotingPowerDivisor(token) : votingPowerDivisor;
+
+      // Only CUSTOM credits take the circuit bound from scaled power; a CONSTANT round hands the
+      // circuit `credits` and never reads the scaled value, so the floor and the divisor have
+      // nothing to agree about there.
+      //
+      // Where they do meet, the floor is raw and the bound is scaled, so they only agree when the
+      // floor is worth at least one ballot unit. Requiring it here means every slot that passes
+      // `_eligibility` carries weight, and it costs nothing: this reverts in the transaction that
+      // requests the E3, not per input after the fee is paid. It also keeps masks working — they
+      // run the same eligibility check as real votes, so a slot that scaled to zero could not be
+      // masked without revealing which inputs were masks.
+      if (creditMode == CreditMode.CUSTOM && minVotingPower < divisor) revert MinVotingPowerBelowScale();
+
+      round.votingPowerDivisor = divisor;
     }
   }
 
@@ -365,21 +511,26 @@ contract CRISPProgram is IE3Program, Ownable, EIP712 {
 
     if (data.length == 0) revert EmptyInputData();
 
-    (bytes memory noirProof, address slotAddress, bytes32 encryptedVoteCommitment, bytes memory encryptedVote) = abi.decode(
-      data,
-      (bytes, address, bytes32, bytes)
-    );
+    (
+      bytes memory noirProof,
+      address slotAddress,
+      bytes32 encryptedVoteCommitment,
+      bytes memory encryptedVote,
+      uint40 parentIndexPlusOne
+    ) = abi.decode(data, (bytes, address, bytes32, bytes, uint40));
 
     // The two census families differ here and nowhere else. A Merkle round proves membership
     // inside the circuit against a posted root. An ONCHAIN round reads the power from the token
     // and gives it to the circuit, so the eligibility check has to happen here instead.
     (bytes32 eligibility, IHonkVerifier verifier) = _eligibility(e3Id, slotAddress);
 
-    (uint40 voteIndex, bytes32 previousEncryptedVoteCommitment) = _processVote(e3Id, slotAddress, encryptedVoteCommitment);
+    bytes32 parentCommitment = _parentCommitment(e3Id, slotAddress, parentIndexPlusOne);
+
+    uint40 voteIndex = _processVote(e3Id, slotAddress, encryptedVoteCommitment, encryptedVote, parentIndexPlusOne);
 
     // Set the public inputs for the proof. Order must match Noir circuit.
     bytes32[] memory noirPublicInputs = new bytes32[](9);
-    noirPublicInputs[0] = previousEncryptedVoteCommitment;
+    noirPublicInputs[0] = parentCommitment;
     // A Keccak digest does not fit in one field element, so it enters the circuit as its two
     // 16-byte halves. The circuit rebuilds the 32 bytes with `digest_from_halves`.
     {
@@ -389,7 +540,7 @@ contract CRISPProgram is IE3Program, Ownable, EIP712 {
     }
     noirPublicInputs[3] = bytes32(uint256(uint160(slotAddress)));
     noirPublicInputs[4] = eligibility;
-    noirPublicInputs[5] = bytes32(uint256(previousEncryptedVoteCommitment == bytes32(0) ? 1 : 0));
+    noirPublicInputs[5] = bytes32(uint256(parentIndexPlusOne == 0 ? 1 : 0));
     noirPublicInputs[6] = bytes32(e3Data[e3Id].numOptions);
     noirPublicInputs[7] = encryptedVoteCommitment;
     noirPublicInputs[8] = e3.committeePublicKey;
@@ -399,7 +550,31 @@ contract CRISPProgram is IE3Program, Ownable, EIP712 {
       revert InvalidNoirProof();
     }
 
-    emit InputPublished(e3Id, encryptedVote, voteIndex);
+    emit InputPublished(e3Id, slotAddress, encryptedVoteCommitment, encryptedVote, voteIndex, parentIndexPlusOne);
+  }
+
+  /// @notice The commitment of the entry an input names as its parent.
+  /// @dev Zero when the input names none, which is what the circuit reads as `is_first_vote`.
+  ///
+  /// Naming no parent is allowed even when the slot already holds entries, and it has to be: a
+  /// slot whose every entry is unusable has nothing to extend, and refusing that here would leave
+  /// it permanently unwritable. Nothing is gained by refusing it either — the Secure Process
+  /// accepts an entry only when its parent is the one currently selected for the slot, so an input
+  /// that skips a usable parent is dropped from the tally wherever this contract lets it through.
+  /// @param e3Id The round.
+  /// @param slotAddress The slot the input is written to.
+  /// @param parentIndexPlusOne The tree index of the parent entry plus one, or zero for none.
+  /// @return The parent's commitment, or zero.
+  function _parentCommitment(uint256 e3Id, address slotAddress, uint40 parentIndexPlusOne) internal view returns (bytes32) {
+    if (parentIndexPlusOne == 0) return bytes32(0);
+
+    bytes32 commitment = e3Data[e3Id].inputCommitment[slotAddress][parentIndexPlusOne - 1];
+    // Zero for an index this slot never wrote to, including one belonging to another slot. The
+    // circuit would read it as `is_first_vote` while this contract reads it as an update, so the
+    // two would disagree about the same input.
+    if (commitment == bytes32(0)) revert UnknownParentInput(parentIndexPlusOne - 1);
+
+    return commitment;
   }
 
   /// @notice Resolve the eligibility public input and the verifier for a round.
@@ -419,19 +594,48 @@ contract CRISPProgram is IE3Program, Ownable, EIP712 {
       return (bytes32(round.merkleRoot), honkVerifier);
     }
 
-    uint256 power = IVotesToken(round.token).getPastVotes(slotAddress, round.snapshot);
+    uint256 rawPower = IVotesToken(round.token).getPastVotes(slotAddress, round.snapshot);
 
-    // A slot with no power is never writable, whatever the round configured. Without this floor a
-    // round with `minVotingPower == 0` would let anyone mask any address, including addresses that
-    // never held the token.
+    // The floor is compared against RAW power, in the token's own units. `minVotingPower` is a
+    // governance setting ("you need N tokens to vote") written the way every other token plugin
+    // writes it, so scaling it here would reinterpret a configured value by the divisor.
     uint256 threshold = round.minVotingPower == 0 ? 1 : round.minVotingPower;
-    if (power < threshold) revert SlotNotEligible();
+    if (rawPower < threshold) revert SlotNotEligible();
+
+    // Scaled only for the circuit. It enforces `vote <= voting_power`, and the BFV encoding caps
+    // each choice at `2**(100/numOptions) - 1` — about 8.6e9 for three options. Raw power from an
+    // 18-decimal token is ~1e18 per token, so handing it over unscaled would put every holder
+    // above the cap and collapse token weighting into a flat ceiling. Dividing mirrors what the
+    // coordinator does when it builds a Merkle census (`balance / 10**(decimals - 1)`), so both
+    // census families encode ballots in the same units and a tally decodes the same way.
+    uint256 power = rawPower / round.votingPowerDivisor;
 
     // Eligibility comes from the power at the snapshot. The weight the circuit enforces comes from
     // the credit mode, so a CONSTANT round gives every eligible slot the same credits.
     return (bytes32(round.creditMode == CreditMode.CONSTANT ? round.credits : power), onchainHonkVerifier);
   }
 
+  /// @notice The divisor to apply to raw voting power when the requester does not name one.
+  /// @dev Mirrors the coordinator's census scaling (`balance / 10**(decimals - 1)`), so an ONCHAIN
+  /// round and a Merkle round over the same token encode ballots in identical units. `decimals()`
+  /// is optional on an ERC20, so a token without it is left unscaled rather than rejected — a
+  /// requester that needs scaling for such a token passes an explicit divisor.
+  /// @param token The token voting power is read from.
+  /// @return The divisor, never zero.
+  function _defaultVotingPowerDivisor(address token) internal view returns (uint256) {
+    try IVotesToken(token).decimals() returns (uint8 dec) {
+      // `10 ** 78` does not fit in a uint256, and the exponentiation happens in the success body
+      // of the `try`, where a revert is NOT caught — an absurd `decimals` would surface as a bare
+      // arithmetic panic instead of a named error, which is the failure mode the code check above
+      // exists to avoid. Refused explicitly; such a token can still be used by naming a divisor.
+      if (dec > MAX_DERIVABLE_DECIMALS) revert UnsupportedTokenDecimals(dec);
+
+      return dec > 1 ? 10 ** (uint256(dec) - 1) : 1;
+    } catch {
+      return 1;
+    }
+  }
+
   /// @notice The last finalized timepoint of a token, in its ERC-6372 clock units.
   /// @dev Falls back to block numbers when the token has no `clock()`, which matches the default
   /// ERC20Votes clock.
@@ -487,15 +691,32 @@ contract CRISPProgram is IE3Program, Ownable, EIP712 {
     return votes;
   }
 
-  /// @notice Get the slot index for a given E3 ID and slot address
+  /// @notice The index of the last input published to a slot.
+  /// @dev The last one *published*, which is not always the one that holds the slot. This contract
+  /// cannot tell whether an input's bytes deserialize to the ciphertext its commitment describes,
+  /// so the entry at this index may be one the Secure Process will never select. A client naming a
+  /// parent must resolve the chain — from the published bytes, or from the CRISP server's
+  /// `state/previous-ciphertext` — rather than reading it from here.
   /// @param e3Id The E3 program ID
   /// @param slotAddress The slot address
-  /// @return The slot index, or -1 if the slot is empty
+  /// @return The index of the last published input, or -1 if the slot is empty
   function getSlotIndex(uint256 e3Id, address slotAddress) external view returns (int40) {
     uint40 storedIndexPlusOne = e3Data[e3Id].voteSlots[slotAddress];
     return int40(storedIndexPlusOne) - 1;
   }
 
+  /// @notice The commitment this contract recorded for one entry of a slot.
+  /// @dev Zero for an index this slot never wrote to. A client names a parent by index and must
+  /// prove against exactly the commitment stored for it, so this is how it checks what that will
+  /// be before proving.
+  /// @param e3Id The round.
+  /// @param slotAddress The slot address.
+  /// @param index The tree index of the entry.
+  /// @return The stored commitment, or zero when there is no such entry for this slot.
+  function inputCommitmentOf(uint256 e3Id, address slotAddress, uint40 index) external view returns (bytes32) {
+    return e3Data[e3Id].inputCommitment[slotAddress][index];
+  }
+
   /// @inheritdoc IE3Program
   function verify(
     uint256 e3Id,
@@ -525,29 +746,56 @@ contract CRISPProgram is IE3Program, Ownable, EIP712 {
     return true;
   }
 
-  /// @notice Process a vote: insert or update in the merkle tree depending
-  /// on whether it's the first vote or an override.
+  /// @notice Record one input: append its leaf and remember its commitment for later parents.
   function _processVote(
     uint256 e3Id,
     address slotAddress,
-    bytes32 encryptedVoteCommitment
-  ) internal returns (uint40 voteIndex, bytes32 previousEncryptedVoteCommitment) {
-    uint40 storedIndexPlusOne = e3Data[e3Id].voteSlots[slotAddress];
+    bytes32 encryptedVoteCommitment,
+    bytes memory encryptedVote,
+    uint40 parentIndexPlusOne
+  ) internal returns (uint40 voteIndex) {
+    RoundData storage round = e3Data[e3Id];
 
-    // we treat the index 0 as not voted yet
-    // any valid index will be index + 1
-    if (storedIndexPlusOne == 0) {
-      // FIRST VOTE
-      previousEncryptedVoteCommitment = bytes32(0);
-      voteIndex = e3Data[e3Id].votes.numberOfLeaves;
-      e3Data[e3Id].voteSlots[slotAddress] = voteIndex + 1;
-      e3Data[e3Id].votes._insert(uint256(encryptedVoteCommitment));
-    } else {
-      // RE-VOTE
-      voteIndex = storedIndexPlusOne - 1;
-      previousEncryptedVoteCommitment = bytes32(e3Data[e3Id].votes.elements[voteIndex]);
-      e3Data[e3Id].votes._update(uint256(encryptedVoteCommitment), voteIndex);
-    }
+    // Append-only. Updating a slot's leaf in place would let anyone who can write to a slot — and
+    // the mask path needs no signature — replace the bytes of a vote that was already counted,
+    // erasing it. Appending leaves the earlier entry in the tree, so the Secure Process can fall
+    // back to it when a later entry is unusable, and nothing is lost.
+    uint256 leaf = inputLeaf(encryptedVote, encryptedVoteCommitment, slotAddress, parentIndexPlusOne);
+
+    // Refuse a byte-identical resubmission. Without this the tree is a free growth surface for
+    // anyone replaying a published input, and the round dies at tree capacity rather than at the
+    // input deadline.
+    if (round.appendedLeaf[leaf]) revert InputAlreadyPublished(leaf);
+    round.appendedLeaf[leaf] = true;
+
+    voteIndex = round.votes.numberOfLeaves;
+    round.votes._insert(leaf);
+
+    round.voteSlots[slotAddress] = voteIndex + 1;
+    round.inputCommitment[slotAddress][voteIndex] = encryptedVoteCommitment;
+  }
+
+  /// @notice Builds the input tree leaf for one published input.
+  /// @dev Binds four things the Secure Process must be able to trust:
+  ///
+  /// - the **bytes**, because the Noir proof constrains the commitment and never sees the
+  ///   serialized ciphertext, so the two can disagree and only the guest can tell;
+  /// - the **commitment**, so a submitter cannot pair any commitment with any ciphertext;
+  /// - the **slot**, because the tree is append-only and the guest tallies one entry per slot.
+  ///   Without the slot in the leaf a prover could re-group entries and change which one wins;
+  /// - the **parent**, because that is what the guest walks the slot's chain by. An unbound parent
+  ///   would let a prover re-point entries and select a different one.
+  ///
+  /// SHA-256 rather than Keccak: the zkVM accelerates SHA-256 inline, while its Keccak accelerator
+  /// emits a proof assumption the host must prove separately and compose. The extra on-chain cost
+  /// is about 67k gas on a transaction that already carries the ciphertext.
+  function inputLeaf(
+    bytes memory encryptedVote,
+    bytes32 commitment,
+    address slotAddress,
+    uint40 parentIndexPlusOne
+  ) public pure returns (uint256) {
+    return uint256(sha256(abi.encodePacked(sha256(encryptedVote), commitment, slotAddress, parentIndexPlusOne))) % SNARK_SCALAR_FIELD;
   }
 
   /// @notice Decode bytes to uint64 array

package/contracts/Mocks/MockInterfold.sol

@@ -19,6 +19,11 @@ contract MockInterfold {
   uint256 public nextE3Id;
 
   mapping(uint256 => E3) public e3s;
+  mapping(IE3Program => bool) public e3Programs;
+
+  function registerE3Program(IE3Program program) external {
+    e3Programs[program] = true;
+  }
 
   function request(address program) external {
     _request(program, 2);
@@ -68,7 +73,7 @@ contract MockInterfold {
       encryptionSchemeId: ENCRYPTION_SCHEME_ID,
       e3Program: IE3Program(address(0)),
       paramSet: 0, // Insecure512
-      customParams: abi.encode(address(0), nextE3Id, numOptions, 0, 0, 0),
+      customParams: abi.encode(address(0), nextE3Id, numOptions, 0, 0, 0, 0),
       decryptionVerifier: IDecryptionVerifier(address(0)),
       pkVerifier: IPkVerifier(address(0)),
       committeePublicKey: committeePublicKey,
@@ -78,7 +83,7 @@ contract MockInterfold {
       ciphertextCommitment: bytes32(0)
     });
 
-    IE3Program(program).validate(nextE3Id, 0, bytes(""), bytes(""), abi.encode(address(0), nextE3Id, numOptions, 0, 0, 0));
+    IE3Program(program).validate(nextE3Id, 0, bytes(""), bytes(""), abi.encode(address(0), nextE3Id, numOptions, 0, 0, 0, 0));
 
     nextE3Id++;
   }
@@ -105,7 +110,7 @@ contract MockInterfold {
         encryptionSchemeId: ENCRYPTION_SCHEME_ID,
         e3Program: IE3Program(address(0)),
         paramSet: 0, // Insecure512
-        customParams: abi.encode(address(0), 0, 2, 0, 0, 0),
+        customParams: abi.encode(address(0), 0, 2, 0, 0, 0, 0),
         decryptionVerifier: IDecryptionVerifier(address(0)),
         pkVerifier: IPkVerifier(address(0)),
         committeePublicKey: committeePublicKey,

package/contracts/SelfRegistry.sol

@@ -0,0 +1,101 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+//
+// This file is provided WITHOUT ANY WARRANTY;
+// without even the implied warranty of MERCHANTABILITY
+// or FITNESS FOR A PARTICULAR PURPOSE.
+pragma solidity >=0.8.27;
+
+/// @notice An open self-registration census for `CensusMode.ONCHAIN` rounds.
+/// @dev Anyone may register themselves, once, and registration is permanent. The contract answers
+/// the `IVotesToken` surface `CRISPProgram._eligibility` reads: `getPastVotes` returns 1 for a
+/// registered account and 0 otherwise. It has no `decimals()`, so the voting-power divisor
+/// derives to 1, and no `clock()`, so the round snapshot falls back to block numbers — both
+/// fallbacks `CRISPProgram` already implements.
+///
+/// `getPastVotes` deliberately ignores the timepoint. An honest checkpointed answer would fix the
+/// electorate at the round's snapshot, which is taken in the transaction that requests the round —
+/// before anyone knew there was a round to register for. Ignoring it is what lets a voter register
+/// during the input window and vote in the same round. The cost is that the electorate is not
+/// fixed per round: an input's eligibility depends on when it is published, not on one snapshot
+/// every input shares. That is a deliberate trade for low-stakes polls.
+///
+/// Registration is open and unpriced, so one person can register any number of addresses. Use
+/// this census only where one-address-one-vote is not worth attacking — a meme poll, a temperature
+/// check — never where the outcome carries value. Pair it with `CreditMode.CONSTANT` and credits
+/// of 1: every registrant carries the same weight, and `minVotingPower` of 1 is exactly what a
+/// registered account reports.
+///
+/// Registrants are enumerable so mask submitters can draw a target: a mask is written to someone
+/// else's slot, and without a public list of who is eligible there is nobody to mask. The list is
+/// append-only, which keeps indices stable for random selection.
+contract SelfRegistry {
+  /// @notice One entry per registered account, in registration order. Append-only.
+  address[] private _registrants;
+
+  /// @notice Whether an account has registered.
+  mapping(address account => bool) public isRegistered;
+
+  /// @notice An account registered for voting.
+  /// @param account The account that registered.
+  /// @param index Its position in the registrant list.
+  event Registered(address indexed account, uint256 index);
+
+  /// @notice The account has already registered; registration is permanent and single-shot.
+  error AlreadyRegistered(address account);
+
+  /// @notice Register the caller as an eligible voter.
+  /// @dev Permanent: there is no deregistration. Removing an entry would shift or hole the
+  /// registrant list that mask submitters index into, and would let a voter provably leave the
+  /// electorate mid-round — a slot that cannot be masked any more is a receipt.
+  function register() external {
+    if (isRegistered[msg.sender]) revert AlreadyRegistered(msg.sender);
+
+    isRegistered[msg.sender] = true;
+    _registrants.push(msg.sender);
+
+    emit Registered(msg.sender, _registrants.length - 1);
+  }
+
+  /// @notice The voting power of an account: 1 when registered, 0 otherwise.
+  /// @dev The timepoint is ignored — see the contract-level note. The parameter stays in the
+  /// signature because `CRISPProgram` calls through `IVotesToken`.
+  /// @param account The account to read.
+  /// @return One for a registered account, zero otherwise.
+  function getPastVotes(address account, uint256) external view returns (uint256) {
+    return isRegistered[account] ? 1 : 0;
+  }
+
+  /// @notice How many accounts have registered.
+  /// @return The registrant count.
+  function totalRegistrants() external view returns (uint256) {
+    return _registrants.length;
+  }
+
+  /// @notice The registrant at one index of the append-only list.
+  /// @param index The position, in registration order.
+  /// @return The registered account.
+  function registrantAt(uint256 index) external view returns (address) {
+    return _registrants[index];
+  }
+
+  /// @notice A page of the registrant list, for clients drawing mask targets.
+  /// @dev Clamped rather than reverting past the end, so a caller can page with a fixed size and
+  /// not race registrations between reading the count and reading the page.
+  /// @param start The first index to read.
+  /// @param count How many entries to read at most.
+  /// @return page The registrants in `[start, min(start + count, total))`.
+  function registrants(uint256 start, uint256 count) external view returns (address[] memory page) {
+    uint256 total = _registrants.length;
+    if (start >= total) return new address[](0);
+
+    // Compared by subtraction, not by `start + count > total`: the addition runs under checked
+    // arithmetic, so a large `count` would revert before the clamp it exists to trigger.
+    // `total - start` cannot underflow — `start < total` is established above.
+    uint256 end = count > total - start ? total : start + count;
+    page = new address[](end - start);
+
+    for (uint256 i = start; i < end; i++) {
+      page[i - start] = _registrants[i];
+    }
+  }
+}

package/contracts/interfaces/IHonkVerifier.sol

@@ -7,8 +7,10 @@ pragma solidity >=0.8.27;
 
 /// @notice The subset of a generated Honk verifier that `CRISPProgram` calls.
 /// @dev Declared as an interface so the census paths can hold verifiers generated from different
-/// circuits. `CRISPVerifier.sol` and `CRISPOnchainVerifier.sol` both declare a contract named
-/// `HonkVerifier`, so importing both concrete types would collide.
+/// circuits. Every generated verifier declares a contract named `HonkVerifier`, and there is one
+/// per census mode per BFV preset under `contracts/verifiers/<preset>/`, so importing the concrete
+/// types would collide. Deployment resolves the right one by fully qualified name; see
+/// `scripts/verifiers.ts`.
 interface IHonkVerifier {
   /// @notice Verify a folded ballot proof against its public inputs.
   /// @dev Reverts rather than returning false when the public inputs do not match the proof.

package/contracts/interfaces/IVotesToken.sol

@@ -14,4 +14,10 @@ interface IVotesToken {
   /// @param timepoint The timepoint, in the ERC-6372 clock units of the token.
   /// @return The voting power at that timepoint.
   function getPastVotes(address account, uint256 timepoint) external view returns (uint256);
+
+  /// @notice The token's decimals, used to derive the default voting-power divisor.
+  /// @dev Optional: a token without it falls back to a divisor of 1, so the probe must not be
+  /// treated as a requirement the way `getPastVotes` is.
+  /// @return The number of decimals.
+  function decimals() external view returns (uint8);
 }

package/contracts/{CRISPOnchainVerifier.sol → verifiers/CRISPOnchainVerifier.sol}

@@ -8,7 +8,7 @@ pragma solidity >=0.8.21;
 uint256 constant N = 2097152;
 uint256 constant LOG_N = 21;
 uint256 constant NUMBER_OF_PUBLIC_INPUTS = 17;
-uint256 constant VK_HASH = 0x0b1a8d6509209282299c53d628ce472a47ef437bdb6799ccbc0423372bb530d4;
+uint256 constant VK_HASH = 0x0a12a4d2efe48fe7bee586e156eb7cb5d2d7dc71bccf0fa4b4a9b91c097b4c8c;
 library HonkVerificationKey {
   function loadVerificationKey() internal pure returns (Honk.VerificationKey memory) {
     Honk.VerificationKey memory vk = Honk.VerificationKey({
@@ -20,8 +20,8 @@ library HonkVerificationKey {
         y: uint256(0x01137e39f6b1ec6101fad7a4472102bfe11e7534e55e58109734c4b927efe6a6)
       }),
       qr: Honk.G1Point({
-        x: uint256(0x289b159ca7e4437437f18d73d2b649c2043fa68dfcf97dbfeedf6f1b424d068b),
-        y: uint256(0x28ed000f4b9a44c36695072beaab8802db7f39473ce933426e62ee4f817e0899)
+        x: uint256(0x2ac08692659e39f2a9f8cff82c54221ef67e138279c03ffbe9cba0976cb5c5bb),
+        y: uint256(0x18d2a25f4040b02577dcec145c99e389c578119bc9652bd2e07cf1e6ac2edbd9)
       }),
       qo: Honk.G1Point({
         x: uint256(0x18424976826978ddb710bfdc21c64a296884c27b0d8dadf6ac7681445dde8d8c),

package/contracts/{CRISPVerifier.sol → verifiers/CRISPVerifier.sol}

@@ -8,7 +8,7 @@ pragma solidity >=0.8.21;
 uint256 constant N = 2097152;
 uint256 constant LOG_N = 21;
 uint256 constant NUMBER_OF_PUBLIC_INPUTS = 17;
-uint256 constant VK_HASH = 0x1d0e6ec8f2fe720a1f528f02a66b66c1479c1648afaaedec06d89b889a0ff0c2;
+uint256 constant VK_HASH = 0x00d736cd7cf93a94fe0fa02be1bd85f7ea05d3bfa1697f95456c05a7cce354ce;
 library HonkVerificationKey {
   function loadVerificationKey() internal pure returns (Honk.VerificationKey memory) {
     Honk.VerificationKey memory vk = Honk.VerificationKey({
@@ -20,8 +20,8 @@ library HonkVerificationKey {
         y: uint256(0x01137e39f6b1ec6101fad7a4472102bfe11e7534e55e58109734c4b927efe6a6)
       }),
       qr: Honk.G1Point({
-        x: uint256(0x0c9d534606fb88b2814caaec28c8f0ccd9f903b2236fe399ce723cb7a89cff54),
-        y: uint256(0x12d1f3a930e1c9be768e98d5ed2c5c74b3bd1bce2f50ce042cde7270f8032df1)
+        x: uint256(0x048bf2f40b9f0e61917b3bd9d156debaa531af8449eebbb46c6ba23cb0de4ae2),
+        y: uint256(0x25842efe61b33504731c38e50c899a32ec606172705f7a3c74ca1427d83d0fe4)
       }),
       qo: Honk.G1Point({
         x: uint256(0x18424976826978ddb710bfdc21c64a296884c27b0d8dadf6ac7681445dde8d8c),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crisp-e3/contracts",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "type": "module",
   "files": [
     "contracts",
@@ -31,7 +31,7 @@
     "@zk-kit/lazy-imt.sol": "2.0.0-beta.12",
     "poseidon-solidity": "^0.0.5",
     "solady": "^0.1.13",
-    "@interfold/contracts": "0.6.0"
+    "@interfold/contracts": "0.13.0"
   },
   "devDependencies": {
     "@nomicfoundation/hardhat-keystore": "3.0.3",
@@ -53,8 +53,8 @@
     "typechain": "^8.3.0",
     "typescript": "5.8.3",
     "viem": "2.30.6",
-    "@crisp-e3/sdk": "^0.17.0",
-    "@crisp-e3/zk-inputs": "^0.17.0"
+    "@crisp-e3/sdk": "^0.18.0",
+    "@crisp-e3/zk-inputs": "^0.18.0"
   },
   "scripts": {
     "compile": "hardhat compile",
@@ -66,8 +66,16 @@
     "deploy:contracts:mock": "export USE_MOCKS=true PRINT_ENV_VARS=true && pnpm deploy:contracts",
     "deploy:contracts:full": "export DEPLOY_INTERFOLD=true && pnpm deploy:contracts",
     "deploy:contracts:full:mock": "export DEPLOY_INTERFOLD=true USE_MOCKS=true PRINT_ENV_VARS=true && pnpm deploy:contracts",
+    "governance:builder": "hardhat run deploy/create-governance-builder.ts",
     "test": "hardhat test mocha",
+    "check:test-legs": "node scripts/check-test-legs.mjs",
+    "test:unit": "pnpm check:test-legs && hardhat test mocha tests/census-mode.test.ts tests/crisp.journal.test.ts tests/input-leaf.test.ts tests/interfold-binding.test.ts tests/self-registry.test.ts tests/tally.decoding.test.ts",
+    "test:input-tree": "hardhat test mocha tests/input-tree-e2e.test.ts",
+    "test:input-tree:poisoning": "hardhat test mocha --grep \"accepts an input whose bytes|lets an honest mask follow\" -- tests/input-tree-e2e.test.ts",
+    "test:input-tree:canonical": "hardhat test mocha --grep \"^(?!.*(?:accepts an input whose bytes|lets an honest mask follow))\" -- tests/input-tree-e2e.test.ts",
+    "test:ballots": "hardhat test mocha tests/crisp.contracts.test.ts tests/onchain-census.test.ts",
     "verify": "hardhat run deploy/verify.ts",
-    "updateSubmissionWindow": "hardhat ciphernode:window"
+    "updateSubmissionWindow": "hardhat ciphernode:window",
+    "check:presets": "node ../../scripts/check-presets.mjs"
   }
 }