fix(fast-inbox): dedupe checkpoint header verification on epoch proof submission (A-1373)

submitEpochRootProof verified the supplied checkpoint headers and then hit
getEpochProofPublicInputs, which verified them again, hashing every header in
the epoch twice per submission. Split the assembly into a private
computeEpochProofPublicInputs that takes the headers as already verified, and
keep the header check on the externally reachable getter, which is the entry
point off-chain callers use and must not trust caller-supplied fee fields.

Author: spalladino

l1-contracts/src/core/libraries/rollup/EpochProofLib.sol

@@ -109,6 +109,8 @@ library EpochProofLib {
 
     Epoch endEpoch = assertAcceptable(_args.start, _args.end);
 
+    // Rehash the supplied headers against storage once, here: the public-input assembly below reads the fee
+    // recipient/value out of them and relies on this call having run.
     verifyHeaders(_args.start, _args.end, _args.headers);
 
     // Verify attestations for the last checkpoint in the epoch
@@ -150,6 +152,11 @@ library EpochProofLib {
    * own public inputs used for generating the proof vs the ones assembled
    * by this contract when verifying it.
    *
+   * @dev The fee recipient/value public inputs are sourced from the supplied headers, so this entry point rehashes
+   * them against storage before assembling: an off-chain caller must not walk away with public inputs built from
+   * unverified fee fields and only discover the mismatch when the on-chain proof reverts. The submit path verifies
+   * the headers up front and assembles via computeEpochProofPublicInputs to avoid rehashing them twice.
+   *
    * @param  _start - The start of the epoch (inclusive)
    * @param  _end - The end of the epoch (inclusive)
    * @param  _args - Array of public inputs to the proof (previousArchive, endArchive, endTimestamp, outHash, proverId)
@@ -163,6 +170,107 @@ library EpochProofLib {
     ProposedHeader[] calldata _headers,
     bytes calldata _blobPublicInputs
   ) internal view returns (bytes32[] memory) {
+    verifyHeaders(_start, _end, _headers);
+    return computeEpochProofPublicInputs(_start, _end, _args, _headers, _blobPublicInputs);
+  }
+
+  /**
+   * @notice Verifies committee attestations for the last checkpoint in the epoch before accepting the epoch proof
+   *
+   * @dev This verification ensures that the committee has properly validated the final state of the epoch
+   *      before the proof can be accepted. The function validates that:
+   *      1. The provided attestations match the stored attestation hash for the checkpoint
+   *      2. The attestations have valid signatures from committee members
+   *      3. The attestations meet the required threshold (2/3+ of committee)
+   *
+   *      For escape hatch epochs, attestation verification is skipped since there is no committee
+   *      involvement - only the designated escape hatch proposer can propose blocks.
+   *
+   * @dev Errors Thrown:
+   *      - Rollup__InvalidAttestations: Provided attestations don't match stored hash or fail validation
+   *
+   * @param _endCheckpointNumber The last checkpoint number in the epoch to verify attestations for
+   * @param _attestations The committee attestations containing signatures and validator information
+   */
+  function verifyLastCheckpointAttestationsAndOutHash(
+    uint256 _endCheckpointNumber,
+    CommitteeAttestations memory _attestations,
+    bytes32 _outHash
+  ) private {
+    // Get the stored attestation hash and payload digest for the last checkpoint
+    CompressedTempCheckpointLog storage checkpointLog = STFLib.getStorageTempCheckpointLog(_endCheckpointNumber);
+
+    // Verify that the out hash matches the stored value
+    // The stored out hash is part of the payloadDigest that was attested to.
+    require(checkpointLog.outHash == _outHash, Errors.Rollup__InvalidOutHash(checkpointLog.outHash, _outHash));
+
+    // Verify that the provided attestations match the stored hash
+    bytes32 providedAttestationsHash = keccak256(abi.encode(_attestations));
+    require(providedAttestationsHash == checkpointLog.attestationsHash, Errors.Rollup__InvalidAttestations());
+
+    // Get the epoch for the last checkpoint
+    Epoch epoch = STFLib.getEpochForCheckpoint(_endCheckpointNumber);
+
+    // Check if this is an escape hatch epoch - skip attestation verification if so
+    // since escape hatch blocks are proposed without committee attestations.
+    // Uses epoch-stable lookup so proof verification uses the escape hatch that was
+    // active when the epoch started, not whatever is currently configured.
+    {
+      IEscapeHatch escapeHatch = ValidatorSelectionLib.getEscapeHatchForEpoch(epoch);
+      if (address(escapeHatch) != address(0)) {
+        (bool isOpen,) = escapeHatch.isHatchOpen(epoch);
+        if (isOpen) {
+          // Skip attestation verification for escape hatch epochs
+          return;
+        }
+      }
+    }
+
+    ValidatorSelectionLib.verifyAttestations(epoch, _attestations, checkpointLog.payloadDigest);
+  }
+
+  /**
+   * @notice Rehashes each provided checkpoint header and requires it to match the stored header hash
+   *
+   * @param _start The first checkpoint number in the epoch (inclusive)
+   * @param _end The last checkpoint number in the epoch (inclusive)
+   * @param _headers The proposed headers for each checkpoint in [_start, _end]
+   */
+  function verifyHeaders(uint256 _start, uint256 _end, ProposedHeader[] calldata _headers) private view {
+    uint256 numCheckpoints = _end - _start + 1;
+    require(
+      _headers.length == numCheckpoints, Errors.Rollup__InvalidCheckpointHeaderCount(numCheckpoints, _headers.length)
+    );
+
+    for (uint256 i = 0; i < numCheckpoints; i++) {
+      bytes32 expectedHeaderHash = STFLib.getHeaderHash(_start + i);
+      bytes32 providedHeaderHash = ProposedHeaderLib.hash(_headers[i]);
+      require(
+        providedHeaderHash == expectedHeaderHash,
+        Errors.Rollup__InvalidCheckpointHeader(expectedHeaderHash, providedHeaderHash)
+      );
+    }
+  }
+
+  /**
+   * @notice Assembles the root rollup public inputs, taking the supplied checkpoint headers as already verified
+   *
+   * @dev Callers must have rehashed `_headers` against the stored header hashes beforehand, since the fee
+   * recipient/value public inputs are read straight out of them.
+   *
+   * @param  _start - The start of the epoch (inclusive)
+   * @param  _end - The end of the epoch (inclusive)
+   * @param  _args - Array of public inputs to the proof (previousArchive, endArchive, endTimestamp, outHash, proverId)
+   * @param  _headers - The proposed checkpoint headers supplying the fee recipient and value for each checkpoint
+   * @param _blobPublicInputs- The blob public inputs for the proof
+   */
+  function computeEpochProofPublicInputs(
+    uint256 _start,
+    uint256 _end,
+    PublicInputArgs calldata _args,
+    ProposedHeader[] calldata _headers,
+    bytes calldata _blobPublicInputs
+  ) private view returns (bytes32[] memory) {
     RollupStore storage rollupStore = STFLib.getStorage();
 
     {
@@ -183,11 +291,6 @@ library EpochProofLib {
       }
     }
 
-    // The fee recipient/value below are sourced from the supplied headers, so the header hashes must be validated here
-    // as well as on the submit path - otherwise an off-chain caller of this getter would assemble public inputs from
-    // unverified fee fields and only discover the mismatch when the on-chain proof reverts.
-    verifyHeaders(_start, _end, _headers);
-
     bytes32[] memory publicInputs = new bytes32[](Constants.ROOT_ROLLUP_PUBLIC_INPUTS_LENGTH);
 
     // Structure of the root rollup public inputs we need to reassemble:
@@ -289,84 +392,6 @@ library EpochProofLib {
     return publicInputs;
   }
 
-  /**
-   * @notice Verifies committee attestations for the last checkpoint in the epoch before accepting the epoch proof
-   *
-   * @dev This verification ensures that the committee has properly validated the final state of the epoch
-   *      before the proof can be accepted. The function validates that:
-   *      1. The provided attestations match the stored attestation hash for the checkpoint
-   *      2. The attestations have valid signatures from committee members
-   *      3. The attestations meet the required threshold (2/3+ of committee)
-   *
-   *      For escape hatch epochs, attestation verification is skipped since there is no committee
-   *      involvement - only the designated escape hatch proposer can propose blocks.
-   *
-   * @dev Errors Thrown:
-   *      - Rollup__InvalidAttestations: Provided attestations don't match stored hash or fail validation
-   *
-   * @param _endCheckpointNumber The last checkpoint number in the epoch to verify attestations for
-   * @param _attestations The committee attestations containing signatures and validator information
-   */
-  function verifyLastCheckpointAttestationsAndOutHash(
-    uint256 _endCheckpointNumber,
-    CommitteeAttestations memory _attestations,
-    bytes32 _outHash
-  ) private {
-    // Get the stored attestation hash and payload digest for the last checkpoint
-    CompressedTempCheckpointLog storage checkpointLog = STFLib.getStorageTempCheckpointLog(_endCheckpointNumber);
-
-    // Verify that the out hash matches the stored value
-    // The stored out hash is part of the payloadDigest that was attested to.
-    require(checkpointLog.outHash == _outHash, Errors.Rollup__InvalidOutHash(checkpointLog.outHash, _outHash));
-
-    // Verify that the provided attestations match the stored hash
-    bytes32 providedAttestationsHash = keccak256(abi.encode(_attestations));
-    require(providedAttestationsHash == checkpointLog.attestationsHash, Errors.Rollup__InvalidAttestations());
-
-    // Get the epoch for the last checkpoint
-    Epoch epoch = STFLib.getEpochForCheckpoint(_endCheckpointNumber);
-
-    // Check if this is an escape hatch epoch - skip attestation verification if so
-    // since escape hatch blocks are proposed without committee attestations.
-    // Uses epoch-stable lookup so proof verification uses the escape hatch that was
-    // active when the epoch started, not whatever is currently configured.
-    {
-      IEscapeHatch escapeHatch = ValidatorSelectionLib.getEscapeHatchForEpoch(epoch);
-      if (address(escapeHatch) != address(0)) {
-        (bool isOpen,) = escapeHatch.isHatchOpen(epoch);
-        if (isOpen) {
-          // Skip attestation verification for escape hatch epochs
-          return;
-        }
-      }
-    }
-
-    ValidatorSelectionLib.verifyAttestations(epoch, _attestations, checkpointLog.payloadDigest);
-  }
-
-  /**
-   * @notice Rehashes each provided checkpoint header and requires it to match the stored header hash
-   *
-   * @param _start The first checkpoint number in the epoch (inclusive)
-   * @param _end The last checkpoint number in the epoch (inclusive)
-   * @param _headers The proposed headers for each checkpoint in [_start, _end]
-   */
-  function verifyHeaders(uint256 _start, uint256 _end, ProposedHeader[] calldata _headers) private view {
-    uint256 numCheckpoints = _end - _start + 1;
-    require(
-      _headers.length == numCheckpoints, Errors.Rollup__InvalidCheckpointHeaderCount(numCheckpoints, _headers.length)
-    );
-
-    for (uint256 i = 0; i < numCheckpoints; i++) {
-      bytes32 expectedHeaderHash = STFLib.getHeaderHash(_start + i);
-      bytes32 providedHeaderHash = ProposedHeaderLib.hash(_headers[i]);
-      require(
-        providedHeaderHash == expectedHeaderHash,
-        Errors.Rollup__InvalidCheckpointHeader(expectedHeaderHash, providedHeaderHash)
-      );
-    }
-  }
-
   /**
    * @notice Validates that an epoch proof submission meets all acceptance criteria
    *
@@ -434,6 +459,9 @@ library EpochProofLib {
    *      2. Assembling the public inputs for the root rollup circuit
    *      3. Verifying the validity proof against the assembled public inputs using the configured verifier
    *
+   * @dev Assumes the caller has already verified the supplied checkpoint headers against storage, so assembly skips
+   *      rehashing them.
+   *
    * @dev Errors Thrown:
    *      - Rollup__InvalidBlobProof: Batched blob proof verification failed
    *      - Rollup__InvalidProof: validity proof verification failed
@@ -449,7 +477,7 @@ library EpochProofLib {
     BlobLib.validateBatchedBlob(_args.blobInputs);
 
     bytes32[] memory publicInputs =
-      getEpochProofPublicInputs(_args.start, _args.end, _args.args, _args.headers, _args.blobInputs);
+      computeEpochProofPublicInputs(_args.start, _args.end, _args.args, _args.headers, _args.blobInputs);
 
     require(rollupStore.config.epochProofVerifier.verify(_args.proof, publicInputs), Errors.Rollup__InvalidProof());