fix(sequencer): invalidate malicious yParity attestation checkpoints (A-1401) (#24537)

## Context

A-1351 (#24515) fixed the honest-proposer and relay path for
non-canonical yParity attestation signatures, but a malicious selected
proposer can still hand-craft `propose()` calldata carrying a
non-proposer signature slot with `v ∈ {0,1}` (or an all-zero `(r,s,v)`
in a bitmap-marked signature slot). L1 accepts this at propose time (it
only recovers the proposer's own slot) and stores the attestations hash
over the raw bytes. Afterwards, either:

- the slot recovers to the correct member, so honest nodes deem the
checkpoint valid and nobody invalidates it — but epoch proving reverts
at `ECDSA.recover` (which rejects `v ∉ {27,28}`), a silent stall; or
- the slot is detected as invalid, but the invalidation repack via
`packAttestations` is not byte-faithful, so the recomputed hash diverges
from the stored one and `InvalidateLib` reverts — wedging the chain
until prune.

This is the malicious-proposer sibling of A-1351; it survives that fix.
Tracks aztec-claude#650.

## Approach

TS-only — no L1 changes, since this targets a fresh deployment. Two
parts:

- **Detection** — `getAttestationInfoFromPayload` no longer passes
`allowYParityAsV: true`, so TS signature validity matches L1's
`ECDSA.recover`. A non-canonical slot is now classified as an invalid
attestation, so honest nodes detect the bad checkpoint instead of
silently accepting it.
- **Byte-faithful invalidation** — the raw packed
`CommitteeAttestations` tuple from the checkpoint calldata is threaded
verbatim (as `verbatimAttestations`) through the negative
`ValidateCheckpointResult` into `buildInvalidateCheckpointRequest`,
which submits those exact bytes rather than repacking. With the original
bytes, `invalidateBadAttestation` reproduces the stored hash and L1's
`tryRecover` returns `address(0) ≠ member`, so invalidation succeeds.

`verbatimAttestations` is a required field on the negative result and is
serialized unconditionally — a repack fallback is intentionally absent,
since silently repacking would re-introduce the wedge.

The gossip sender-recovery path (`recoverCoordinationSigner`)
deliberately stays lenient (`allowYParityAsV`) so an honest node can
still attribute a yParity-encoded message and canonicalize it on
ingress; only the on-chain checkpoint validation is made strict. A
comment documents the split so it is not accidentally unified.

## Tests

An e2e regression under the invalidation suite
(`invalidate_block.parallel.test.ts`, "proposer invalidates checkpoint
with a yParity attestation slot") demonstrates the attack red→green: a
malicious proposer lands a checkpoint whose non-proposer attestation
slots carry raw yParity bytes, and the honest next proposer invalidates
it — which only succeeds when the invalidation submits the verbatim
calldata bytes (a repack diverges from the on-chain `attestationsHash`
and reverts). Plus unit coverage for the strict attestation-info
classification, the byte-faithful passthrough, and the result
round-trip.

An attester-side variant (a committee member emitting yParity
attestations) is not separately tested: the honest proposer's
`orderAttestations` normalization (A-1351) canonicalizes the byte before
the L1 bundle, so it never reaches L1 and produces the same on-chain
outcome as — and is subsumed by — the malicious-proposer case above.

Fixes A-1401

Author: spalladino

yarn-project/archiver/src/l1/calldata_retriever.test.ts

@@ -505,6 +505,7 @@ describe('CalldataRetriever', () => {
             archiveRoot: Fr.random(),
             header: CheckpointHeader.random(),
             attestations: [],
+            verbatimAttestations: { signatureIndices: '0x', signaturesOrAddresses: '0x' },
             blockHash,
             feeAssetPriceModifier: 0n,
           };

yarn-project/archiver/src/l1/calldata_retriever.ts

@@ -34,6 +34,12 @@ type CheckpointData = {
   archiveRoot: Fr;
   header: CheckpointHeader;
   attestations: CommitteeAttestation[];
+  /**
+   * The exact packed `CommitteeAttestations` tuple as it appears in the propose calldata, preserved
+   * verbatim (never re-derived from {@link attestations}) so invalidation evidence stays byte-faithful to
+   * the on-chain `attestationsHash`.
+   */
+  verbatimAttestations: ViemCommitteeAttestations;
   blockHash: string;
   feeAssetPriceModifier: bigint;
 };
@@ -406,14 +412,14 @@ export class CalldataRetriever {
         return undefined;
       }
 
-      const [decodedArgs, packedAttestations] = args! as readonly [
+      const [decodedArgs, verbatimAttestations] = args! as readonly [
         { archive: Hex; oracleInput: { feeAssetPriceModifier: bigint }; header: ViemHeader },
         ViemCommitteeAttestations,
         ...unknown[],
       ];
 
       // Verify attestationsHash
-      const computedAttestationsHash = this.computeAttestationsHash(packedAttestations);
+      const computedAttestationsHash = this.computeAttestationsHash(verbatimAttestations);
       if (
         !Buffer.from(hexToBytes(computedAttestationsHash)).equals(
           Buffer.from(hexToBytes(expectedHashes.attestationsHash)),
@@ -441,15 +447,15 @@ export class CalldataRetriever {
         return undefined;
       }
 
-      const attestations = CommitteeAttestation.fromPacked(packedAttestations, this.targetCommitteeSize);
+      const attestations = CommitteeAttestation.fromPacked(verbatimAttestations, this.targetCommitteeSize);
 
       this.logger.trace(`Validated and decoded propose calldata for checkpoint ${checkpointNumber}`, {
         checkpointNumber,
         archive: decodedArgs.archive,
         header: decodedArgs.header,
         l1BlockHash: blockHash,
         attestations,
-        packedAttestations,
+        verbatimAttestations,
         targetCommitteeSize: this.targetCommitteeSize,
       });
 
@@ -458,6 +464,7 @@ export class CalldataRetriever {
         archiveRoot,
         header,
         attestations,
+        verbatimAttestations,
         blockHash,
         feeAssetPriceModifier,
       };
@@ -467,8 +474,8 @@ export class CalldataRetriever {
   }
 
   /** Computes the keccak256 hash of ABI-encoded CommitteeAttestations. */
-  private computeAttestationsHash(packedAttestations: ViemCommitteeAttestations): Hex {
-    return keccak256(encodeAbiParameters([this.getCommitteeAttestationsStructDef()], [packedAttestations]));
+  private computeAttestationsHash(verbatimAttestations: ViemCommitteeAttestations): Hex {
+    return keccak256(encodeAbiParameters([this.getCommitteeAttestationsStructDef()], [verbatimAttestations]));
   }
 
   /** Computes the keccak256 payload digest from the checkpoint header, archive root, and fee asset price modifier. */

yarn-project/archiver/src/l1/data_retrieval.ts

@@ -12,6 +12,7 @@ import type {
   InboxContract,
   MessageSentLog,
   RollupContract,
+  ViemCommitteeAttestations,
   ViemHeader,
 } from '@aztec/ethereum/contracts';
 import type { ViemPublicClient, ViemPublicDebugClient } from '@aztec/ethereum/types';
@@ -56,6 +57,11 @@ export type RetrievedCheckpointFromCalldata = RetrievedCheckpointBase & {
   blobHashes: Buffer[];
   /** Parent beacon block root from the L1 block, used for blob fetching. */
   parentBeaconBlockRoot: string | undefined;
+  /**
+   * The exact packed `CommitteeAttestations` tuple from the propose calldata, carried verbatim so that
+   * attestation validation can attach byte-faithful invalidation evidence to a negative result.
+   */
+  verbatimAttestations: ViemCommitteeAttestations;
 };
 
 export async function retrievedToPublishedCheckpoint({

yarn-project/archiver/src/modules/validation.test.ts

@@ -5,15 +5,48 @@ import { times } from '@aztec/foundation/collection';
 import { Secp256k1Signer, flipSignature } from '@aztec/foundation/crypto/secp256k1-signer';
 import { Signature } from '@aztec/foundation/eth-signature';
 import { type Logger, createLogger } from '@aztec/foundation/log';
-import { CommitteeAttestation, EthAddress } from '@aztec/stdlib/block';
-import { Checkpoint } from '@aztec/stdlib/checkpoint';
+import {
+  CommitteeAttestation,
+  CommitteeAttestationsAndSigners,
+  EthAddress,
+  type ValidateCheckpointResult,
+} from '@aztec/stdlib/block';
+import { Checkpoint, type PublishedCheckpoint } from '@aztec/stdlib/checkpoint';
+import type { L1RollupConstants } from '@aztec/stdlib/epoch-helpers';
+import { ConsensusPayload, type CoordinationSignatureContext } from '@aztec/stdlib/p2p';
 import { TEST_COORDINATION_SIGNATURE_CONTEXT } from '@aztec/stdlib/testing';
 
 import { type MockProxy, mock } from 'jest-mock-extended';
 import assert from 'node:assert';
 
 import { makeSignedPublishedCheckpoint } from '../test/mock_structs.js';
-import { getAttestationInfoFromPublishedCheckpoint, validateCheckpointAttestations } from './validation.js';
+import { getAttestationInfoFromPublishedCheckpoint, validateAttestations } from './validation.js';
+
+/**
+ * Blob-path wrapper over the shared attestation validator, used only by these tests. Production
+ * invalidation always originates from the calldata path (validateCheckpointAttestationsFromCalldata);
+ * this repacks a fully decoded checkpoint's attestations to supply the verbatimAttestations field.
+ */
+function validateCheckpointAttestations(
+  publishedCheckpoint: PublishedCheckpoint,
+  epochCache: EpochCache,
+  constants: Pick<L1RollupConstants, 'epochDuration'>,
+  signatureContext: CoordinationSignatureContext,
+  logger?: Logger,
+): Promise<ValidateCheckpointResult> {
+  const { checkpoint, attestations } = publishedCheckpoint;
+  const payload = ConsensusPayload.fromCheckpoint(checkpoint, signatureContext);
+  const verbatimAttestations = CommitteeAttestationsAndSigners.packAttestations(attestations);
+  return validateAttestations(
+    payload,
+    attestations,
+    verbatimAttestations,
+    checkpoint.toCheckpointInfo(),
+    epochCache,
+    constants,
+    logger,
+  );
+}
 
 describe('validateCheckpointAttestations', () => {
   let epochCache: MockProxy<EpochCache>;
@@ -232,6 +265,30 @@ describe('validateCheckpointAttestations', () => {
       expect(result.invalidIndex).toBe(2);
     });
 
+    it('fails if an attestation is in yParity (v in {0, 1}) form even though it recovers to the right member', async () => {
+      const checkpoint = await makeCheckpoint(signers.slice(0, 4), committee);
+
+      // Rewrite index 2's canonical signature to its yParity form: same (r, s), recovery byte 0/1. It still
+      // recovers to the same committee member off-chain, but L1 ECDSA.recover rejects v not in {27, 28}.
+      const original = checkpoint.attestations[2];
+      const yParity = new Signature(original.signature.r, original.signature.s, original.signature.v - 27);
+      checkpoint.attestations[2] = new CommitteeAttestation(original.address, yParity);
+
+      const attestations = getAttestationInfoFromPublishedCheckpoint(checkpoint, TEST_COORDINATION_SIGNATURE_CONTEXT);
+      expect(attestations[2].status).toBe('invalid-signature');
+
+      const result = await validateCheckpointAttestations(
+        checkpoint,
+        epochCache,
+        constants,
+        TEST_COORDINATION_SIGNATURE_CONTEXT,
+        logger,
+      );
+      assert(!result.valid);
+      assert(result.reason === 'invalid-attestation');
+      expect(result.invalidIndex).toBe(2);
+    });
+
     it('reports correct index when invalid attestation follows provided address', async () => {
       const checkpoint = await makeCheckpoint(signers.slice(0, 3), committee);
 

yarn-project/archiver/src/modules/validation.ts

@@ -1,4 +1,5 @@
 import type { EpochCache } from '@aztec/epoch-cache';
+import type { ViemCommitteeAttestations } from '@aztec/ethereum/contracts';
 import { type CheckpointNumber, EpochNumber } from '@aztec/foundation/branded-types';
 import { compactArray } from '@aztec/foundation/collection';
 import type { Fr } from '@aztec/foundation/curves/bn254';
@@ -29,29 +30,15 @@ export function getAttestationInfoFromPublishedCheckpoint(
   return getAttestationInfoFromPayload(payload, attestations);
 }
 
-/**
- * Validates the attestations of a checkpoint already retrieved (with its blocks) from blobs.
- * Returns true if the attestations are valid and sufficient, false otherwise.
- */
-export function validateCheckpointAttestations(
-  publishedCheckpoint: PublishedCheckpoint,
-  epochCache: EpochCache,
-  constants: Pick<L1RollupConstants, 'epochDuration'>,
-  signatureContext: CoordinationSignatureContext,
-  logger?: Logger,
-): Promise<ValidateCheckpointResult> {
-  const { checkpoint, attestations } = publishedCheckpoint;
-  const payload = ConsensusPayload.fromCheckpoint(checkpoint, signatureContext);
-  return validateAttestations(payload, attestations, checkpoint.toCheckpointInfo(), epochCache, constants, logger);
-}
-
 /** The subset of a calldata-only checkpoint needed to validate its committee attestations. */
 export type CalldataCheckpointForAttestations = {
   checkpointNumber: CheckpointNumber;
   archiveRoot: Fr;
   feeAssetPriceModifier: bigint;
   header: CheckpointHeader;
   attestations: CommitteeAttestation[];
+  /** The exact packed attestations tuple from L1 calldata, carried verbatim for byte-faithful invalidation. */
+  verbatimAttestations: ViemCommitteeAttestations;
 };
 
 /**
@@ -80,17 +67,26 @@ export function validateCheckpointAttestationsFromCalldata(
     checkpointNumber: checkpoint.checkpointNumber,
     timestamp: checkpoint.header.timestamp,
   };
-  return validateAttestations(payload, checkpoint.attestations, checkpointInfo, epochCache, constants, logger);
+  return validateAttestations(
+    payload,
+    checkpoint.attestations,
+    checkpoint.verbatimAttestations,
+    checkpointInfo,
+    epochCache,
+    constants,
+    logger,
+  );
 }
 
 /**
  * Core attestation validation over a consensus payload, its attestations, and checkpoint metadata --
  * independent of whether the checkpoint's blocks have been decoded from blobs. Returns true if the
  * attestations are valid and sufficient, false otherwise.
  */
-async function validateAttestations(
+export async function validateAttestations(
   payload: ConsensusPayload,
   attestations: CommitteeAttestation[],
+  verbatimAttestations: ViemCommitteeAttestations,
   checkpointInfo: CheckpointInfo,
   epochCache: EpochCache,
   constants: Pick<L1RollupConstants, 'epochDuration'>,
@@ -137,6 +133,7 @@ async function validateAttestations(
     epoch,
     attestors,
     attestations,
+    verbatimAttestations,
   });
 
   for (let i = 0; i < attestorInfos.length; i++) {

yarn-project/archiver/src/store/block_store.test.ts

@@ -1989,6 +1989,7 @@ describe('BlockStore', () => {
         seed: 456n,
         attestors: [EthAddress.random()],
         attestations: [CommitteeAttestation.random()],
+        verbatimAttestations: { signatureIndices: '0x', signaturesOrAddresses: '0x' },
         reason: 'insufficient-attestations',
       };
 
@@ -2007,6 +2008,7 @@ describe('BlockStore', () => {
         epoch: EpochNumber(789),
         seed: 101n,
         attestations: [CommitteeAttestation.random()],
+        verbatimAttestations: { signatureIndices: '0x', signaturesOrAddresses: '0x' },
         reason: 'invalid-attestation',
         invalidIndex: 5,
       };
@@ -2027,6 +2029,7 @@ describe('BlockStore', () => {
         seed: 888n,
         attestors: [EthAddress.random()],
         attestations: [CommitteeAttestation.random()],
+        verbatimAttestations: { signatureIndices: '0x', signaturesOrAddresses: '0x' },
         reason: 'insufficient-attestations',
       };
 
@@ -2046,6 +2049,7 @@ describe('BlockStore', () => {
         seed: 0n,
         attestors: [],
         attestations: [],
+        verbatimAttestations: { signatureIndices: '0x', signaturesOrAddresses: '0x' },
         reason: 'insufficient-attestations',
       };
 

yarn-project/archiver/src/test/fake_l1_state.ts

@@ -682,7 +682,7 @@ export class FakeL1State {
       getHashedSignaturePayloadTypedData(attestationsAndSigners),
     );
 
-    const packedAttestations = attestationsAndSigners.getPackedAttestations();
+    const verbatimAttestations = attestationsAndSigners.getPackedAttestations();
 
     const rollupInput = encodeFunctionData({
       abi: RollupAbi,
@@ -693,7 +693,7 @@ export class FakeL1State {
           archive,
           oracleInput: { feeAssetPriceModifier: 0n },
         },
-        packedAttestations,
+        verbatimAttestations,
         attestationsAndSigners.getSigners().map(signer => signer.toString()),
         attestationsAndSignersSignature.toViemSignature(),
         blobInput,
@@ -716,7 +716,7 @@ export class FakeL1State {
 
     // Compute attestationsHash (same logic as CalldataRetriever)
     const attestationsHash = Buffer32.fromString(
-      keccak256(encodeAbiParameters([this.getCommitteeAttestationsStructDef()], [packedAttestations])),
+      keccak256(encodeAbiParameters([this.getCommitteeAttestationsStructDef()], [verbatimAttestations])),
     );
 
     // Compute payloadDigest (same logic as CalldataRetriever)

yarn-project/aztec-node/src/aztec-node/node_public_calls_simulator.test.ts

@@ -452,6 +452,7 @@ function makeInvalidStatus(firstInvalid: CheckpointNumber): ValidateCheckpointRe
     seed: 0n,
     attestors: [],
     attestations: [],
+    verbatimAttestations: { signatureIndices: '0x', signaturesOrAddresses: '0x' },
     reason: 'insufficient-attestations',
   };
 }

yarn-project/end-to-end/src/multi-node/invalid-attestations/invalidate_block.parallel.test.ts

@@ -818,6 +818,19 @@ describe('multi-node/invalid-attestations/invalidate_block', () => {
     });
   });
 
+  // Injects every non-proposer attestation slot in yParity (v ∈ {0, 1}) form in the packed L1 tuple. L1
+  // accepts it at propose() (attestation signatures are not verified there), but the checkpoint can never be
+  // proven (ValidatorSelectionLib.verifyAttestations → ECDSA.recover rejects v ∉ {27, 28}). A repack of the
+  // invalidation evidence would canonicalize the bytes back to 27/28 and diverge from the on-chain
+  // attestationsHash, reverting the invalidation. Verifies an honest proposer detects the bad checkpoint and
+  // invalidates it byte-faithfully from the raw calldata. Regression for A-1401.
+  it('proposer invalidates checkpoint with a yParity attestation slot', async () => {
+    await runInvalidationTest({
+      attackConfig: { injectYParityAttestation: true },
+      disableConfig: { injectYParityAttestation: false },
+    });
+  });
+
   // Injects shuffled attestation ordering (accepted offchain but rejected by L1 which requires the
   // committee order). Waits for the bad checkpoint then verifies a good proposer invalidates it.
   // Regression for the node accepting attestations that did not conform to the committee order,

yarn-project/sequencer-client/src/config.ts

@@ -62,6 +62,7 @@ export const DefaultSequencerConfig = {
   injectFakeAttestation: false,
   injectHighSValueAttestation: false,
   injectUnrecoverableSignatureAttestation: false,
+  injectYParityAttestation: false,
   fishermanMode: false,
   shuffleAttestationOrdering: false,
   skipPushProposedBlocksToArchiver: false,
@@ -225,6 +226,10 @@ export const sequencerConfigMappings: ConfigMappingsType<SequencerConfig> = {
     description: 'Inject an attestation with an unrecoverable signature (for testing only)',
     ...booleanConfigHelper(DefaultSequencerConfig.injectUnrecoverableSignatureAttestation),
   },
+  injectYParityAttestation: {
+    description: 'Inject a non-proposer attestation slot in yParity form in the packed L1 tuple (for testing only)',
+    ...booleanConfigHelper(DefaultSequencerConfig.injectYParityAttestation),
+  },
   fishermanMode: {
     env: 'FISHERMAN_MODE',
     description: