Merge pull request #54 from AztecProtocol/master

Preparation for release v2.1.96

aztec-connect-cpp/src/rollup/constants.hpp

@@ -38,7 +38,7 @@ constexpr bool is_circuit_change_expected = 0;
  constraints. They need to be changed when there is a circuit change. */
 constexpr uint32_t ACCOUNT = 23967;
 constexpr uint32_t JOIN_SPLIT = 64047;
-constexpr uint32_t CLAIM = 22684;
+constexpr uint32_t CLAIM = 23050;
 constexpr uint32_t ROLLUP = 1173221;
 constexpr uint32_t ROOT_ROLLUP = 5481327;
 constexpr uint32_t ROOT_VERIFIER = 7435892;
@@ -61,12 +61,12 @@ namespace circuit_vk_hash {
  to comply with the from_buffer<>() method. */
 constexpr auto ACCOUNT = uint256_t(0xcd6d70c733eaf823, 0x6505d3402817ad3d, 0xbf9e2b6a262589cf, 0xafcc546b55cc45e3);
 constexpr auto JOIN_SPLIT = uint256_t(0xb23c7772f47bc823, 0x5493625d4f08603c, 0x21ac50a5929576f9, 0xb7b3113c131460e5);
-constexpr auto CLAIM = uint256_t(0x878301ebba40ab60, 0x931466762c62d661, 0x40aad71ec3496905, 0x9f47aaa109759d0a);
-constexpr auto ROLLUP = uint256_t(0x8712bcbeb11180c5, 0x598412e4f700c484, 0xfe50ad453c8e4288, 0xa7340fac5feb663f);
-constexpr auto ROOT_ROLLUP = uint256_t(0xcf2fee21f089b32f, 0x90c6187354cf70d4, 0x3a5a90b8c86d8c64, 0xd55af088ddc86db7);
+constexpr auto CLAIM = uint256_t(0xa753ce523719749e, 0x80216aff7f8bc9ce, 0xa9b0f69bbd24ac33, 0xae17c5fb7d488138);
+constexpr auto ROLLUP = uint256_t(0x5f2f6590e5553f19, 0x62c287e01b897621, 0xf32d03437085e2d, 0x567b0be24dc99966);
+constexpr auto ROOT_ROLLUP = uint256_t(0x64e5e03cf9534ed6, 0x7fdc871935b9e4fe, 0xd2b81e990cc15f3d, 0x47f00f76d92e5e4d);
 ;
 constexpr auto ROOT_VERIFIER =
- uint256_t(0xe91df73df393fb5f, 0x99a9fa13abfbb206, 0x2ffe8c891cbde8c2, 0xdcb051e8ca06df5e);
+ uint256_t(0xb4349747ae6ea507, 0xfaafa0f2e384c984, 0x9325870bcc594daf, 0x50163a2572c67363);
 }; // namespace circuit_vk_hash
 
 namespace ProofIds {

aztec-connect-cpp/src/rollup/proofs/claim/claim.test.cpp

@@ -3,10 +3,19 @@
 #include "index.hpp"
 #include "../inner_proof_data/inner_proof_data.hpp"
 #include "../notes/native/index.hpp"
+#include "../notes/circuit/index.hpp"
+#include "./claim_circuit.hpp"
 #include <common/test.hpp>
+#include <cstddef>
+#include <iterator>
 #include <stdlib/merkle_tree/index.hpp>
 #include <numeric/random/engine.hpp>
+#include <string>
+#include <utility>
 
+#define ENABLE_MALICIOUS_RATIO_CHECK_FOR_TESTS
+#include "./malicious_claim_circuit.hpp"
+#undef ENABLE_MALICIOUS_RATIO_CHECK_FOR_TESTS
 namespace rollup {
 namespace proofs {
 namespace claim {
@@ -1579,6 +1588,72 @@ TEST_F(claim_tests, test_real_virtual)
  EXPECT_EQ(tx.get_output_notes()[0], result.public_inputs[InnerProofFields::NOTE_COMMITMENT1]);
  EXPECT_EQ(tx.get_output_notes()[1], result.public_inputs[InnerProofFields::NOTE_COMMITMENT2]);
 }
+/**
+ * @brief Check that malicious prover can't submit an erroneous claim
+ *
+ */
+TEST_F(claim_tests, test_claim_fails_if_prover_is_malicious)
+{
+ // Generate notes with malicious values
+ const claim_note note1 = { .deposit_value = 1,
+ .bridge_call_data = 0,
+ .defi_interaction_nonce = 0,
+ .fee = 0,
+ .value_note_partial_commitment =
+ create_partial_commitment(user.note_secret, user.owner.public_key, 0, 0),
+ .input_nullifier = fr::random_element(&engine) };
+
+ const defi_interaction::note note2 = { .bridge_call_data = 0,
+ .interaction_nonce = 0,
+ .total_input_value = 100,
+ .total_output_value_a = 100,
+ .total_output_value_b = 100,
+ .interaction_result = 1 };
+ append_note(note1, data_tree);
+ append_note(note2, defi_tree);
+ claim_tx tx = create_claim_tx(note1, 0, 0, note2);
+ tx.output_value_a = 100;
+ tx.output_value_b = 100;
+
+ // Create one regular composer
+ Composer composer = Composer(cd.proving_key, cd.verification_key, cd.num_gates);
+ // And one donor
+ Composer donor = Composer(cd.proving_key, cd.verification_key, cd.num_gates);
+
+ // Construct the circuit with malicious witness in the donor
+ malicious_claim_circuit(donor, tx);
+
+ // Construct the regular claim circuit in the regular composer
+ claim_circuit(composer, tx);
+
+ // The witness in the regular will not satisfy the contriaints
+ info("Check circuit before transplant: ", composer.check_circuit());
+ ASSERT_EQ(composer.variables.size(), donor.variables.size());
+ // Copy the values of variables into the regular circuit
+ for (size_t i = 0; i < composer.variables.size(); i++) {
+ composer.variables[i] = donor.variables[i];
+ }
+ // If the circuit is undercontrained, the will both pass now
+ info("Check donor circuit: ", donor.check_circuit());
+ info("Check circuit after transplant: ", composer.check_circuit());
+ Timer proof_timer;
+ info(": Creating proof...");
+ verify_result<Composer> result;
+ auto prover = composer.create_unrolled_prover();
+ auto proof = prover.construct_proof();
+ result.proof_data = proof.proof_data;
+ info(": Proof created in ", proof_timer.toString(), "s");
+ auto verifier = composer.create_unrolled_verifier();
+ result.verified = verifier.verify_proof({ result.proof_data });
+ if (!result.verified) {
+ info(": Proof validation failed.");
+ } else {
+ info(": Verified successfully.");
+ }
+ result.verification_key = composer.circuit_verification_key;
+ EXPECT_FALSE(result.verified);
+}
+
 } // namespace claim
 } // namespace proofs
 } // namespace rollup

aztec-connect-cpp/src/rollup/proofs/claim/malicious_claim_circuit.hpp

@@ -0,0 +1,228 @@
+#pragma once
+#include "claim_tx.hpp"
+#include <stdlib/types/turbo.hpp>
+#include "malicious_ratio_check.hpp"
+#include "../notes/circuit/index.hpp"
+#include <stdlib/merkle_tree/membership.hpp>
+
+#ifndef ENABLE_MALICIOUS_RATIO_CHECK_FOR_TESTS
+static_assert(false, "THIS FILE CAN ONLY BE USED INT TESTS");
+#endif
+namespace rollup {
+namespace proofs {
+namespace claim {
+
+using namespace plonk::stdlib::types::turbo;
+using namespace plonk::stdlib::merkle_tree;
+using namespace notes;
+/**
+ * @brief This function creates the same circuit as the regular claim circuit, but feels it with malicious witness
+ *
+ * @param composer
+ * @param tx
+ */
+void malicious_claim_circuit(Composer& composer, claim_tx const& tx)
+{
+ // Create witnesses.
+ const auto proof_id = field_ct(witness_ct(&composer, ProofIds::DEFI_CLAIM));
+ proof_id.assert_equal(ProofIds::DEFI_CLAIM);
+ const auto data_root = field_ct(witness_ct(&composer, tx.data_root));
+ const auto defi_root = field_ct(witness_ct(&composer, tx.defi_root));
+ const auto claim_note_index =
+ suint_ct(witness_ct(&composer, tx.claim_note_index), DATA_TREE_DEPTH, "claim_note_index");
+ const auto claim_note_path = create_witness_hash_path(composer, tx.claim_note_path);
+ const auto defi_note_index =
+ suint_ct(witness_ct(&composer, tx.defi_note_index), DEFI_TREE_DEPTH, "defi_note_index");
+
+ /**
+ * Conversion to `claim_note_witness_data` contains:
+ * - range constraints on the claim note's attributes
+ * - expansion of bridge_call_data
+ * - expansion of the bridge_call_data's bit_config
+ * - sense checks on the bit_config's values
+ * (some bits can contradict each other)
+ */
+ const auto claim_note_data = circuit::claim::claim_note_witness_data(composer, tx.claim_note);
+
+ const auto claim_note = circuit::claim::claim_note(claim_note_data);
+ const auto defi_interaction_note_path = create_witness_hash_path(composer, tx.defi_interaction_note_path);
+
+ /**
+ * Implicit conversion to `defi_interaction::witness_data` includes:
+ * - range constraints on the defi_interaction_note's attributes
+ * - expansion of bridge_call_data
+ * - expansion of the bridge_call_data's bit_config
+ * - sense checks on the bit_config's values
+ * (some bits can contradict each other)
+ */
+ const auto defi_interaction_note = circuit::defi_interaction::note({ composer, tx.defi_interaction_note });
+ const auto output_value_a =
+ suint_ct(witness_ct(&composer, tx.output_value_a), NOTE_VALUE_BIT_LENGTH, "output_value_a");
+ const auto output_value_b =
+ suint_ct(witness_ct(&composer, tx.output_value_b), NOTE_VALUE_BIT_LENGTH, "output_value_b");
+
+ const bool_ct first_output_virtual =
+ circuit::get_asset_id_flag(claim_note_data.bridge_call_data_local.output_asset_id_a);
+ const bool_ct second_output_virtual =
+ circuit::get_asset_id_flag(claim_note_data.bridge_call_data_local.output_asset_id_b);
+ const bool_ct& second_input_in_use = claim_note_data.bridge_call_data_local.config.second_input_in_use;
+ const bool_ct& second_output_in_use = claim_note_data.bridge_call_data_local.config.second_output_in_use;
+
+ {
+ // Don't support zero deposits (because they're illogical):
+ claim_note.deposit_value.value.assert_is_not_zero("Not supported: zero deposit");
+ // Ensure deposit_value <= total_input_value
+ defi_interaction_note.total_input_value.subtract(
+ claim_note.deposit_value, NOTE_VALUE_BIT_LENGTH, "deposit_value > total_input_value");
+ // These checks are superfluous, but included just in case:
+ // Ensure output_value_a <= total_output_value_a
+ defi_interaction_note.total_output_value_a.subtract(
+ output_value_a, NOTE_VALUE_BIT_LENGTH, "output_value_a > total_output_value_a");
+ // Ensure output_value_b <= total_output_value_b
+ defi_interaction_note.total_output_value_b.subtract(
+ output_value_b, NOTE_VALUE_BIT_LENGTH, "output_value_b > total_output_value_b");
+ }
+
+ {
+ // Ratio checks.
+ // Note, these ratio_checks also guarantee:
+ // defi_interaction_note.total_input_value != 0
+ // defi_interaction_note.total_output_value_a != 0 (unless output_value_a == 0)
+ // defi_interaction_note.total_output_value_b != 0 (unless output_value_b == 0)
+
+ // Check that (deposit * total_output_value_a) == (output_value_a * total_input_value)
+ // Rearranging, this ensures output_value_a == (deposit / total_input_value) * total_output_value_a
+ const bool_ct rc1 = malicious_ratio_check(composer,
+ { .a1 = claim_note.deposit_value.value,
+ .a2 = defi_interaction_note.total_input_value.value,
+ .b1 = output_value_a.value,
+ .b2 = defi_interaction_note.total_output_value_a.value });
+ const bool_ct valid1 = (output_value_a == 0 && defi_interaction_note.total_output_value_a == 0) || rc1;
+ valid1.assert_equal(true, "ratio check 1 failed");
+
+ // Check that (deposit * total_output_value_b) == (output_value_b * total_input_value)
+ // Rearranging, this ensures output_value_b == (deposit / total_input_value) * total_output_value_b
+ const bool_ct rc2 = malicious_ratio_check(composer,
+ { .a1 = claim_note.deposit_value.value,
+ .a2 = defi_interaction_note.total_input_value.value,
+ .b1 = output_value_b.value,
+ .b2 = defi_interaction_note.total_output_value_b.value });
+ const bool_ct valid2 = (output_value_b == 0 && defi_interaction_note.total_output_value_b == 0) || rc2;
+ valid2.assert_equal(true, "ratio check 2 failed");
+ }
+
+ // This nullifier1 is unique because the claim_note.commitment is unique (which itself is unique because it contains
+ // a unique input_nullifier (from the defi-deposit tx which created it)).
+ const auto nullifier1 = circuit::claim::compute_nullifier(claim_note.commitment);
+
+ // We 'nullify' this (claim note, defi interaction note) combination. Each owner of a claim note can produce a valid
+ // nullifier.
+ const auto nullifier2 =
+ circuit::defi_interaction::compute_nullifier(defi_interaction_note.commitment, claim_note.commitment);
+
+ field_ct output_note_commitment1;
+ field_ct output_note_commitment2;
+ {
+ // Compute output notes.
+ const auto virtual_note_flag = suint_ct(uint256_t(1) << (MAX_NUM_ASSETS_BIT_LENGTH - 1));
+
+ // If the defi interaction was unsuccessful, refund the original defi_deposit_value (which was denominated in
+ // bridge input_asset_id_a) via output note 1.
+ const bool_ct& interaction_success = defi_interaction_note.interaction_result;
+ const auto output_value_1 =
+ suint_ct::conditional_assign(interaction_success, output_value_a, claim_note_data.deposit_value);
+ const auto output_asset_id_1_if_success =
+ suint_ct::conditional_assign(first_output_virtual,
+ virtual_note_flag + claim_note.defi_interaction_nonce,
+ claim_note_data.bridge_call_data_local.output_asset_id_a);
+ const auto output_asset_id_1 = suint_ct::conditional_assign(
+ interaction_success, output_asset_id_1_if_success, claim_note_data.bridge_call_data_local.input_asset_id_a);
+ output_note_commitment1 = circuit::value::complete_partial_commitment(
+ claim_note.value_note_partial_commitment, output_value_1, output_asset_id_1, nullifier1);
+
+ // If the defi interaction was unsuccessful, refund the original defi_deposit_value (which was denominated in
+ // bridge input_asset_id_b) via output note 2, and only if there was a second input asset to the bridge.
+ const auto output_value_2 =
+ suint_ct::conditional_assign(interaction_success, output_value_b, claim_note_data.deposit_value);
+ const auto output_asset_id_2_if_success =
+ suint_ct::conditional_assign(second_output_virtual,
+ virtual_note_flag + claim_note.defi_interaction_nonce,
+ claim_note_data.bridge_call_data_local.output_asset_id_b);
+ const auto output_asset_id_2 = suint_ct::conditional_assign(
+ interaction_success, output_asset_id_2_if_success, claim_note_data.bridge_call_data_local.input_asset_id_b);
+ output_note_commitment2 = circuit::value::complete_partial_commitment(
+ claim_note.value_note_partial_commitment, output_value_2, output_asset_id_2, nullifier2);
+
+ // We zero the output_note_commitment2 in two cases:
+ // - if the bridge interaction succeeded and returned a second output asset; or
+ // - if the bridge interaction failed and no second asset was ever sent to the bridge.
+ const bool_ct is_bridge_output_b_in_use = interaction_success && second_output_in_use;
+ const bool_ct was_bridge_input_b_in_use = !interaction_success && second_input_in_use;
+
+ const bool_ct output_note_2_exists = is_bridge_output_b_in_use || was_bridge_input_b_in_use;
+
+ output_note_commitment2 = output_note_commitment2 * output_note_2_exists;
+ }
+
+ {
+ // Check claim note and interaction note are related.
+ claim_note.bridge_call_data.assert_equal(defi_interaction_note.bridge_call_data,
+ "note bridge call datas don't match");
+ claim_note.defi_interaction_nonce.assert_equal(defi_interaction_note.interaction_nonce,
+ "note nonces don't match");
+ }
+
+ {
+ // Existence checks
+
+ // Check claim note exists:
+ const bool_ct claim_exists = check_membership(data_root,
+ claim_note_path,
+ claim_note.commitment,
+ claim_note_index.value.decompose_into_bits(DATA_TREE_DEPTH));
+ claim_exists.assert_equal(true, "claim note not a member");
+
+ // Check defi interaction note exists:
+ const bool_ct din_exists = check_membership(defi_root,
+ defi_interaction_note_path,
+ defi_interaction_note.commitment,
+ defi_note_index.value.decompose_into_bits(DEFI_TREE_DEPTH));
+ din_exists.assert_equal(true, "defi interaction note not a member");
+ }
+
+ // Force unused public inputs to 0.
+ const field_ct public_value = witness_ct(&composer, 0);
+ const field_ct public_owner = witness_ct(&composer, 0);
+ const field_ct asset_id = witness_ct(&composer, 0);
+ const field_ct defi_deposit_value = witness_ct(&composer, 0);
+ const field_ct backward_link = witness_ct(&composer, 0);
+ const field_ct allow_chain = witness_ct(&composer, 0);
+ public_value.assert_is_zero();
+ public_owner.assert_is_zero();
+ asset_id.assert_is_zero();
+ defi_deposit_value.assert_is_zero();
+ backward_link.assert_is_zero();
+ allow_chain.assert_is_zero();
+
+ // The following make up the public inputs to the circuit.
+ proof_id.set_public();
+ output_note_commitment1.set_public();
+ output_note_commitment2.set_public();
+ nullifier1.set_public();
+ nullifier2.set_public();
+ public_value.set_public(); // 0
+ public_owner.set_public(); // 0
+ asset_id.set_public(); // 0
+ data_root.set_public();
+ claim_note.fee.set_public();
+ claim_note_data.bridge_call_data_local.input_asset_id_a.set_public();
+ claim_note.bridge_call_data.set_public();
+ defi_deposit_value.set_public(); // 0
+ defi_root.set_public();
+ backward_link.set_public(); // 0
+ allow_chain.set_public(); // 0
+}
+
+} // namespace claim
+} // namespace proofs
+} // namespace rollup