fix: honk audit fixes (#456)

suyash67 · web-flow · commit 2c6023ab998e · 2026-07-02T04:46:14.000+05:30
* fix 1: pin honk_key_gen Solidity VK emission to flavor entity count Audit finding #1. The Solidity VK generator hand-wrote the precomputed-G1 emission list with no link to the flavor, so adding/removing a precomputed entity would silently drift the generated on-chain VK out of sync with the C++ layout. Drive the emission count from a (commitment, name) array and static_assert it against the flavor's size(); add a test asserting the generator emits exactly size() G1 points. * fix 3: set beta_quartic in RelationParameters::compute_beta_powers Audit finding #3. compute_beta_powers() set beta..beta_cube but left beta_quartic at 0, so the test-only get_random() built eccvm_set_permutation_delta with a zero domain-separation tag instead of the production FIRST_TERM_TAG * beta^4. Set beta_quartic = beta_cube * beta so test-infra parameters match the eccvm relation semantics. * fix 4: reject wrong-size field input in VK deserialization Audit finding #4. NativeVerificationKey_::from_field_elements and the StdlibVerificationKey_ span constructor consumed only the fields they needed and silently ignored trailing ones, so an oversize (malformed) VK deserialized without error. Assert the input field count matches the VK layout exactly on both paths so a malformed VK is rejected rather than masked. * fix 6: add [[nodiscard]] to create_recursion_constraints Audit finding #6. create_recursion_constraints returns the aggregated pairing points and IPA claim the caller must deferred-accumulate to complete recursive verification, but unlike its inner helper create_honk_recursion_constraints it carried no [[nodiscard]] -- a caller could silently drop the result and skip accumulation with no diagnostic. Add the attribute, matching the inner helper. * fix 7: assert that hasZK and masking layout are consistent. * fix: extend gemini-masking-layout assert to remaining ZK flavors Finding #7's gemini_masking_layout_consistent<> static_assert was only on Ultra/UltraZK/Mega/MegaZKFlavor. UltraKeccakZKFlavor, UltraZKRecursiveFlavor and MegaZKRecursiveFlavor hand-declare both the masking flag and the AllValues layout, so they can drift independently the same way -- MegaZKRecursiveFlavor most acutely, since its HasGeminiMasking=false is decoupled from HasZK=true. Add the assert to all three; all are currently consistent, so this is pure hardening.
diff --git a/barretenberg/cpp/src/barretenberg/dsl/acir_format/recursion_constraint.hpp b/barretenberg/cpp/src/barretenberg/dsl/acir_format/recursion_constraint.hpp
@@ -132,7 +132,8 @@ struct RecursionConstraint {
  * @param chonk_recursion_data pair of (ChonkRecursionConstraints, ChonkRecursionConstraintsOriginalOpcodeIndices)
  */
 template <typename Builder>
-HonkRecursionConstraintsOutput<Builder> create_recursion_constraints(
+[[nodiscard("pairing points and IPA claim must be accumulated")]] HonkRecursionConstraintsOutput<Builder>
+create_recursion_constraints(
     Builder& builder,
     GateCounter<Builder>& gate_counter,
     std::vector<size_t>& gates_per_opcode,
diff --git a/barretenberg/cpp/src/barretenberg/flavor/flavor.hpp b/barretenberg/cpp/src/barretenberg/flavor/flavor.hpp
@@ -238,6 +238,9 @@ class NativeVerificationKey_ : public PrecomputedCommitments {
      */
     size_t from_field_elements(const std::span<const DataType>& elements)
     {
+        BB_ASSERT_EQ(elements.size(),
+                     calc_num_data_types(),
+                     "VerificationKey::from_field_elements received the wrong number of field elements");
 
         size_t idx = 0;
         auto deserialize = [&idx, &elements]<typename T>(T& target) {
@@ -418,6 +421,9 @@ class StdlibVerificationKey_ : public PrecomputedCommitments {
         for (Commitment& commitment : this->get_all()) {
             commitment = Codec::template deserialize_from_frs<Commitment>(elements, num_frs_read);
         }
+        BB_ASSERT_EQ(num_frs_read,
+                     elements.size(),
+                     "StdlibVerificationKey deserialization received the wrong number of field elements");
     }
 
     /**
diff --git a/barretenberg/cpp/src/barretenberg/flavor/flavor_concepts.hpp b/barretenberg/cpp/src/barretenberg/flavor/flavor_concepts.hpp
@@ -107,5 +107,21 @@ constexpr bool flavor_has_gemini_masking()
     }
 }
 
+// Whether a flavor's entity layout actually carries a gemini_masking_poly column.
+template <typename Flavor>
+constexpr bool flavor_entities_have_gemini_masking()
+{
+    return requires(typename Flavor::AllValues values) { values.gemini_masking_poly(); };
+}
+
+// The masking invariant: the advertised flag must match the real entity layout. A flavor that
+// declares Gemini masking (via HasGeminiMasking / HasZK) must actually carry the gemini_masking_poly
+// column, and vice versa.
+template <typename Flavor>
+constexpr bool gemini_masking_layout_consistent()
+{
+    return flavor_has_gemini_masking<Flavor>() == flavor_entities_have_gemini_masking<Flavor>();
+}
+
 // clang-format on
 } // namespace bb
diff --git a/barretenberg/cpp/src/barretenberg/flavor/mega_flavor.hpp b/barretenberg/cpp/src/barretenberg/flavor/mega_flavor.hpp
@@ -8,6 +8,7 @@
 
 #include "barretenberg/commitment_schemes/kzg/kzg.hpp"
 #include "barretenberg/flavor/flavor.hpp"
+#include "barretenberg/flavor/flavor_concepts.hpp"
 #include "barretenberg/flavor/generated/mega_flavor_generated.hpp"
 #include "barretenberg/flavor/partially_evaluated_multivariates.hpp"
 #include "barretenberg/flavor/prover_polynomials.hpp"
@@ -88,6 +89,9 @@ class MegaFlavor : public MegaFlavor_Generated {
      */
     using AllValues = AllEntities<FF>;
 
+    static_assert(gemini_masking_layout_consistent<MegaFlavor>(),
+                  "MegaFlavor gemini masking flag must match its entity layout");
+
     /**
      * @brief A container for the prover polynomials handles.
      */
diff --git a/barretenberg/cpp/src/barretenberg/flavor/mega_zk_flavor.hpp b/barretenberg/cpp/src/barretenberg/flavor/mega_zk_flavor.hpp
@@ -10,6 +10,7 @@
 #include "barretenberg/commitment_schemes/small_subgroup_ipa/small_subgroup_ipa_utils.hpp"
 #include "barretenberg/constants.hpp"
 #include "barretenberg/flavor/flavor.hpp"
+#include "barretenberg/flavor/flavor_concepts.hpp"
 #include "barretenberg/flavor/generated/mega_zk_flavor_generated.hpp"
 #include "barretenberg/flavor/partially_evaluated_multivariates.hpp"
 #include "barretenberg/flavor/prover_polynomials.hpp"
@@ -103,6 +104,10 @@ class MegaZKFlavor : public MegaZKFlavor_Generated {
     }
 
     using AllValues = AllEntities<FF>;
+
+    static_assert(gemini_masking_layout_consistent<MegaZKFlavor>(),
+                  "MegaZKFlavor gemini masking flag must match its entity layout");
+
     using ProverPolynomials = ProverPolynomialsBase<AllEntities<Polynomial>, AllValues, Polynomial>;
     using PrecomputedData = PrecomputedData_<Polynomial, NUM_PRECOMPUTED_ENTITIES>;
     using VerificationKey = NativeVerificationKey_<PrecomputedEntities<Commitment>, Codec, HashFunction, CommitmentKey>;
diff --git a/barretenberg/cpp/src/barretenberg/flavor/mega_zk_recursive_flavor.hpp b/barretenberg/cpp/src/barretenberg/flavor/mega_zk_recursive_flavor.hpp
@@ -6,6 +6,7 @@
 
 #pragma once
 #include "barretenberg/commitment_schemes/kzg/kzg.hpp"
+#include "barretenberg/flavor/flavor_concepts.hpp"
 #include "barretenberg/flavor/mega_zk_flavor.hpp"
 #include "barretenberg/stdlib/primitives/curves/bn254.hpp"
 #include "barretenberg/stdlib/primitives/field/field.hpp"
@@ -78,6 +79,9 @@ template <typename BuilderType> class MegaZKRecursiveFlavor_ {
         using Base::Base;
     };
 
+    static_assert(gemini_masking_layout_consistent<MegaZKRecursiveFlavor_>(),
+                  "MegaZKRecursiveFlavor gemini masking flag must match its entity layout");
+
     using VerificationKey = StdlibVerificationKey_<CircuitBuilder,
                                                    NativeFlavor::PrecomputedEntities<Commitment>,
                                                    NativeFlavor::VerificationKey>;
diff --git a/barretenberg/cpp/src/barretenberg/flavor/native_verification_key.test.cpp b/barretenberg/cpp/src/barretenberg/flavor/native_verification_key.test.cpp
@@ -88,3 +88,21 @@ TYPED_TEST(NativeVerificationKeyTests, VKSizeCheck)
     VerificationKey vk(TestFixture::create_vk());
     EXPECT_EQ(vk.to_field_elements().size(), VerificationKey::calc_num_data_types());
 }
+
+// from_field_elements must require an exact field count, not just enough fields.
+TYPED_TEST(NativeVerificationKeyTests, FromFieldElementsRejectsWrongSize)
+{
+    using Flavor = typename TypeParam::Flavor;
+    using VerificationKey = typename Flavor::VerificationKey;
+
+    VerificationKey vk(TestFixture::create_vk());
+    const auto fields = vk.to_field_elements();
+
+    VerificationKey roundtrip;
+    EXPECT_NO_THROW(roundtrip.from_field_elements(fields));
+
+    auto oversize = fields;
+    oversize.push_back(fields.back());
+    VerificationKey bad;
+    EXPECT_ANY_THROW(bad.from_field_elements(oversize));
+}
diff --git a/barretenberg/cpp/src/barretenberg/flavor/stdlib_verification_key.test.cpp b/barretenberg/cpp/src/barretenberg/flavor/stdlib_verification_key.test.cpp
@@ -90,3 +90,43 @@ TYPED_TEST(StdlibVerificationKeyTests, VKHashingConsistency)
     FF vk_hash_2 = vk.hash_with_origin_tagging(transcript);
     EXPECT_EQ(vk_hash_1.get_value(), vk_hash_2.get_value());
 }
+
+// The span constructor must require an exact field count, not just enough fields.
+TYPED_TEST(StdlibVerificationKeyTests, SpanConstructorRejectsWrongSize)
+{
+    using Flavor = TypeParam;
+    using NativeFlavor = typename Flavor::NativeFlavor;
+    using NativeVerificationKey = typename NativeFlavor::VerificationKey;
+    using StdlibVerificationKey = typename Flavor::VerificationKey;
+    using OuterBuilder = typename Flavor::CircuitBuilder;
+    using FF = stdlib::field_t<OuterBuilder>;
+    using Codec = stdlib::StdlibCodec<FF>;
+    using ProverInstance = ProverInstance_<NativeFlavor>;
+    using InnerBuilder = typename NativeFlavor::CircuitBuilder;
+
+    InnerBuilder builder;
+    stdlib::recursion::honk::DefaultIO<InnerBuilder>::add_default(builder);
+    auto prover_instance = std::make_shared<ProverInstance>(builder);
+    auto native_vk = std::make_shared<NativeVerificationKey>(prover_instance->get_precomputed());
+
+    OuterBuilder outer_builder;
+    StdlibVerificationKey vk(&outer_builder, native_vk);
+
+    std::vector<FF> fields;
+    auto append = [&]<typename T>(const T& input) {
+        std::vector<FF> input_fields = Codec::template serialize_to_fields<T>(input);
+        fields.insert(fields.end(), input_fields.begin(), input_fields.end());
+    };
+    append(vk.log_circuit_size);
+    append(vk.num_public_inputs);
+    append(vk.pub_inputs_offset);
+    for (const auto& commitment : vk.get_all()) {
+        append(commitment);
+    }
+
+    EXPECT_NO_THROW(StdlibVerificationKey{ std::span<FF>(fields) });
+
+    std::vector<FF> oversize = fields;
+    oversize.push_back(fields.back());
+    EXPECT_ANY_THROW(StdlibVerificationKey{ std::span<FF>(oversize) });
+}
diff --git a/barretenberg/cpp/src/barretenberg/flavor/ultra_flavor.hpp b/barretenberg/cpp/src/barretenberg/flavor/ultra_flavor.hpp
@@ -8,6 +8,7 @@
 
 #include "barretenberg/commitment_schemes/kzg/kzg.hpp"
 #include "barretenberg/flavor/flavor.hpp"
+#include "barretenberg/flavor/flavor_concepts.hpp"
 #include "barretenberg/flavor/generated/ultra_flavor_generated.hpp"
 #include "barretenberg/flavor/generated/ultra_zk_flavor_generated.hpp"
 #include "barretenberg/flavor/partially_evaluated_multivariates.hpp"
@@ -115,6 +116,9 @@ class UltraFlavor : public UltraFlavor_Generated {
 
     using AllValues = AllValues_<HasZK>;
 
+    static_assert(gemini_masking_layout_consistent<UltraFlavor>(),
+                  "UltraFlavor gemini masking flag must match its entity layout");
+
     /**
      * @brief A container for polynomials handles.
      */
diff --git a/barretenberg/cpp/src/barretenberg/flavor/ultra_keccak_zk_flavor.hpp b/barretenberg/cpp/src/barretenberg/flavor/ultra_keccak_zk_flavor.hpp
@@ -8,6 +8,7 @@
 
 #include "barretenberg/commitment_schemes/small_subgroup_ipa/small_subgroup_ipa_utils.hpp"
 #include "barretenberg/constants.hpp"
+#include "barretenberg/flavor/flavor_concepts.hpp"
 #include "barretenberg/flavor/ultra_keccak_flavor.hpp"
 
 namespace bb {
@@ -44,6 +45,10 @@ class UltraKeccakZKFlavor : public UltraKeccakFlavor {
     }
 
     using AllValues = UltraFlavor::AllValues_<HasZK>;
+
+    static_assert(gemini_masking_layout_consistent<UltraKeccakZKFlavor>(),
+                  "UltraKeccakZKFlavor gemini masking flag must match its entity layout");
+
     using ProverPolynomials = UltraFlavor::ProverPolynomials_<HasZK>;
     using PartiallyEvaluatedMultivariates = UltraFlavor::PartiallyEvaluatedMultivariates_<HasZK>;
 
diff --git a/barretenberg/cpp/src/barretenberg/flavor/ultra_zk_flavor.hpp b/barretenberg/cpp/src/barretenberg/flavor/ultra_zk_flavor.hpp
@@ -8,6 +8,7 @@
 
 #include "barretenberg/commitment_schemes/small_subgroup_ipa/small_subgroup_ipa_utils.hpp"
 #include "barretenberg/constants.hpp"
+#include "barretenberg/flavor/flavor_concepts.hpp"
 #include "barretenberg/flavor/ultra_flavor.hpp"
 
 namespace bb {
@@ -49,10 +50,15 @@ class UltraZKFlavor : public UltraFlavor {
     }
 
     using AllValues = UltraFlavor::AllValues_<HasZK>;
+
+    static_assert(gemini_masking_layout_consistent<UltraZKFlavor>(),
+                  "UltraZKFlavor gemini masking flag must match its entity layout");
+
     using ProverPolynomials = UltraFlavor::ProverPolynomials_<HasZK>;
     using PartiallyEvaluatedMultivariates = UltraFlavor::PartiallyEvaluatedMultivariates_<HasZK>;
 
     template <size_t LENGTH> using ProverUnivariates = AllEntities<bb::Univariate<FF, LENGTH>>;
     using ExtendedEdges = ProverUnivariates<MAX_PARTIAL_RELATION_LENGTH>;
 };
+
 } // namespace bb
diff --git a/barretenberg/cpp/src/barretenberg/flavor/ultra_zk_recursive_flavor.hpp b/barretenberg/cpp/src/barretenberg/flavor/ultra_zk_recursive_flavor.hpp
@@ -5,6 +5,7 @@
 // =====================
 
 #pragma once
+#include "barretenberg/flavor/flavor_concepts.hpp"
 #include "barretenberg/flavor/ultra_recursive_flavor.hpp"
 #include "barretenberg/flavor/ultra_zk_flavor.hpp"
 
@@ -41,6 +42,9 @@ template <typename BuilderType> class UltraZKRecursiveFlavor_ : public UltraRecu
         using Base = UltraFlavor::AllEntities_<FF, HasZK>;
         using Base::Base;
     };
+
+    static_assert(gemini_masking_layout_consistent<UltraZKRecursiveFlavor_>(),
+                  "UltraZKRecursiveFlavor gemini masking flag must match its entity layout");
 };
 
 } // namespace bb
diff --git a/barretenberg/cpp/src/barretenberg/honk/utils/honk_key_gen.hpp b/barretenberg/cpp/src/barretenberg/honk/utils/honk_key_gen.hpp
@@ -7,9 +7,12 @@
 #pragma once
 
 #include "barretenberg/ecc/fields/field_conversion.hpp"
+#include <array>
 #include <ostream>
 #include <string>
+#include <string_view>
 #include <type_traits>
+#include <utility>
 
 /**
  * Write a solidity file containing the vk params to the given stream.
@@ -26,7 +29,6 @@ inline void output_vk_sol_ultra_honk(std::ostream& os,
                                      std::string const& class_name,
                                      bool include_types_import = false)
 {
-
     const auto print_u256_const = [&](const auto& element, const std::string& name) {
         os << "uint256 constant " << name << " = " << element << ";" << std::endl;
     };
@@ -80,34 +82,54 @@ inline void output_vk_sol_ultra_honk(std::ostream& os,
     print_u256(1 << key->log_circuit_size, "circuitSize");
     print_u256(key->log_circuit_size, "logCircuitSize");
     print_u256(key->num_public_inputs, "publicInputsSize");
-    print_g1(key->q_l(), "ql");
-    print_g1(key->q_r(), "qr");
-    print_g1(key->q_o(), "qo");
-    print_g1(key->q_4(), "q4");
-    print_g1(key->q_m(), "qm");
-    print_g1(key->q_c(), "qc");
-    print_g1(key->q_lookup(), "qLookup");
-    print_g1(key->q_arith(), "qArith");
-    print_g1(key->q_delta_range(), "qDeltaRange");
-    print_g1(key->q_elliptic(), "qElliptic");
-    print_g1(key->q_memory(), "qMemory");
-    print_g1(key->q_nnf(), "qNnf");
-    print_g1(key->q_poseidon2_external(), "qPoseidon2External");
-    print_g1(key->q_poseidon2_internal(), "qPoseidon2Internal");
-    print_g1(key->sigma_1(), "s1");
-    print_g1(key->sigma_2(), "s2");
-    print_g1(key->sigma_3(), "s3");
-    print_g1(key->sigma_4(), "s4");
-    print_g1(key->table_1(), "t1");
-    print_g1(key->table_2(), "t2");
-    print_g1(key->table_3(), "t3");
-    print_g1(key->table_4(), "t4");
-    print_g1(key->id_1(), "id1");
-    print_g1(key->id_2(), "id2");
-    print_g1(key->id_3(), "id3");
-    print_g1(key->id_4(), "id4");
-    print_g1(key->lagrange_first(), "lagrangeFirst");
-    print_g1(key->lagrange_last(), "lagrangeLast", /*last=*/ true);
+    using Commitment = std::remove_cvref_t<decltype(key->q_l())>;
+
+    // (commitment, Solidity field name) pairs in on-chain VK struct order. The array length is the
+    // single source of truth for the number of emitted G1 points; the static_assert pins it to the
+    // flavor so adding/removing a precomputed entity fails to compile here rather than silently
+    // drifting the emitted Solidity VK out of sync with the C++ layout.
+    const auto precomputed_commitments = std::to_array<std::pair<Commitment, std::string_view>>({
+        { key->q_l(), "ql" },
+        { key->q_r(), "qr" },
+        { key->q_o(), "qo" },
+        { key->q_4(), "q4" },
+        { key->q_m(), "qm" },
+        { key->q_c(), "qc" },
+        { key->q_lookup(), "qLookup" },
+        { key->q_arith(), "qArith" },
+        { key->q_delta_range(), "qDeltaRange" },
+        { key->q_elliptic(), "qElliptic" },
+        { key->q_memory(), "qMemory" },
+        { key->q_nnf(), "qNnf" },
+        { key->q_poseidon2_external(), "qPoseidon2External" },
+        { key->q_poseidon2_internal(), "qPoseidon2Internal" },
+        { key->sigma_1(), "s1" },
+        { key->sigma_2(), "s2" },
+        { key->sigma_3(), "s3" },
+        { key->sigma_4(), "s4" },
+        { key->table_1(), "t1" },
+        { key->table_2(), "t2" },
+        { key->table_3(), "t3" },
+        { key->table_4(), "t4" },
+        { key->id_1(), "id1" },
+        { key->id_2(), "id2" },
+        { key->id_3(), "id3" },
+        { key->id_4(), "id4" },
+        { key->lagrange_first(), "lagrangeFirst" },
+        { key->lagrange_last(), "lagrangeLast" },
+    });
+
+    // lhs = no of precomputed commitments listed above
+    // rhs = no of precomputed commitments in the verification key
+    static_assert(std::tuple_size_v<decltype(precomputed_commitments)> ==
+                      std::remove_cvref_t<decltype(*key)>::size(),
+                  "honk_key_gen G1 emission list is out of sync with the flavor's precomputed entity count");
+
+    // print the precomputed commitments
+    for (size_t i = 0; i < precomputed_commitments.size(); ++i) {
+        const auto& [commitment, name] = precomputed_commitments[i];
+        print_g1(commitment, std::string(name), /*last=*/i + 1 == precomputed_commitments.size());
+    }
     os <<
         "        });\n"
         "        return vk;\n"
diff --git a/barretenberg/cpp/src/barretenberg/relations/relation_parameters.hpp b/barretenberg/cpp/src/barretenberg/relations/relation_parameters.hpp
@@ -48,6 +48,7 @@ template <typename T> struct RelationParameters {
         beta = beta_challenge;
         beta_sqr = beta * beta;
         beta_cube = beta_sqr * beta;
+        beta_quartic = beta_cube * beta;
     }
 
     // Multilinear batching (γ^0, ..., γ^{num_claims - 1}); entries past the claim count are left untouched so that
@@ -92,7 +93,8 @@ template <typename T> struct RelationParameters {
         RelationParameters result;
         result.compute_eta_powers(T::random_element()); // eta, eta_two = eta², eta_three = eta³
         result.rom_logup_gamma = T::random_element();
-        result.compute_beta_powers(T::random_element()); // beta, beta_sqr = beta², beta_cube = beta³
+        result.compute_beta_powers(
+            T::random_element()); // beta, beta_sqr = beta², beta_cube = beta³, beta_quartic = beta⁴
         result.gamma = T::random_element();
         result.public_input_delta = T::random_element();
         auto first_term_tag = result.beta_quartic; // FIRST_TERM_TAG (= 1) * beta_quartic
diff --git a/barretenberg/cpp/src/barretenberg/relations/relation_types.test.cpp b/barretenberg/cpp/src/barretenberg/relations/relation_types.test.cpp
diff --git a/barretenberg/cpp/src/barretenberg/ultra_honk/ultra_honk.test.cpp b/barretenberg/cpp/src/barretenberg/ultra_honk/ultra_honk.test.cpp

Original file line number	Diff line number	Diff line change
`@@ -238,6 +238,9 @@ class NativeVerificationKey_ : public PrecomputedCommitments {`
`238`	`238`	`*/`
`239`	`239`	`size_t from_field_elements(const std::span<const DataType>& elements)`
`240`	`240`	`{`
	`241`	`+ BB_ASSERT_EQ(elements.size(),`
	`242`	`+ calc_num_data_types(),`
	`243`	`+ "VerificationKey::from_field_elements received the wrong number of field elements");`
`241`	`244`
`242`	`245`	`size_t idx = 0;`
`243`	`246`	`auto deserialize = [&idx, &elements]<typename T>(T& target) {`
`@@ -418,6 +421,9 @@ class StdlibVerificationKey_ : public PrecomputedCommitments {`
`418`	`421`	`for (Commitment& commitment : this->get_all()) {`
`419`	`422`	`commitment = Codec::template deserialize_from_frs<Commitment>(elements, num_frs_read);`
`420`	`423`	`}`
	`424`	`+ BB_ASSERT_EQ(num_frs_read,`
	`425`	`+ elements.size(),`
	`426`	`+ "StdlibVerificationKey deserialization received the wrong number of field elements");`
`421`	`427`	`}`
`422`	`428`
`423`	`429`	`/**`