|
1 | | -use eth_types::H256; |
| 1 | +//! This module implements related functions that aggregates public inputs of many chunks into a |
| 2 | +//! single one. |
| 3 | +//! |
| 4 | +//! # Spec |
| 5 | +//! |
| 6 | +//! A chunk is a list of continuous blocks. It consists of 4 hashes: |
| 7 | +//! - state root before this chunk |
| 8 | +//! - state root after this chunk |
| 9 | +//! - the withdraw root of this chunk |
| 10 | +//! - the data hash of this chunk |
| 11 | +//! Those 4 hashes are obtained from the caller. |
| 12 | +//! |
| 13 | +//! A chunk's public input hash is then derived from the above 4 attributes via |
| 14 | +//! |
| 15 | +//! - chunk_pi_hash := keccak(chain_id || prev_state_root || post_state_root || withdraw_root || |
| 16 | +//! chunk_data_hash) |
| 17 | +//! |
| 18 | +//! A batch is a list of continuous chunks. It consists of 2 hashes |
| 19 | +//! |
| 20 | +//! - batch_data_hash := keccak(chunk_0.data_hash || ... || chunk_k-1.data_hash) |
| 21 | +//! |
| 22 | +//! - batch_pi_hash := keccak(chain_id || chunk_0.prev_state_root || chunk_k-1.post_state_root || |
| 23 | +//! chunk_k-1.withdraw_root || batch_data_hash) |
| 24 | +//! |
| 25 | +//! Note that chain_id is used for all public input hashes. But not for any data hashes. |
| 26 | +//! |
| 27 | +//! # Circuit |
| 28 | +//! |
| 29 | +//! A BatchHashCircuit asserts that the batch is well-formed. |
| 30 | +//! |
| 31 | +//! ## Public Input |
| 32 | +//! The public inputs of the circuit (32 Field elements) is constructed as |
| 33 | +//! - batch_pi_hash: 32 Field elements |
| 34 | +//! |
| 35 | +//! ## Constraints |
| 36 | +//! The circuit attests the following statements: |
| 37 | +//! |
| 38 | +//! 1. all hashes are computed correctly |
| 39 | +//! 2. the relations between hash preimages and digests are satisfied |
| 40 | +//! - batch_data_hash is part of the input to compute batch_pi_hash |
| 41 | +//! - batch_pi_hash used same roots as chunk_pi_hash |
| 42 | +//! - same data_hash is used to compute batch_data_hash and chunk_pi_hash for all chunks |
| 43 | +//! - chunks are continuous: they are linked via the state roots |
| 44 | +//! - all hashes uses a same chain_id |
| 45 | +//! 3. the batch_pi_hash matches the circuit's public input (32 field elements) above |
| 46 | +
|
| 47 | +use eth_types::{Field, H256}; |
2 | 48 | use ethers_core::utils::keccak256; |
3 | 49 |
|
4 | 50 | use super::chunk::ChunkHash; |
5 | 51 |
|
6 | 52 | #[derive(Default, Debug, Clone)] |
7 | 53 | /// A batch is a set of continuous chunks. |
8 | 54 | /// A BatchHash consists of 2 hashes. |
| 55 | +/// - batch_data_hash := keccak(chunk_0.data_hash || ... || chunk_k-1.data_hash) |
| 56 | +/// - batch_pi_hash := keccak(chain_id || chunk_0.prev_state_root || chunk_k-1.post_state_root || |
| 57 | +/// chunk_k-1.withdraw_root || batch_data_hash) |
9 | 58 | pub struct BatchHash { |
| 59 | + pub(crate) chain_id: u64, |
| 60 | + pub(crate) chunks: Vec<ChunkHash>, |
10 | 61 | pub(crate) data_hash: H256, |
11 | 62 | pub(crate) public_input_hash: H256, |
12 | 63 | } |
13 | 64 |
|
14 | 65 | impl BatchHash { |
| 66 | + /// Sample a batch hash circuit from random (for testing) |
| 67 | + #[cfg(test)] |
| 68 | + pub(crate) fn mock_batch_hash_circuit<R: rand::RngCore>(r: &mut R, size: usize) -> Self { |
| 69 | + let mut chunks = (0..size) |
| 70 | + .map(|_| ChunkHash::mock_chunk_hash(r)) |
| 71 | + .collect::<Vec<_>>(); |
| 72 | + for i in 0..size - 1 { |
| 73 | + chunks[i + 1].prev_state_root = chunks[i].post_state_root; |
| 74 | + } |
| 75 | + |
| 76 | + Self::construct(&chunks) |
| 77 | + } |
| 78 | + |
15 | 79 | /// Build Batch hash from a list of chunks |
16 | 80 | pub(crate) fn construct(chunk_hashes: &[ChunkHash]) -> Self { |
| 81 | + assert!(!chunk_hashes.is_empty(), "input chunk slice is empty"); |
| 82 | + |
17 | 83 | // sanity: the chunks are continuous |
18 | 84 | for i in 0..chunk_hashes.len() - 1 { |
19 | 85 | assert_eq!( |
@@ -50,8 +116,82 @@ impl BatchHash { |
50 | 116 | let public_input_hash = keccak256(preimage); |
51 | 117 |
|
52 | 118 | Self { |
| 119 | + chain_id: chunk_hashes[0].chain_id, |
| 120 | + chunks: chunk_hashes.to_vec(), |
53 | 121 | data_hash: data_hash.into(), |
54 | 122 | public_input_hash: public_input_hash.into(), |
55 | 123 | } |
56 | 124 | } |
| 125 | + |
| 126 | + /// Extract all the hash inputs that will ever be used |
| 127 | + /// orders: |
| 128 | + /// - batch_public_input_hash |
| 129 | + /// - batch_data_hash_preimage |
| 130 | + /// - chunk\[i\].piHash for i in \[0, k) |
| 131 | + pub(crate) fn extract_hash_preimages(&self) -> Vec<Vec<u8>> { |
| 132 | + let mut res = vec![]; |
| 133 | + |
| 134 | + // batchPiHash = |
| 135 | + // keccak( |
| 136 | + // chain_id || |
| 137 | + // chunk[0].prev_state_root || |
| 138 | + // chunk[k-1].post_state_root || |
| 139 | + // chunk[k-1].withdraw_root || |
| 140 | + // batch_data_hash ) |
| 141 | + let batch_public_input_hash_preimage = [ |
| 142 | + self.chain_id.to_le_bytes().as_ref(), |
| 143 | + self.chunks[0].prev_state_root.as_bytes(), |
| 144 | + self.chunks.last().unwrap().post_state_root.as_bytes(), |
| 145 | + self.chunks.last().unwrap().withdraw_root.as_bytes(), |
| 146 | + self.data_hash.as_bytes(), |
| 147 | + ] |
| 148 | + .concat(); |
| 149 | + res.push(batch_public_input_hash_preimage); |
| 150 | + |
| 151 | + // batchDataHash = keccak(chunk[0].dataHash || ... || chunk[k-1].dataHash) |
| 152 | + let batch_data_hash_preimage = self |
| 153 | + .chunks |
| 154 | + .iter() |
| 155 | + .flat_map(|x| x.data_hash.as_bytes().iter()) |
| 156 | + .cloned() |
| 157 | + .collect(); |
| 158 | + res.push(batch_data_hash_preimage); |
| 159 | + |
| 160 | + // compute piHash for each chunk for i in [0..k) |
| 161 | + // chunk[i].piHash = |
| 162 | + // keccak( |
| 163 | + // chain id || |
| 164 | + // chunk[i].prevStateRoot || chunk[i].postStateRoot || chunk[i].withdrawRoot || |
| 165 | + // chunk[i].datahash) |
| 166 | + for chunk in self.chunks.iter() { |
| 167 | + let chunk_pi_hash_preimage = [ |
| 168 | + self.chain_id.to_le_bytes().as_ref(), |
| 169 | + chunk.prev_state_root.as_bytes(), |
| 170 | + chunk.post_state_root.as_bytes(), |
| 171 | + chunk.withdraw_root.as_bytes(), |
| 172 | + chunk.data_hash.as_bytes(), |
| 173 | + ] |
| 174 | + .concat(); |
| 175 | + res.push(chunk_pi_hash_preimage) |
| 176 | + } |
| 177 | + |
| 178 | + res |
| 179 | + } |
| 180 | + |
| 181 | + fn num_instance(&self) -> Vec<usize> { |
| 182 | + // 12 elements from the accumulators |
| 183 | + // 32 elements from batch_data_hash_digest |
| 184 | + vec![44] |
| 185 | + } |
| 186 | + |
| 187 | + /// Compute the public inputs for this circuit |
| 188 | + /// which is the public_input_hash |
| 189 | + pub(crate) fn instances<F: Field>(&self) -> Vec<Vec<F>> { |
| 190 | + vec![self |
| 191 | + .public_input_hash |
| 192 | + .as_bytes() |
| 193 | + .iter() |
| 194 | + .map(|&x| F::from(x as u64)) |
| 195 | + .collect()] |
| 196 | + } |
57 | 197 | } |
0 commit comments