Merge branch 'v5-next' into merge-train/spartan-v5

Author: AztecBot

docs/docs-developers/docs/foundational-topics/pxe/execution_hooks.md

@@ -82,14 +82,23 @@ For an unconstrained self-send (the recipient is one of the wallet's own account
 
 ### In Noir tests
 
-When testing in Noir, leaving the strategy unset makes `TestEnvironment` fall back to the bare PXE default. Set a strategy when creating the environment to exercise a specific one; it affects message delivery in private executions:
+When testing in Noir, leaving the strategy unset makes `TestEnvironment` fall back to the bare PXE default. Set a strategy
+when creating the environment to exercise a specific one; it affects message delivery in private executions that use the
+default wallet strategy hook. Use `with_default_tag_secret_strategy` to configure the strategy for a specific delivery
+mode:
 
 ```rust
 let env = TestEnvironment::new_opts(
-    TestEnvironmentOptions::new().with_tagging_secret_strategy(TaggingSecretStrategy::non_interactive_handshake()),
+    TestEnvironmentOptions::new().with_default_tag_secret_strategy(
+        MessageDelivery::onchain_unconstrained(),
+        TaggingSecretStrategy::non_interactive_handshake(),
+    ),
 );
 ```
 
+Use `with_default_tag_secret_strategy_all_modes` only when the same strategy should apply to both constrained and
+unconstrained delivery. Contract-fixed delivery derivations bypass this default strategy.
+
 ### In production
 
 Pass a `resolveTaggingSecretStrategy` hook when [creating the PXE](#configuring-hooks). It receives a `TaggingSecretStrategyRequest` with the executing contract's address and the message's sender, recipient, and delivery mode (`'constrained'` or `'unconstrained'`), so a wallet can apply per-application or per-recipient policies, or surface the decision to the user, instead of returning a fixed value.

docs/docs-developers/docs/resources/migration_notes.md

@@ -9,6 +9,48 @@ Aztec is in active development. Each version may introduce breaking changes that
 
 ## TBD
 
+### [Aztec.nr] `TestEnvironmentOptions::with_tagging_secret_strategy` replaced
+
+`TestEnvironmentOptions::with_tagging_secret_strategy` is now `with_default_tag_secret_strategy_all_modes` for tests
+that want the same default wallet strategy for both onchain delivery modes. The new naming reflects that these helpers
+configure the TXE default wallet strategy hook; contract-fixed delivery derivations bypass that default.
+
+For mode-specific defaults and hook semantics, see the
+[`resolveTaggingSecretStrategy` test helper docs](../foundational-topics/pxe/execution_hooks.md#resolvetaggingsecretstrategy).
+
+### [Aztec.nr] L1-to-L2 message consumption takes the secret as an array
+
+`PrivateContext::consume_l1_to_l2_message` and `PublicContext::consume_l1_to_l2_message` now take the message secret as an arbitrary-length array `[Field; N]` instead of a single `Field`, so a consumer can derive its secret hash from more than one field. The helpers `compute_secret_hash` and `compute_l1_to_l2_message_nullifier` are likewise now generic over the secret length. A single-field secret behaves exactly as before (the hashes are unchanged for `N = 1`) — just wrap it in an array.
+
+**Migration:**
+
+```diff
+- context.consume_l1_to_l2_message(content, secret, sender, leaf_index);
++ context.consume_l1_to_l2_message(content, [secret], sender, leaf_index);
+```
+
+```diff
+- let secret_hash = compute_secret_hash(secret);
++ let secret_hash = compute_secret_hash([secret]);
+```
+
+**Impact**: Contracts that consume L1-to-L2 messages, or that call `compute_secret_hash` / `compute_l1_to_l2_message_nullifier`, must wrap their single-field secret in an array. Already-deployed contracts are unaffected: their unchanged bytecode keeps working, as PXE serves the previous L1-to-L2 membership-witness oracle through a compatibility adaptor.
+
+### [Aztec.js] `computeL1ToL2MessageNullifier` replaced by `computeFeeJuiceMessageNullifier`
+
+The `@aztec/stdlib` helper `computeL1ToL2MessageNullifier(contract, messageHash, secret)`, which returned the siloed message nullifier, has been removed. Its replacement `computeFeeJuiceMessageNullifier(messageHash, secret)` returns the **unsiloed** nullifier — siloing now happens at the point where the nullifier is looked up. `getL1ToL2MessageWitness` accordingly takes an optional `{ contractAddress, nullifier }` (unsiloed) and silos internally. `computeSecretHash` is unchanged, and `getNonNullifiedL1ToL2MessageWitness` keeps the same signature.
+
+**Migration:**
+
+```diff
+- const nullifier = await computeL1ToL2MessageNullifier(contract, messageHash, secret);
++ // computeFeeJuiceMessageNullifier returns the UNSILOED nullifier; silo it before looking it up, or hand the
++ // unsiloed value to getL1ToL2MessageWitness which silos for you.
++ const nullifier = await siloNullifier(contract, await computeFeeJuiceMessageNullifier(messageHash, secret));
+```
+
+**Impact**: Only affects code calling these low-level messaging helpers directly - most integrations use `getNonNullifiedL1ToL2MessageWitness`, which is unchanged.
+
 ### [Aztec.js] Account signing keys are no longer derived from the privacy secret
 
 Schnorr account signing keys used to be derived from the account's privacy secret (via the now-removed `deriveSigningKey`), which meant the ownership key could be reconstructed from a value the PXE holds. The relationship is now reversed: the signing key is the root, and the privacy secret is derived from it with `deriveSecretKeyFromSigningKey` (exported from `@aztec/accounts/utils`).

docs/examples/contracts/aave_bridge/src/main.nr

@@ -50,7 +50,7 @@ pub contract AaveBridge {
         // Consume message and emit nullifier
         self.context.consume_l1_to_l2_message(
             content_hash,
-            secret,
+            [secret],
             config.portal,
             message_leaf_index,
         );
@@ -76,7 +76,7 @@ pub contract AaveBridge {
         let content_hash = get_mint_to_private_content_hash(amount);
         self.context.consume_l1_to_l2_message(
             content_hash,
-            secret_for_L1_to_L2_message_consumption,
+            [secret_for_L1_to_L2_message_consumption],
             config.portal,
             message_leaf_index,
         );

docs/examples/contracts/nft_bridge/src/main.nr

@@ -38,7 +38,7 @@ pub contract NFTBridge {
         // Consume the L1 -> L2 message
         self.context.consume_l1_to_l2_message(
             content_hash,
-            secret,
+            [secret],
             self.storage.portal.read(),
             message_leaf_index,
         );

noir-projects/aztec-nr/aztec/src/context/private_context.nr

@@ -868,14 +868,20 @@ impl PrivateContext {
     ///
     /// # Arguments
     /// * `content` - The message content that was sent from L1
-    /// * `secret` - Secret value used for message privacy (if needed)
+    /// * `secret` - Secret fields used for message privacy (if needed)
     /// * `sender` - Ethereum address that sent the message
     /// * `leaf_index` - Index of the message in the L1-to-L2 message tree
     ///
     /// # Advanced
     /// Validates message existence in the L1-to-L2 message tree and nullifies the message to prevent
     /// double-consumption.
-    pub fn consume_l1_to_l2_message(&mut self, content: Field, secret: Field, sender: EthAddress, leaf_index: Field) {
+    pub fn consume_l1_to_l2_message<let N: u32>(
+        &mut self,
+        content: Field,
+        secret: [Field; N],
+        sender: EthAddress,
+        leaf_index: Field,
+    ) {
         let nullifier = process_l1_to_l2_message(
             self.anchor_block_header.state.l1_to_l2_message_tree.root,
             self.this_address(),

noir-projects/aztec-nr/aztec/src/context/public_context.nr

@@ -226,7 +226,7 @@ impl PublicContext {
     ///
     /// # Arguments
     /// * `content` - The message content that was sent from L1
-    /// * `secret` - Secret value used for message privacy (if needed)
+    /// * `secret` - Secret fields used for message privacy (if needed)
     /// * `sender` - Ethereum address that sent the message
     /// * `leaf_index` - Index of the message in the L1-to-L2 message tree
     ///
@@ -236,7 +236,13 @@ impl PublicContext {
     /// * Message hash is computed from all parameters + chain context
     /// * Will revert if message doesn't exist or was already consumed
     ///
-    pub fn consume_l1_to_l2_message(self: Self, content: Field, secret: Field, sender: EthAddress, leaf_index: Field) {
+    pub fn consume_l1_to_l2_message<let N: u32>(
+        self: Self,
+        content: Field,
+        secret: [Field; N],
+        sender: EthAddress,
+        leaf_index: Field,
+    ) {
         let secret_hash = compute_secret_hash(secret);
         let message_hash = compute_l1_to_l2_message_hash(
             sender,

noir-projects/aztec-nr/aztec/src/hash.nr

@@ -12,8 +12,8 @@ use crate::protocol::{
 
 pub use crate::protocol::hash::compute_siloed_nullifier;
 
-pub fn compute_secret_hash(secret: Field) -> Field {
-    poseidon2_hash_with_separator([secret], DOM_SEP__SECRET_HASH)
+pub fn compute_secret_hash<let N: u32>(secret: [Field; N]) -> Field {
+    poseidon2_hash_with_separator(secret, DOM_SEP__SECRET_HASH)
 }
 
 pub fn compute_l1_to_l2_message_hash(
@@ -47,9 +47,9 @@ pub fn compute_l1_to_l2_message_hash(
     sha256_to_field(hash_bytes)
 }
 
-// The nullifier of a l1 to l2 message is the hash of the message salted with the secret
-pub fn compute_l1_to_l2_message_nullifier(message_hash: Field, secret: Field) -> Field {
-    poseidon2_hash_with_separator([message_hash, secret], DOM_SEP__MESSAGE_NULLIFIER)
+// The nullifier of an l1 to l2 message is the hash of the message salted with the secret.
+pub fn compute_l1_to_l2_message_nullifier<let N: u32>(message_hash: Field, secret: [Field; N]) -> Field {
+    poseidon2_hash_with_separator([message_hash].concat(secret), DOM_SEP__MESSAGE_NULLIFIER)
 }
 
 // Computes the hash of input arguments or return values for private functions, or for authwit creation.
@@ -96,7 +96,7 @@ pub fn compute_public_bytecode_commitment(
 #[test]
 unconstrained fn secret_hash_matches_typescript() {
     let secret = 8;
-    let hash = compute_secret_hash(secret);
+    let hash = compute_secret_hash([secret]);
 
     // The following value was generated by `yarn-project/stdlib/src/hash/hash.test.ts`
     let secret_hash_from_ts = 0x1848b066724ab0ffb50ecb0ee3398eb839f162823d262bad959721a9c13d1e96;

noir-projects/aztec-nr/aztec/src/messages/delivery/tag.nr

@@ -180,6 +180,29 @@ mod test {
         });
     }
 
+    #[test(should_fail_with = "an unconstrained tagging secret cannot back constrained delivery")]
+    unconstrained fn constrained_delivery_rejects_a_resolved_unconstrained_secret() {
+        let env = TestEnvironment::new();
+        let secret: Field = 7;
+        let index: u32 = 0;
+
+        env.private_context(|context| {
+            mock_existing_handshake_secrets(Option::none());
+            let _ = OracleMock::mock("aztec_prv_resolveTaggingStrategy").returns(
+                ResolvedTaggingStrategy::unconstrained_secret(secret),
+            );
+            let _ = OracleMock::mock("aztec_prv_getNextTaggingIndex").returns(index);
+
+            let _ = derive_log_tag(
+                context,
+                OnchainDeliveryMode::onchain_constrained(),
+                SENDER,
+                RECIPIENT,
+                Option::none(),
+            );
+        });
+    }
+
     #[test]
     unconstrained fn constrained_delivery_emits_the_sequence_nullifier_and_constrained_tag() {
         let env = TestEnvironment::new();

noir-projects/aztec-nr/aztec/src/messaging.nr

@@ -1,18 +1,18 @@
 use crate::{
     hash::{compute_l1_to_l2_message_hash, compute_l1_to_l2_message_nullifier, compute_secret_hash},
-    oracle::get_l1_to_l2_membership_witness::get_l1_to_l2_membership_witness,
+    oracle::get_l1_to_l2_membership_witness::{get_l1_to_l2_membership_witness, UnsiloedNullifier},
 };
 
 use crate::protocol::{address::{AztecAddress, EthAddress}, merkle_tree::root::root_from_sibling_path};
 
-pub fn process_l1_to_l2_message(
+pub fn process_l1_to_l2_message<let N: u32>(
     l1_to_l2_root: Field,
     contract_address: AztecAddress,
     portal_contract_address: EthAddress,
     chain_id: Field,
     version: Field,
     content: Field,
-    secret: Field,
+    secret: [Field; N],
     leaf_index: Field,
 ) -> Field {
     let secret_hash = compute_secret_hash(secret);
@@ -26,14 +26,20 @@ pub fn process_l1_to_l2_message(
         leaf_index,
     );
 
+    let nullifier = compute_l1_to_l2_message_nullifier(message_hash, secret);
+
     // We prove that `message_hash` is in the tree by showing the derivation of the tree root, using a merkle path we
     // get from an oracle.
     // Safety: The witness is only used as a "magical value" that makes the merkle proof below pass. Hence it's safe.
-    let (_leaf_index, sibling_path) =
-        unsafe { get_l1_to_l2_membership_witness(contract_address, message_hash, secret) };
+    let (_leaf_index, sibling_path) = unsafe {
+        get_l1_to_l2_membership_witness(
+            message_hash,
+            Option::some(UnsiloedNullifier { contract_address, nullifier }),
+        )
+    };
 
     let root = root_from_sibling_path(message_hash, leaf_index, sibling_path);
     assert_eq(root, l1_to_l2_root, "Message not in state");
 
-    compute_l1_to_l2_message_nullifier(message_hash, secret)
+    nullifier
 }

noir-projects/aztec-nr/aztec/src/oracle/get_l1_to_l2_membership_witness.nr

@@ -1,19 +1,27 @@
 use crate::protocol::{address::AztecAddress, constants::L1_TO_L2_MSG_TREE_HEIGHT};
 
+/// An unsiloed L1 to L2 message nullifier.
+pub struct UnsiloedNullifier {
+    pub contract_address: AztecAddress,
+    pub nullifier: Field,
+}
+
 /// Returns the leaf index and sibling path of an entry in the L1 to L2 messaging tree, which can then be used to prove
 /// its existence.
+///
+/// When `nullifier` is `Some`, the returned witness is guaranteed to be for a message that has not yet been consumed:
+/// PXE checks it is not present in the nullifier tree. Pass `None` to retrieve the witness regardless of whether the
+/// message has been consumed.
 pub unconstrained fn get_l1_to_l2_membership_witness(
-    contract_address: AztecAddress,
     message_hash: Field,
-    secret: Field,
+    nullifier: Option<UnsiloedNullifier>,
 ) -> (Field, [Field; L1_TO_L2_MSG_TREE_HEIGHT]) {
-    get_l1_to_l2_membership_witness_oracle(contract_address, message_hash, secret)
+    get_l1_to_l2_membership_witness_oracle(message_hash, nullifier)
 }
 
 // Obtains membership witness (index and sibling path) for a message in the L1 to L2 message tree.
-#[oracle(aztec_utl_getL1ToL2MembershipWitness)]
+#[oracle(aztec_utl_getL1ToL2MembershipWitnessV2)]
 unconstrained fn get_l1_to_l2_membership_witness_oracle(
-    _contract_address: AztecAddress,
     _message_hash: Field,
-    _secret: Field,
+    _nullifier: Option<UnsiloedNullifier>,
 ) -> (Field, [Field; L1_TO_L2_MSG_TREE_HEIGHT]) {}