enigma-memory 0.1.18 → 0.1.22

package/cortex-v3/zk/action-transition-vk.json

@@ -0,0 +1,119 @@
+{
+ "protocol": "groth16",
+ "curve": "bn128",
+ "nPublic": 6,
+ "vk_alpha_1": [
+  "20491192805390485299153009773594534940189261866228447918068658471970481763042",
+  "9383485363053290200918347156157836566562967994039712273449902621266178545958",
+  "1"
+ ],
+ "vk_beta_2": [
+  [
+   "6375614351688725206403948262868962793625744043794305715222011528459656738731",
+   "4252822878758300859123897981450591353533073413197771768651442665752259397132"
+  ],
+  [
+   "10505242626370262277552901082094356697409835680220590971873171140371331206856",
+   "21847035105528745403288232691147584728191162732299865338377159692350059136679"
+  ],
+  [
+   "1",
+   "0"
+  ]
+ ],
+ "vk_gamma_2": [
+  [
+   "10857046999023057135944570762232829481370756359578518086990519993285655852781",
+   "11559732032986387107991004021392285783925812861821192530917403151452391805634"
+  ],
+  [
+   "8495653923123431417604973247489272438418190587263600148770280649306958101930",
+   "4082367875863433681332203403145435568316851327593401208105741076214120093531"
+  ],
+  [
+   "1",
+   "0"
+  ]
+ ],
+ "vk_delta_2": [
+  [
+   "13737662410675739411863134805140287859060923769822448201927359014696163081734",
+   "4117678118637767853444917675194014084295990843761821712032859657573845168793"
+  ],
+  [
+   "12440663807394144368844811397485796369005354387040694274244057858904591863934",
+   "14918784436058974714769646045917855067545813731749283109383306566509970063914"
+  ],
+  [
+   "1",
+   "0"
+  ]
+ ],
+ "vk_alphabeta_12": [
+  [
+   [
+    "2029413683389138792403550203267699914886160938906632433982220835551125967885",
+    "21072700047562757817161031222997517981543347628379360635925549008442030252106"
+   ],
+   [
+    "5940354580057074848093997050200682056184807770593307860589430076672439820312",
+    "12156638873931618554171829126792193045421052652279363021382169897324752428276"
+   ],
+   [
+    "7898200236362823042373859371574133993780991612861777490112507062703164551277",
+    "7074218545237549455313236346927434013100842096812539264420499035217050630853"
+   ]
+  ],
+  [
+   [
+    "7077479683546002997211712695946002074877511277312570035766170199895071832130",
+    "10093483419865920389913245021038182291233451549023025229112148274109565435465"
+   ],
+   [
+    "4595479056700221319381530156280926371456704509942304414423590385166031118820",
+    "19831328484489333784475432780421641293929726139240675179672856274388269393268"
+   ],
+   [
+    "11934129596455521040620786944827826205713621633706285934057045369193958244500",
+    "8037395052364110730298837004334506829870972346962140206007064471173334027475"
+   ]
+  ]
+ ],
+ "IC": [
+  [
+   "17280374774876985846576072155775428516496713436280020899969455256740600851464",
+   "2671616274471658023769750029773332756237435115913176879115442697574865188504",
+   "1"
+  ],
+  [
+   "2751614090515481590396962831401435765981832671548864424231114586290804339579",
+   "16428749235453947228504302900037063604472053005766132106401972790975458744568",
+   "1"
+  ],
+  [
+   "15534383599204355668299964644425285581617198919119365038272985785250172114179",
+   "19738745792178322068371965888908382453886170122899730042053198979780669618452",
+   "1"
+  ],
+  [
+   "20918951320925303999718884037532749487091705086799263428894345973067477369719",
+   "2238654040295421993050985142411549503013736162286374355578022239924997748959",
+   "1"
+  ],
+  [
+   "19310512165623498566554150832696933132378225334866219165202410444613582137484",
+   "19520562604893676100742722752037908641381116593594160616565283205759504663879",
+   "1"
+  ],
+  [
+   "3002913514489910657253716597454484439734159929193355076313837586280075955821",
+   "11280484143192028440413145680326119197314222133146217088623894210455485551233",
+   "1"
+  ],
+  [
+   "3748279575462613177944311348202437507732869101809965496229575295667816904847",
+   "1996549668722327272255704796991151399572019816051051495186051999353345441680",
+   "1"
+  ]
+ ]
+}

package/cortex-v3/zk/alias-adversarial.test.mjs

@@ -0,0 +1,220 @@
+// alias-adversarial.test.mjs — adversarial-witness regression test for the
+// FieldLessThan x+r aliasing vulnerability in circuits/action_transition.circom.
+//
+// THE BUG (fixed): FieldLessThan originally decomposed its operands with plain
+// Num2Bits(254). Over Fr = BN254 scalar field (r), a 254-bit decomposition is
+// NOT unique: any x < 2^254 - r also satisfies the bit-sum constraint as the
+// integer x + r (since x + r ≡ x mod r and x + r < 2^254). An adversarial
+// prover hand-crafting a witness (the compiled wasm calculator always produces
+// canonical bits, so generated-witness tests CANNOT catch this) could encode a
+// comparison operand as x + r and flip the IMT strict ordering
+// predValue < nf < predNextValue — e.g. insert a nullifier at a wrong IMT
+// position (breaking sortedness, enabling a later double-revocation of an
+// already-spent nullifier), or pass nf < nf as nf < nf + r.
+//
+// Verified during development (pre-fix r1cs, 89,845 constraints): a witness
+// tampered to read predNextValue as predNextValue + r PASSED
+// `snarkjs wtns check` against the vulnerable R1CS. That artifact was removed
+// in repo hygiene; the fix below is what this test guards.
+//
+// THE FIX: both operands now use circomlib Num2Bits_strict(), whose AliasCheck
+// constrains the represented integer < r, killing the alias.
+//
+// This test:
+//   1. builds a VALID revoke witness via TreeWitness's buildActionWitness,
+//   2. produces the witness bin via the compiled witness_calculator
+//      (control: `snarkjs wtns check` ACCEPTS it),
+//   3. tampers the ltLo operand encoding predValue = 0 to its alias 0 + r
+//      (bit-level, exactly what an adversarial prover controls) and asserts
+//      `snarkjs wtns check` REJECTS the tampered witness,
+//   4. asserts the calculator canonicalizes x + r at the INPUT layer
+//      (calculateWTNSBin normalizes mod r → identical witness),
+//   5. source guard: FieldLessThan must use Num2Bits_strict, and the circuit
+//      must contain no plain Num2Bits(254).
+//
+// Run: node --test cortex-v3/zk/alias-adversarial.test.mjs
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+import {
+  DOMAIN_REVOCATION,
+  FIELD_R,
+  NoteTree,
+  NullifierIMT,
+  poseidon,
+} from "./zk-tree.mjs";
+import { buildActionWitness } from "./witness.mjs";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const PKG_ROOT = resolve(__dirname, "..");
+const BUILD = join(PKG_ROOT, "circuits", "build");
+const R1CS = join(BUILD, "action_transition.r1cs");
+const SYM = join(BUILD, "action_transition.sym");
+const WASM = join(BUILD, "action_transition_js", "action_transition.wasm");
+const WITNESS_CALC = join(BUILD, "action_transition_js", "witness_calculator.js");
+const CIRCUIT_SRC = join(PKG_ROOT, "circuits", "action_transition.circom");
+
+const require = createRequire(import.meta.url);
+
+const OWNER_KEY = 1111111111111111111111111111111111111111111111111111111111111111n;
+const RHO = 2222222222222222222222222222222222222222222222222222222222222222n;
+const PAYLOAD = 3333333333333333333333333333333333333333333333333333333333333333n;
+const OWNER_KEY2 = 4444444444444444444444444444444444444444444444444444444444444444n;
+const RHO2 = 5555555555555555555555555555555555555555555555555555555555555555n;
+const PAYLOAD2 = 6666666666666666666666666666666666666666666666666666666666666666n;
+
+// ---------------------------------------------------------------------------
+// Minimal .wtns (snarkjs witness binary) reader/writer.
+// Layout: "wtns" | u32 version | u32 nSections | sections {u32 type, u64 size,
+// payload}; section 1 = header {u32 n8, n8 bytes prime, u32 nVars};
+// section 2 = nVars little-endian field elements (wire 0 first).
+// ---------------------------------------------------------------------------
+function readWtns(path) {
+  const b = readFileSync(path);
+  assert.equal(b.toString("utf8", 0, 4), "wtns", "bad wtns magic");
+  const nSec = b.readUInt32LE(8);
+  let off = 12;
+  let n8 = 0;
+  let nVars = 0;
+  let dataOff = 0;
+  for (let i = 0; i < nSec; i++) {
+    const type = b.readUInt32LE(off);
+    const size = Number(b.readBigUInt64LE(off + 4));
+    off += 12;
+    if (type === 1) {
+      n8 = b.readUInt32LE(off);
+      nVars = b.readUInt32LE(off + 4 + n8);
+    }
+    if (type === 2) dataOff = off;
+    off += size;
+  }
+  const vals = [];
+  for (let i = 0; i < nVars; i++) {
+    vals.push(BigInt("0x" + Buffer.from(b.subarray(dataOff + i * n8, dataOff + (i + 1) * n8)).reverse().toString("hex")));
+  }
+  return { raw: b, n8, nVars, dataOff, vals };
+}
+
+function writeWtns(path, tmpl, vals) {
+  const out = Buffer.from(tmpl.raw);
+  for (let i = 0; i < vals.length; i++) {
+    const le = Buffer.from(vals[i].toString(16).padStart(tmpl.n8 * 2, "0"), "hex").reverse();
+    le.copy(out, tmpl.dataOff + i * tmpl.n8);
+  }
+  writeFileSync(path, out);
+}
+
+// .sym format: <labelId>,<wireIndex>,<componentId>,<name>; wireIndex -1 marks
+// signals eliminated by constraint simplification (aliases — no wire exists).
+function symWireMap(path) {
+  const m = new Map();
+  for (const line of readFileSync(path, "utf8").split("\n")) {
+    if (!line.trim()) continue;
+    const [, wire, , name] = line.split(",");
+    m.set(name.trim(), Number(wire));
+  }
+  return m;
+}
+
+/** `snarkjs wtns check` → true if the witness satisfies the R1CS. */
+function wtnsCheck(wtnsPath) {
+  try {
+    execFileSync("npx", ["snarkjs", "wtns", "check", R1CS, wtnsPath], {
+      shell: true,
+      stdio: "pipe",
+      cwd: PKG_ROOT,
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+test("adversarial x+r alias witness is rejected by the hardened circuit", async (t) => {
+  const tmp = mkdtempSync(join(tmpdir(), "enigma-alias-"));
+  t.after(() => rmSync(tmp, { recursive: true, force: true }));
+
+  // -- 1. valid revoke witness via TreeWitness's buildActionWitness ----------
+  const noteTree = new NoteTree();
+  const imt = new NullifierIMT();
+  buildActionWitness({ // note at index 0
+    mode: "append", noteTree, nullifierTree: imt,
+    ownerKey: OWNER_KEY2, rho: RHO2, payloadCommit: PAYLOAD2,
+  });
+  buildActionWitness({ // note at index 1
+    mode: "append", noteTree, nullifierTree: imt,
+    ownerKey: OWNER_KEY, rho: RHO, payloadCommit: PAYLOAD,
+  });
+  const input = buildActionWitness({ // first revoke → genesis predecessor
+    mode: "revoke", noteTree, nullifierTree: imt, noteIndex: 1,
+    ownerKey: OWNER_KEY, rho: RHO, payloadCommit: PAYLOAD,
+  });
+  assert.equal(input.predValue, "0", "test assumes genesis predecessor (predValue 0)");
+  assert.equal(
+    input.nullifier,
+    poseidon([DOMAIN_REVOCATION, OWNER_KEY, RHO]).toString(),
+  );
+
+  // -- 2. witness bin via the compiled witness_calculator --------------------
+  const buildCalc = require(WITNESS_CALC);
+  const calc = await buildCalc(readFileSync(WASM));
+  const honestBin = Buffer.from(await calc.calculateWTNSBin(input, true));
+  const honestPath = join(tmp, "honest.wtns");
+  writeFileSync(honestPath, honestBin);
+
+  // control: the honest witness satisfies the R1CS
+  assert.ok(wtnsCheck(honestPath), "control failed: honest revoke witness must pass wtns check");
+
+  // -- 3. tamper: encode ltLo operand predValue=0 as its alias 0 + r ---------
+  // ltLo checks predValue < nf. predValue is 0 (genesis predecessor); the bit
+  // decomposition of the integer r (= 0 + r, a 254-bit value) satisfies every
+  // plain-Num2Bits constraint over Fr but represents a different integer, so
+  // the comparator would evaluate r < nf instead of 0 < nf. An adversarial
+  // prover picks whichever alias makes a FALSE ordering pass.
+  const sym = symWireMap(SYM);
+  const tmpl = readWtns(honestPath);
+  const tampered = tmpl.vals.slice();
+  for (let i = 0; i < 254; i++) {
+    const name = `main.ltLo.aBits.out[${i}]`;
+    const w = sym.get(name);
+    assert.ok(w !== undefined, `sym missing ${name}`);
+    assert.notEqual(w, -1, `${name} unexpectedly eliminated by simplification`);
+    tampered[w] = (FIELD_R >> BigInt(i)) & 1n; // alias: 0 → 0 + r
+  }
+  const tamperedPath = join(tmp, "tampered.wtns");
+  writeWtns(tamperedPath, tmpl, tampered);
+
+  assert.equal(
+    wtnsCheck(tamperedPath),
+    false,
+    "VULNERABILITY: x+r aliased FieldLessThan operand was ACCEPTED — " +
+      "FieldLessThan must use Num2Bits_strict (see file header)",
+  );
+
+  // -- 4. the calculator canonicalizes x + r at the input layer --------------
+  // Inputs are normalized mod r, so supplying predValue as 0 + r through the
+  // honest tooling yields the identical (canonical, accepted) witness — the
+  // alias is only reachable by hand-crafted witnesses, which leg 3 rejects.
+  const aliasedInput = { ...input, predValue: (0n + FIELD_R).toString() };
+  const canonBin = Buffer.from(await calc.calculateWTNSBin(aliasedInput, true));
+  assert.ok(canonBin.equals(honestBin), "calculator must normalize predValue 0+r ≡ 0");
+  const canonPath = join(tmp, "canonicalized.wtns");
+  writeFileSync(canonPath, canonBin);
+  assert.ok(wtnsCheck(canonPath), "canonicalized witness must pass wtns check");
+});
+
+test("source guard: FieldLessThan uses Num2Bits_strict, no plain Num2Bits(254) anywhere", () => {
+  const src = readFileSync(CIRCUIT_SRC, "utf8");
+  const code = src.replace(/\/\/[^\n]*/g, ""); // strip line comments (docs may quote the pattern)
+  const m = code.match(/template FieldLessThan\(\) \{[\s\S]*?\n\}/);
+  assert.ok(m, "FieldLessThan template not found in circuit source");
+  assert.match(m[0], /Num2Bits_strict\(\)/, "FieldLessThan must use Num2Bits_strict (x+r alias guard)");
+  assert.doesNotMatch(code, /Num2Bits\(254\)/, "plain Num2Bits(254) is aliasable over Fr — forbidden");
+});

package/cortex-v3/zk/groth16-verify-child.mjs

@@ -0,0 +1,17 @@
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const snarkjs = require('snarkjs');
+
+process.once('message', async (request) => {
+  try {
+    const verified = await snarkjs.groth16.verify(
+      request.verificationKey,
+      request.publicSignals,
+      request.proof,
+    );
+    process.send({ verified }, () => process.exit(0));
+  } catch (error) {
+    process.send({ error: error.message }, () => process.exit(1));
+  }
+});