Repository navigation
fix: Avoid early proof submission prover griefing - #25582
Merged
Merged
Conversation
Collaborator
Flakey Tests🤖 says: This CI run detected 1 tests that failed, but were tolerated due to a .test_patterns.yml entry. |
Rumata888
marked this pull request as ready for review
October 2, 2026 17:39
Rumata888
requested review from
iAmMichaelConnor,
just-mitch and
koenmtb1
as code owners
October 2, 2026 17:39
spalladino
approved these changes
Oct 2, 2026
15 tasks done
spalladino
pushed a commit
that referenced
this pull request
Oct 2, 2026
Review follow-up for #25582, which merged before this was opened. No contract logic changes. Refs AztecProtocol/aztec-claude#2467 ## Tests - **Shares are replaced on upgrade** (`handleRewards.t.sol`, `test_WhenTheProofIsFullEpoch`). Before, the prover had the minimum shares before and after the upgrade, so a version of the code that kept the old shares passed all tests. The test now raises the prover's score first (560 full-epoch proofs), then asserts that the upgrade stores different shares. - **Invalidated-tail trigger** (`ValidatorSelection.t.sol`, `testFullEpochProofUpgradesRegistrationAfterTailInvalidation`). An epoch ends with a valid checkpoint and a checkpoint with too few attestations. A proof of the first checkpoint is not full-epoch. After `invalidateInsufficientAttestations`, the same proof is full-epoch, upgrades the registration and increases the score. This is trigger (2) of the issue. - `test_GivenTheExistingRegistrationIsFullEpoch` asserts that a first full-epoch proof sets `getHasSubmittedFullEpoch`. ## Other changes - `RewardLib.sol`: one correction to the `fullEpoch` field comment. It said the flag is set when the registration "was submitted after the epoch is closed". A partial proof submitted after the epoch closed does not set it; the flag is set by a full epoch proof. - `RewardLibWrapper`: the two-argument `handleRewardsAndFees` calls the three-argument overload. ## Checks run locally - `forge fmt --check` - `forge test` on `MultiProof.t.sol`, `ValidatorSelection.t.sol` and `handleRewards.t.sol`: 43 pass. - Two deliberate breakages of `RewardLib.handleRewardsAndFees`, both fail the tests: keep the old shares on upgrade (fails `test_WhenTheProofIsFullEpoch`), and remove the upgrade path (fails the new integration test and two existing tests). The full suite is left to CI. ## Not in this PR The prover node still skips submission when `getHasSubmitted` is true (`yarn-project/prover-node/src/prover-node-publisher.ts`, aztec-node repo). It must use `getHasSubmittedFullEpoch` for full-epoch proofs before the issue is fixed for honest provers. That change needs a separate PR in `aztec-labs-eng/aztec-node`. --- *Created by [claudebox](https://claudebox.work/v2/sessions/966f467da8c8b731/jobs/7) · group: `slackbot` · requested by Mike (@iAmMichaelConnor) · [Slack thread](https://aztecfoundation.slack.com/archives/D0B2N7W1WJD/p1790965530798319?thread_ts=1790965530.798319&cid=D0B2N7W1WJD)*
AztecBot
pushed a commit
that referenced
this pull request
Oct 4, 2026
Fixes AztecProtocol/aztec-claude#2467 (cherry picked from commit 9205859)
AztecBot
added a commit
that referenced
this pull request
Oct 4, 2026
Review follow-up for #25582, which merged before this was opened. No contract logic changes. Refs AztecProtocol/aztec-claude#2467 ## Tests - **Shares are replaced on upgrade** (`handleRewards.t.sol`, `test_WhenTheProofIsFullEpoch`). Before, the prover had the minimum shares before and after the upgrade, so a version of the code that kept the old shares passed all tests. The test now raises the prover's score first (560 full-epoch proofs), then asserts that the upgrade stores different shares. - **Invalidated-tail trigger** (`ValidatorSelection.t.sol`, `testFullEpochProofUpgradesRegistrationAfterTailInvalidation`). An epoch ends with a valid checkpoint and a checkpoint with too few attestations. A proof of the first checkpoint is not full-epoch. After `invalidateInsufficientAttestations`, the same proof is full-epoch, upgrades the registration and increases the score. This is trigger (2) of the issue. - `test_GivenTheExistingRegistrationIsFullEpoch` asserts that a first full-epoch proof sets `getHasSubmittedFullEpoch`. ## Other changes - `RewardLib.sol`: one correction to the `fullEpoch` field comment. It said the flag is set when the registration "was submitted after the epoch is closed". A partial proof submitted after the epoch closed does not set it; the flag is set by a full epoch proof. - `RewardLibWrapper`: the two-argument `handleRewardsAndFees` calls the three-argument overload. ## Checks run locally - `forge fmt --check` - `forge test` on `MultiProof.t.sol`, `ValidatorSelection.t.sol` and `handleRewards.t.sol`: 43 pass. - Two deliberate breakages of `RewardLib.handleRewardsAndFees`, both fail the tests: keep the old shares on upgrade (fails `test_WhenTheProofIsFullEpoch`), and remove the upgrade path (fails the new integration test and two existing tests). The full suite is left to CI. ## Not in this PR The prover node still skips submission when `getHasSubmitted` is true (`yarn-project/prover-node/src/prover-node-publisher.ts`, aztec-node repo). It must use `getHasSubmittedFullEpoch` for full-epoch proofs before the issue is fixed for honest provers. That change needs a separate PR in `aztec-labs-eng/aztec-node`. --- *Created by [claudebox](https://claudebox.work/v2/sessions/966f467da8c8b731/jobs/7) · group: `slackbot` · requested by Mike (@iAmMichaelConnor) · [Slack thread](https://aztecfoundation.slack.com/archives/D0B2N7W1WJD/p1790965530798319?thread_ts=1790965530.798319&cid=D0B2N7W1WJD)* (cherry picked from commit 99b8b97)
IlyasRidhuan
added a commit
that referenced
this pull request
Oct 4, 2026
Rolling integration PR for changes labelled `port-to-v6` on `next`. Each merged source PR is cherry-picked onto `cb/port-to-v6` as its own commit, keeping `(#N)` in the title. ## Ported - [x] [#25536](#25536) fix(kernels): charge the teardown call's AVM startup gas (pick applied without conflicts, plus two `fix(port)` commits) - `fix(port)` 1 drops `labs-patches/0001-fix-pxe-charge-the-teardown-call-s-AVM-startup-gas-i.patch`, which the pick brings along. The labs pin on `v6` (`a0d73c0aed`) already carries that PXE change upstream as aztec-labs-eng/aztec-node#364, so the patch has nothing to apply to. The Noir side is `gas_meter.nr` and `validate_gas_used_tests.nr`, both identical to `next`. - `fix(port)` 2 adds labs patch `0001-test-pin-testnet-compatibility-to-the-v6-kernel-VK-t.patch`, which re-pins the VK tree root in `labs/yarn-project/aztec/src/testnet_compatibility.test.ts`. - [x] [#25576](#25576) fix(p2p): require exact contract class log length in DataTxValidator (labs patch) (clean pick) - Adds labs patch `0010-fix-p2p-require-exact-contract-class-log-length-in-D.patch`. Both files it touches (`data_validator.ts`, `data_validator.test.ts`) have the same pre-image blobs on the `v6` labs pin as on `next`'s. - [x] [#25577](#25577) fix(l1): include the Noir compiler in the l1-contracts cache hash (clean pick) - `noir/bootstrap.sh hash` is what the other Noir consumers on `v6` already use (`avm-transpiler`, `noir-protocol-circuits`, `acir_tests`). - [x] [#25578](#25578) fix(circuits): key the VK cache on its real inputs and never cache the L1 verifier (clean pick) - With #25577 and this one applied, `noir-protocol-circuits/bootstrap.sh` and `scripts/circuit_kind.test.sh` are identical to `next` at b0a7559. - [x] [#25579](#25579) fix(private-kernel): a surviving nullifier link may only resolve to a non-revertible note hash (pick applied without conflicts, plus one `fix(port)` commit) - It changes the `private-kernel-reset-tail-to-public` circuits, so the VK tree root moves again. The `fix(port)` commit updates labs patch 0001 to the new root. - [x] [#23587](#23587) fix: anchor Grumpkin SRS to pinned chunk hashes on load (clean pick) - All eight files end up identical to `next` at 08f90e6, as does the rest of `barretenberg/cpp/src/barretenberg/srs`. No later commit on `next` touches them. - [x] [#25580](#25580) test(private-kernel): reject a duplicate nullifier index hidden behind an inactive squashing hint (clean pick) - Test-only: one test and its import in `validate_transient_data_squashing_hints.nr`. - With #25536, #25579 and this one applied, the `private-kernel-lib` crate is identical to `next` at b1b6871. - [x] [#25530](#25530) chore: move away from auto-close-issues.yml (clean pick) - Deletes `.github/workflows/auto-close-issues.yml` and `scripts/auto_close_issues.py`. Nothing else on `v6` invokes either. - [x] [#25566](#25566) docs(types): document that poseidon2_hash_bytes does not commit the byte length (clean pick) - A doc comment and three unit tests in `types/src/hash.nr`, which ends up identical to `next` at 4f4bef8. - [x] [#25582](#25582) fix: Avoid early proof submission prover griefing (clean pick) - [x] [#25585](#25585) test: cover prover registration upgrade paths (clean pick) - Review follow-up to #25582: forge tests, a test wrapper simplification, and one corrected comment in `RewardLib.sol`. No contract logic changes. - [x] [#25570](#25570) refactor(l1): remove the built-in checkpoint reward overrides (clean pick) - `v6` carries the override stack this removes (#25312, #25426, #25461) and the proof-submission optimizations it keeps (#25404, #25406, #25419). - Nothing outside `l1-contracts` references what it removes (`registryRewardOverrides`, `AZTEC_REGISTRY_REWARD_OVERRIDE_*`, `getRegistryRewardOverrides`, the four `RewardLib__*` errors): no hits in this repo or in the `v6` labs pin `a0d73c0aed`. - [x] [#25571](#25571) feat(l1): pluggable sequencer reward calculator (AZIP-28) (clean pick) - Adds `ISequencerRewardCalculator`, `SequencerRewardCalculatorLib`, the `sequencerRewardCalculator` rollup config field, `setSequencerRewardCalculator` / `getSequencerRewardCalculator`, and the optional `AZTEC_SEQUENCER_REWARD_CALCULATOR` deploy variable (zero address by default). - Nothing in the `v6` labs pin references the calculator. Labs imports `network-defaults.json` directly, where the new key is an added default. - [x] [#25572](#25572) test(l1): reference registry reduction sequencer reward calculator (clean pick) - Test-tree only (`l1-contracts/test/reward-calculators`, a fork test and its fixture), plus the `foundry.toml` read permission for the fixture and regenerated gas reports. - [x] [#25573](#25573) test(l1): reference premium sequencer reward calculator with provenance-tracking ATPs (clean pick) - Test-tree only (`l1-contracts/test/reward-calculators/premium`), plus regenerated gas reports. - With #25577, #25578, #25582, #25585, #25570, #25571, #25572 and this one applied, the whole `l1-contracts` directory is identical to `next` at 551aa41. ## Protocol impact - #25536 and #25579 both change private kernel circuits, so the VK tree root that `v6` builds moves: - from `0x2d89003cc2dc62b06f07d83d3635c66c63fc43668369d30e7ee516f908ee10e3` (the testnet deployed from `v6`) - to `0x05b95d9ef57c61d1c6626545101db55ae2d1f98ecb618d1c220610c049ee522b` (taken from this PR's failing CI run on `34e0b24f`), which is what labs patch 0001 pins - the intermediate root with #25536 alone was `0x21f06c3b82320ea5f80646751cdd9fa023dfd61400a42b8c952aa32e8f155793` (from the failing CI run on `bed8264`) - After this merges, `v6` no longer matches the currently deployed testnet until it is redeployed. The re-pin follows the decision recorded on #25549 (a breaking kernel change ported to `v6` re-pins testnet in the same PR). - The protocol contracts hash and the genesis root are unchanged; those two assertions passed on `34e0b24f`. - #25570 and #25571 change how the L1 rollup pays sequencers: - the per-registry checkpoint reward overrides built into the rollup are gone, along with `RollupConfigInput.registryRewardOverrides`, `getRegistryRewardOverrides` and the `AZTEC_REGISTRY_REWARD_OVERRIDE_*` deploy variables - sequencer reward policy is delegated to an optional governance-set calculator contract; with none configured every proposer gets the default sequencer share - #25572 and #25573 add reference calculators under `l1-contracts/test` only; no calculator ships in `src` or is configured by default - #25582 changes the L1 rollup contracts: `RewardLib` reward handling for early proof submissions, and a new `getHasSubmittedFullEpoch` view on `IRollup` / `Rollup`. - Per #25585, the prover node (`prover-node-publisher.ts` in `aztec-labs-eng/aztec-node`) still skips submission when `getHasSubmitted` is true. It has to use `getHasSubmittedFullEpoch` for full-epoch proofs before the fix helps honest provers; that change is not in this PR or in the `v6` labs pin's patch series. - The L1 changes take effect only on a rollup deployed from this code. - #25536 is a repricing: a public tx with a teardown call is charged 20_000 more L2 gas. The PXE on `v6` already estimates that amount. - #25579 rejects, in tail-to-public only, a nullifier whose note hash link resolves to a revertible note hash. No honest client produces that witness; the private-only tail circuit is unchanged. - #25576 tightens p2p tx validation: a contract class log whose `length` exceeds its trimmed length is now rejected. Honest producers already emit the trimmed length. - #23587 makes bb check a loaded Grumpkin SRS against pinned chunk hashes. It changes the bb binary, not any circuit. - #25580 and #25566 add unit tests (and a doc comment) and change no circuit. - #25530 removes a GitHub workflow: issues referenced by commits pushed to `v6` are no longer closed by the script. - #25577 and #25578 are build-cache only and change no circuit: - the l1-contracts cache key now follows the Noir commit - the VK cache key now covers the circuit kind and the bootstrap script, so every VK is regenerated once - the Solidity verifier is written on every build instead of restored from the cache - l1-contracts gains a test that `generated/HonkVerifier.sol` equals the circuits-side verifier ## Testing - CI3 passed on `fb097a89` (the first eleven ports, through #25585), including the testnet compatibility test against the re-pinned root and the l1-contracts forge tests. - CI3 on `34e0b24f` (the first nine ports, before the second re-pin) ran about 10,400 tests; the only failure was the VK tree root assertion that the second re-pin fixes. - `./labs-patches/bootstrap.sh check`: the series (0001, 0010) applies cleanly to `a0d73c0aed`. Patch 0001 was produced with `bootstrap.sh apply` / `export`. - #25577 / #25578: `bash -n` passes on both bootstrap scripts and `scripts/circuit_kind.test.sh` passes locally. `v6` has no `pinned-build.tar.gz`, so the pinned-build path is not exercised. - No circuits, bb or L1 contracts were built locally (no `nargo`, no bb build and no pinned `solc` in the port environment). The four AZIP-28 ports (#25570 to #25573) have no CI result yet: the forge suite, the labs build against the changed rollup ABI and the deploy-script tests run on this PR's CI. - The branch is based on `v6` at cf7ea33; `v6` has since gained #25551 (a notify workflow change), which merges without conflicts. --- *Created by [claudebox](https://claudebox.work/v2/sessions/134efca9a11ee14f/jobs/7) · group: `slackbot` · [Slack thread](https://aztecprotocol.slack.com/archives/C0AGN2WT3CP/p1790609320989739?thread_ts=1790609320.989739&cid=C0AGN2WT3CP)*
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes https://github.com/AztecProtocol/aztec-claude/issues/2467