@crisp-e3/contracts 0.18.0-insecure.0 → 0.18.0

package/README.md

@@ -39,7 +39,7 @@ pnpm deploy:contracts:full     # also deploy Interfold stack (no ZK unless ENABL
 
 This is the main logic of CRISP - an interfold program for secure voting.
 
-It exposes two main functions:
+It exposes three main functions:
 
 - `validate` - that is called when a new E3 instance is requested on Interfold
   (`Interfold.request`).
@@ -47,10 +47,15 @@ It exposes two main functions:
   (`Interfold.publishCiphertextOutput`). This function ensures that the ciphertext output is valid.
   CRISP uses Risc0 as the compute provider for running the FHE program, thus the proof will be a
   Risc0 proof.
-- `validateInput` - validate the input data that is submitted to the E3 instance. It is called by
-  the Interfold contract when a new input is published (`Interfold.publishInput`). In CRISP, the
-  data providers (the ones submitting the inputs) are the voters, and the input submitted is the
-  vote itself. The logic checks that gating conditions are satisfied and that the ciphertext is
-  constructed correctly using
-  [Greco](https://github.com/gnosisguild/interfold/tree/main/circuits/crates/libs/greco). See the
-  Greco [paper](https://eprint.iacr.org/2024/594).
+- `publishInput` - accepts an input for the E3 instance. Data providers call it on this contract
+  directly. In CRISP, the data providers are the voters and the input is the vote itself. The
+  function checks the stage and the input window, resolves the voter's eligibility from the census,
+  and verifies a Noir proof over nine public inputs, which is what establishes that the ciphertext
+  was encrypted correctly under the committee public key
+  (`examples/CRISP/packages/crisp-contracts/contracts/CRISPProgram.sol:493-554`, paths from the
+  repository root). The verifier is the one the round's census selects: `CRISPVerifier.sol` for a
+  census posted as a Merkle root, `CRISPOnchainVerifier.sol` for one read from token balances on
+  chain. Both files declare a contract named `HonkVerifier`, which is why they are named by file.
+  The Greco relations that proof checks are built by
+  `crates/zk-helpers/src/circuits/threshold/user_data_encryption/` and proved by the circuits under
+  `circuits/bin/threshold/`. See the Greco [paper](https://eprint.iacr.org/2024/594).

package/contracts/SelfRegistry.sol

@@ -0,0 +1,101 @@
+// SPDX-License-Identifier: LGPL-3.0-only
+//
+// This file is provided WITHOUT ANY WARRANTY;
+// without even the implied warranty of MERCHANTABILITY
+// or FITNESS FOR A PARTICULAR PURPOSE.
+pragma solidity >=0.8.27;
+
+/// @notice An open self-registration census for `CensusMode.ONCHAIN` rounds.
+/// @dev Anyone may register themselves, once, and registration is permanent. The contract answers
+/// the `IVotesToken` surface `CRISPProgram._eligibility` reads: `getPastVotes` returns 1 for a
+/// registered account and 0 otherwise. It has no `decimals()`, so the voting-power divisor
+/// derives to 1, and no `clock()`, so the round snapshot falls back to block numbers — both
+/// fallbacks `CRISPProgram` already implements.
+///
+/// `getPastVotes` deliberately ignores the timepoint. An honest checkpointed answer would fix the
+/// electorate at the round's snapshot, which is taken in the transaction that requests the round —
+/// before anyone knew there was a round to register for. Ignoring it is what lets a voter register
+/// during the input window and vote in the same round. The cost is that the electorate is not
+/// fixed per round: an input's eligibility depends on when it is published, not on one snapshot
+/// every input shares. That is a deliberate trade for low-stakes polls.
+///
+/// Registration is open and unpriced, so one person can register any number of addresses. Use
+/// this census only where one-address-one-vote is not worth attacking — a meme poll, a temperature
+/// check — never where the outcome carries value. Pair it with `CreditMode.CONSTANT` and credits
+/// of 1: every registrant carries the same weight, and `minVotingPower` of 1 is exactly what a
+/// registered account reports.
+///
+/// Registrants are enumerable so mask submitters can draw a target: a mask is written to someone
+/// else's slot, and without a public list of who is eligible there is nobody to mask. The list is
+/// append-only, which keeps indices stable for random selection.
+contract SelfRegistry {
+  /// @notice One entry per registered account, in registration order. Append-only.
+  address[] private _registrants;
+
+  /// @notice Whether an account has registered.
+  mapping(address account => bool) public isRegistered;
+
+  /// @notice An account registered for voting.
+  /// @param account The account that registered.
+  /// @param index Its position in the registrant list.
+  event Registered(address indexed account, uint256 index);
+
+  /// @notice The account has already registered; registration is permanent and single-shot.
+  error AlreadyRegistered(address account);
+
+  /// @notice Register the caller as an eligible voter.
+  /// @dev Permanent: there is no deregistration. Removing an entry would shift or hole the
+  /// registrant list that mask submitters index into, and would let a voter provably leave the
+  /// electorate mid-round — a slot that cannot be masked any more is a receipt.
+  function register() external {
+    if (isRegistered[msg.sender]) revert AlreadyRegistered(msg.sender);
+
+    isRegistered[msg.sender] = true;
+    _registrants.push(msg.sender);
+
+    emit Registered(msg.sender, _registrants.length - 1);
+  }
+
+  /// @notice The voting power of an account: 1 when registered, 0 otherwise.
+  /// @dev The timepoint is ignored — see the contract-level note. The parameter stays in the
+  /// signature because `CRISPProgram` calls through `IVotesToken`.
+  /// @param account The account to read.
+  /// @return One for a registered account, zero otherwise.
+  function getPastVotes(address account, uint256) external view returns (uint256) {
+    return isRegistered[account] ? 1 : 0;
+  }
+
+  /// @notice How many accounts have registered.
+  /// @return The registrant count.
+  function totalRegistrants() external view returns (uint256) {
+    return _registrants.length;
+  }
+
+  /// @notice The registrant at one index of the append-only list.
+  /// @param index The position, in registration order.
+  /// @return The registered account.
+  function registrantAt(uint256 index) external view returns (address) {
+    return _registrants[index];
+  }
+
+  /// @notice A page of the registrant list, for clients drawing mask targets.
+  /// @dev Clamped rather than reverting past the end, so a caller can page with a fixed size and
+  /// not race registrations between reading the count and reading the page.
+  /// @param start The first index to read.
+  /// @param count How many entries to read at most.
+  /// @return page The registrants in `[start, min(start + count, total))`.
+  function registrants(uint256 start, uint256 count) external view returns (address[] memory page) {
+    uint256 total = _registrants.length;
+    if (start >= total) return new address[](0);
+
+    // Compared by subtraction, not by `start + count > total`: the addition runs under checked
+    // arithmetic, so a large `count` would revert before the clamp it exists to trigger.
+    // `total - start` cannot underflow — `start < total` is established above.
+    uint256 end = count > total - start ? total : start + count;
+    page = new address[](end - start);
+
+    for (uint256 i = start; i < end; i++) {
+      page[i - start] = _registrants[i];
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crisp-e3/contracts",
-  "version": "0.18.0-insecure.0",
+  "version": "0.18.0",
   "type": "module",
   "files": [
     "contracts",
@@ -31,7 +31,7 @@
     "@zk-kit/lazy-imt.sol": "2.0.0-beta.12",
     "poseidon-solidity": "^0.0.5",
     "solady": "^0.1.13",
-    "@interfold/contracts": "0.6.0"
+    "@interfold/contracts": "0.13.0"
   },
   "devDependencies": {
     "@nomicfoundation/hardhat-keystore": "3.0.3",
@@ -53,8 +53,8 @@
     "typechain": "^8.3.0",
     "typescript": "5.8.3",
     "viem": "2.30.6",
-    "@crisp-e3/zk-inputs": "^0.18.0-insecure.0",
-    "@crisp-e3/sdk": "^0.18.0-insecure.0"
+    "@crisp-e3/sdk": "^0.18.0",
+    "@crisp-e3/zk-inputs": "^0.18.0"
   },
   "scripts": {
     "compile": "hardhat compile",
@@ -66,10 +66,13 @@
     "deploy:contracts:mock": "export USE_MOCKS=true PRINT_ENV_VARS=true && pnpm deploy:contracts",
     "deploy:contracts:full": "export DEPLOY_INTERFOLD=true && pnpm deploy:contracts",
     "deploy:contracts:full:mock": "export DEPLOY_INTERFOLD=true USE_MOCKS=true PRINT_ENV_VARS=true && pnpm deploy:contracts",
+    "governance:builder": "hardhat run deploy/create-governance-builder.ts",
     "test": "hardhat test mocha",
     "check:test-legs": "node scripts/check-test-legs.mjs",
-    "test:unit": "pnpm check:test-legs && hardhat test mocha tests/census-mode.test.ts tests/crisp.journal.test.ts tests/input-leaf.test.ts tests/interfold-binding.test.ts tests/tally.decoding.test.ts",
+    "test:unit": "pnpm check:test-legs && hardhat test mocha tests/census-mode.test.ts tests/crisp.journal.test.ts tests/input-leaf.test.ts tests/interfold-binding.test.ts tests/self-registry.test.ts tests/tally.decoding.test.ts",
     "test:input-tree": "hardhat test mocha tests/input-tree-e2e.test.ts",
+    "test:input-tree:poisoning": "hardhat test mocha --grep \"accepts an input whose bytes|lets an honest mask follow\" -- tests/input-tree-e2e.test.ts",
+    "test:input-tree:canonical": "hardhat test mocha --grep \"^(?!.*(?:accepts an input whose bytes|lets an honest mask follow))\" -- tests/input-tree-e2e.test.ts",
     "test:ballots": "hardhat test mocha tests/crisp.contracts.test.ts tests/onchain-census.test.ts",
     "verify": "hardhat run deploy/verify.ts",
     "updateSubmissionWindow": "hardhat ciphernode:window",