refactor: add in-memory MemoryMerkleDB and drop world_state from vm2

Adds a self-contained in-memory MemoryMerkleDB (LowLevelMerkleDBInterface) and
migrates vm2 simulation, the public-tx test tester, and the AVM fuzzer's
FuzzerWorldStateManager off the on-disk world_state onto it (prod continues to
use the WSDB-IPC-backed DB). This leaves the AVM fuzzer + vm2 test paths free of
world_state, which the native-packages extraction depends on.

Author: charlielye

barretenberg/cpp/src/barretenberg/avm_fuzzer/common/interfaces/dbs.cpp

@@ -14,7 +14,6 @@
 
 using namespace bb::avm2::simulation;
 using Poseidon2 = bb::crypto::Poseidon2<bb::crypto::Poseidon2Bn254ScalarFieldParams>;
-using namespace bb::world_state;
 
 namespace bb::avm2::fuzzer {
 
@@ -185,50 +184,23 @@ FuzzerWorldStateManager* FuzzerWorldStateManager::instance = nullptr;
 
 void FuzzerWorldStateManager::initialize_world_state()
 {
-    std::unordered_map<simulation::MerkleTreeId, uint32_t> tree_heights{
-        { simulation::MerkleTreeId::NULLIFIER_TREE, NULLIFIER_TREE_HEIGHT },
-        { simulation::MerkleTreeId::NOTE_HASH_TREE, NOTE_HASH_TREE_HEIGHT },
-        { simulation::MerkleTreeId::PUBLIC_DATA_TREE, PUBLIC_DATA_TREE_HEIGHT },
-        { simulation::MerkleTreeId::L1_TO_L2_MESSAGE_TREE, L1_TO_L2_MSG_TREE_HEIGHT },
-        { simulation::MerkleTreeId::ARCHIVE, ARCHIVE_HEIGHT },
-    };
-    std::unordered_map<simulation::MerkleTreeId, index_t> tree_prefill{
-        { simulation::MerkleTreeId::NULLIFIER_TREE, 128 },
-        { simulation::MerkleTreeId::PUBLIC_DATA_TREE, 128 },
-    };
-    uint32_t initial_header_generator_point = 2064783670; // DomainSeparator.BLOCK_HEADER_HASH
-    ws = std::make_unique<world_state::WorldState>(
-        /*thread_pool_size=*/4, DATA_DIR, MAP_SIZE_KB, tree_heights, tree_prefill, initial_header_generator_point);
-
-    fork_ids.push(ws->create_fork(std::nullopt));
+    mem_db = std::make_unique<simulation::MemoryMerkleDB>(
+        /*nullifier_tree_prefill=*/128, /*public_data_tree_prefill=*/128);
 }
 
-WorldStateRevision FuzzerWorldStateManager::get_current_revision() const
+void FuzzerWorldStateManager::reseed_to_genesis()
 {
-    return WorldStateRevision{ .forkId = fork_ids.top(), .includeUncommitted = true };
+    // Called once per transaction, before applying that transaction's genesis state, so each input starts
+    // from the same state.
+    initialize_world_state();
 }
 
-WorldStateRevision FuzzerWorldStateManager::fork()
-{
-    auto fork_id = ws->create_fork(std::nullopt);
-    fork_ids.push(fork_id);
-    return WorldStateRevision{ .forkId = fork_id, .includeUncommitted = true };
-}
-void FuzzerWorldStateManager::reset_world_state()
-{
-    // We keep the initial fork, so pop until only one remains
-    while (fork_ids.size() != 1) {
-        ws->delete_fork(fork_ids.top());
-        fork_ids.pop();
-    }
-}
 void FuzzerWorldStateManager::register_contract_address(const AztecAddress& contract_address)
 {
     NullifierLeafValue contract_nullifier =
         unconstrained_silo_nullifier(CONTRACT_INSTANCE_REGISTRY_CONTRACT_ADDRESS, contract_address);
     fuzz_info("Registering contract address in world state: ", contract_nullifier.nullifier);
-    auto fork_id = fork_ids.top();
-    ws->insert_indexed_leaves<NullifierLeafValue>(MerkleTreeId::NULLIFIER_TREE, { contract_nullifier }, fork_id);
+    mem_db->insert_indexed_leaves_nullifier_tree(contract_nullifier);
 }
 
 void FuzzerWorldStateManager::write_fee_payer_balance(const AztecAddress& fee_payer, const FF& balance)
@@ -240,25 +212,20 @@ void FuzzerWorldStateManager::write_fee_payer_balance(const AztecAddress& fee_pa
         Poseidon2::hash({ DOM_SEP__PUBLIC_STORAGE_MAP_SLOT, FEE_JUICE_BALANCES_SLOT, fee_payer });
     FF leaf_slot = Poseidon2::hash({ DOM_SEP__PUBLIC_LEAF_SLOT, FF(FEE_JUICE_ADDRESS), fee_juice_balance_slot });
 
-    // Write to public data tree using current fork
-    auto fork_id = fork_ids.top();
-    ws->update_public_data(PublicDataLeafValue(leaf_slot, balance), fork_id);
+    mem_db->insert_indexed_leaves_public_data_tree(PublicDataLeafValue(leaf_slot, balance));
 }
 
 void FuzzerWorldStateManager::public_data_write(const bb::crypto::merkle_tree::PublicDataLeafValue& public_data)
 {
-    auto fork_id = fork_ids.top();
-    ws->update_public_data(public_data, fork_id);
+    mem_db->insert_indexed_leaves_public_data_tree(public_data);
 }
 
 void FuzzerWorldStateManager::append_note_hashes(const std::vector<FF>& note_hashes)
 {
-    auto fork_id = fork_ids.top();
-
     uint64_t padding_leaves = MAX_NOTE_HASHES_PER_TX - (note_hashes.size() % MAX_NOTE_HASHES_PER_TX);
 
-    ws->append_leaves(MerkleTreeId::NOTE_HASH_TREE, note_hashes, fork_id);
-    ws->append_leaves(MerkleTreeId::NOTE_HASH_TREE, std::vector<FF>(padding_leaves, FF(0)), fork_id);
+    mem_db->append_leaves(simulation::MerkleTreeId::NOTE_HASH_TREE, note_hashes);
+    mem_db->append_leaves(simulation::MerkleTreeId::NOTE_HASH_TREE, std::vector<FF>(padding_leaves, FF(0)));
 }
 
 } // namespace bb::avm2::fuzzer

barretenberg/cpp/src/barretenberg/avm_fuzzer/common/interfaces/dbs.hpp

@@ -3,10 +3,10 @@
 #include <memory>
 #include <stack>
 
+#include "barretenberg/crypto/merkle_tree/indexed_tree/indexed_leaf.hpp"
 #include "barretenberg/vm2/common/aztec_types.hpp"
 #include "barretenberg/vm2/simulation/interfaces/db.hpp"
-#include "barretenberg/world_state/types.hpp"
-#include "barretenberg/world_state/world_state.hpp"
+#include "barretenberg/vm2/simulation/lib/memory_merkle_db.hpp"
 
 namespace bb::avm2::fuzzer {
 
@@ -55,20 +55,13 @@ class FuzzerContractDB : public simulation::ContractDBInterface {
     std::stack<Checkpoint> checkpoints;
 };
 
-// Set up and manage a world state for the fuzzer, the plan is to use this to set up different world states
-// This is a bit of hack since we need to access the world state in both cpp and ts. Normally, ws is instantiated
-// inside ts and we use napi to access it from cpp, but for the fuzzer we want to instantiate it in cpp and access it
-// from ts. The simplest way is to use the same database files from both cpp and ts, this is fine for now since we know
-// only one thing will be writing to it at a time.
-// FIXME(ilyas): This won't work with multiple concurrent fuzzing processes, but that's ok for now.
+// Seeds and manages the genesis state the fuzzer simulates against. The C++ simulator runs against a copy
+// of the in-memory MemoryMerkleDB seeded here, so the seed is never mutated by simulation. The genesis
+// uses a fixed 128 nullifier/public-data tree prefill so every input starts from the same state, with no
+// shared on-disk database.
 class FuzzerWorldStateManager {
   public:
-    // Shared constants for C++ and TypeScript to use the same database
-    // Note: TypeScript expects trees in {DATA_DIR}/world_state/, so we include that subdirectory
-    static constexpr const char* DATA_DIR = "/tmp/avm_fuzzer_ws/world_state";
-    static constexpr uint64_t MAP_SIZE_KB = 10240; // 10 MB
-
-    // Static singleton instance management
+    // Static instance management (similar to JsSimulator pattern)
     static void initialize()
     {
         if (instance == nullptr) {
@@ -85,33 +78,26 @@ class FuzzerWorldStateManager {
         return instance;
     }
 
-    void reset_world_state();
     void register_contract_address(const AztecAddress& contract_address);
     void write_fee_payer_balance(const AztecAddress& fee_payer, const FF& balance);
     void public_data_write(const bb::crypto::merkle_tree::PublicDataLeafValue& public_data);
     void append_note_hashes(const std::vector<FF>& note_hashes);
 
-    world_state::WorldStateRevision get_current_revision() const;
-    world_state::WorldStateRevision fork();
-    world_state::WorldState& get_world_state() { return *ws; }
-
-    void checkpoint() { ws->checkpoint(fork_ids.top()); }
-
-    void commit() { ws->commit_checkpoint(fork_ids.top()); }
-
-    void revert() { ws->revert_checkpoint(fork_ids.top()); }
-
-    static const char* get_data_dir() { return DATA_DIR; }
+    // Re-seeds the in-memory merkle DB to a fresh genesis. The fuzzer calls this once per transaction
+    // (before applying that transaction's genesis state) so each input starts from the same state.
+    void reseed_to_genesis();
 
-    static uint64_t get_map_size_kb() { return MAP_SIZE_KB; }
+    // The in-memory merkle DB holds the genesis state plus every mutation applied for the current
+    // transaction. The C++ simulator runs against a copy of this DB so the genesis state is preserved
+    // across the fast and hint-collecting simulations.
+    const simulation::MemoryMerkleDB& get_memory_merkle_db() const { return *mem_db; }
 
   private:
     static FuzzerWorldStateManager* instance;
 
     void initialize_world_state();
 
-    std::unique_ptr<world_state::WorldState> ws;
-    std::stack<uint64_t> fork_ids;
+    std::unique_ptr<simulation::MemoryMerkleDB> mem_db;
 };
 
 } // namespace bb::avm2::fuzzer

barretenberg/cpp/src/barretenberg/avm_fuzzer/fuzz_lib/fuzz.test.cpp

@@ -34,13 +34,11 @@ class FuzzTest : public ::testing::Test {
         if (ws_mgr == nullptr) {
             ws_mgr = FuzzerWorldStateManager::getInstance();
         }
-        ws_mgr->fork();
+        ws_mgr->reseed_to_genesis();
         context = FuzzerContext();
         register_functions(context);
     }
 
-    void TearDown() override { ws_mgr->reset_world_state(); }
-
     SimulatorResult simulate_with_default_tx(std::vector<uint8_t>& bytecode, std::vector<FF> calldata)
     {
         return simulate_with_default_tx(bytecode, calldata, {});
@@ -50,8 +48,6 @@ class FuzzTest : public ::testing::Test {
                                              std::vector<FF> calldata,
                                              const std::vector<FF>& note_hashes)
     {
-        ws_mgr->checkpoint();
-
         ws_mgr->append_note_hashes(note_hashes);
 
         auto contract_address = context.register_contract_from_bytecode(bytecode);
@@ -72,8 +68,6 @@ class FuzzTest : public ::testing::Test {
                                              /*note_hashes=*/{},
                                              /*protocol_contracts=*/{});
 
-        ws_mgr->revert();
-
         return result;
     }
 

barretenberg/cpp/src/barretenberg/avm_fuzzer/fuzz_lib/simulator.cpp

@@ -1,4 +1,5 @@
 #include "barretenberg/avm_fuzzer/fuzz_lib/simulator.hpp"
+#include <thread>
 
 #include <cstdint>
 #include <vector>
@@ -16,14 +17,11 @@
 #include "barretenberg/vm2/simulation/lib/contract_crypto.hpp"
 #include "barretenberg/vm2/simulation/lib/serialization.hpp"
 #include "barretenberg/vm2/simulation_helper.hpp"
-#include "barretenberg/world_state/types.hpp"
-#include "barretenberg/world_state/world_state.hpp"
 
 using bb::avm2::GlobalVariables;
 using namespace bb::avm2;
 using namespace bb::avm2::simulation;
 using namespace bb::avm2::fuzzer;
-using namespace bb::world_state;
 
 constexpr auto MAX_RETURN_DATA_SIZE_IN_FIELDS = 1024;
 
@@ -62,12 +60,12 @@ SimulatorResult CppSimulator::simulate(
         },
     };
 
-    WorldState& ws = ws_mgr.get_world_state();
-    WorldStateRevision ws_rev = ws_mgr.get_current_revision();
-
+    // Run against a fresh copy of the genesis-seeded in-memory merkle DB so the simulation's tree
+    // mutations don't leak into later simulations of the same transaction.
+    simulation::MemoryMerkleDB merkle_db = ws_mgr.get_memory_merkle_db();
     AvmSimulationHelper helper;
     TxSimulationResult result =
-        helper.simulate_fast_with_existing_ws(contract_db, ws_rev, ws, config, tx, globals, protocol_contracts);
+        helper.simulate_fast_internal(contract_db, merkle_db, config, tx, globals, protocol_contracts);
     bool reverted = result.revert_code != RevertCode::OK;
     // Just process the top level call's output
     vinfo(

barretenberg/cpp/src/barretenberg/avm_fuzzer/fuzzer_lib.cpp

@@ -1,4 +1,5 @@
 #include "barretenberg/avm_fuzzer/fuzzer_lib.hpp"
+#include "barretenberg/serialize/msgpack_impl.hpp"
 
 #include <cstdint>
 #include <string>
@@ -26,9 +27,9 @@
 #include "barretenberg/vm2/tooling/stats.hpp"
 #include "barretenberg/vm2/tracegen_helper.hpp"
 
+using namespace bb;
 using namespace bb::avm2::fuzzer;
 using namespace bb::avm2::simulation;
-using namespace bb::world_state;
 
 extern size_t LLVMFuzzerMutate(uint8_t* Data, size_t Size, size_t MaxSize);
 
@@ -104,7 +105,6 @@ SimulatorResult fuzz_tx(FuzzerWorldStateManager& ws_mgr, FuzzerContractDB& contr
     SimulatorResult cpp_result;
 
     try {
-        ws_mgr.checkpoint();
         cpp_result = cpp_simulator.simulate(ws_mgr,
                                             contract_db,
                                             tx_data.tx,
@@ -114,7 +114,6 @@ SimulatorResult fuzz_tx(FuzzerWorldStateManager& ws_mgr, FuzzerContractDB& contr
                                             tx_data.protocol_contracts);
         fuzz_info("CppSimulator completed without exception");
         fuzz_info("CppSimulator result: ", cpp_result);
-        ws_mgr.revert();
     } catch (const std::exception& e) {
         fuzz_info("CppSimulator threw an exception: ", e.what());
         cpp_result = SimulatorResult{
@@ -123,23 +122,20 @@ SimulatorResult fuzz_tx(FuzzerWorldStateManager& ws_mgr, FuzzerContractDB& contr
             .end_tree_snapshots = TreeSnapshots(),
             .revert_reason = e.what(),
         };
-        ws_mgr.revert();
     }
 
     return cpp_result;
 }
 
 /// @brief Run the prover fuzzer: fast simulation, hint collection, comparison, and check_circuit
-/// @param ws_mgr The world state manager (should already be forked)
+/// @param ws_mgr The world state manager (should already be reseeded to genesis)
 /// @param contract_db The contract database
 /// @param tx_data The transaction data
 /// @returns the simulation result
 /// @throws An exception if simulation results differ or check_circuit fails
 TxSimulationResult fuzz_prover(FuzzerWorldStateManager& ws_mgr, FuzzerContractDB& contract_db, FuzzerTxData& tx_data)
 {
     ProtocolContracts& protocol_contracts = tx_data.protocol_contracts;
-    WorldState& ws = ws_mgr.get_world_state();
-    WorldStateRevision ws_rev = ws_mgr.get_current_revision();
     AvmSimulationHelper helper;
 
     // Reset stats for this iteration
@@ -158,29 +154,32 @@ TxSimulationResult fuzz_prover(FuzzerWorldStateManager& ws_mgr, FuzzerContractDB
         .collect_public_inputs = true,
     };
 
-    // 1. Run simulate_fast_with_existing_ws
-    // It is the only one that may throw, so we wrap it in try-catch. If it fails, we do not proceed
+    // Each simulation mutates its merkle DB, so we run each against a fresh copy of the
+    // genesis-seeded in-memory merkle DB to keep them all starting from the same state.
+
+    // 1. Run fast simulation against the in-memory merkle DB.
+    // It is the only one that may throw, so we wrap it in try-catch. If it fails, we do not proceed.
     TxSimulationResult fast_result;
     try {
-        ws_mgr.checkpoint();
-        fast_result = AVM_TRACK_TIME_V(
-            "fuzzer/simulate_fast",
-            helper.simulate_fast_with_existing_ws(
-                contract_db, ws_rev, ws, sim_fast_config, tx_data.tx, tx_data.global_variables, protocol_contracts));
-        ws_mgr.revert();
+        simulation::MemoryMerkleDB fast_merkle_db = ws_mgr.get_memory_merkle_db();
+        fast_result = AVM_TRACK_TIME_V("fuzzer/simulate_fast",
+                                       helper.simulate_fast_internal(contract_db,
+                                                                     fast_merkle_db,
+                                                                     sim_fast_config,
+                                                                     tx_data.tx,
+                                                                     tx_data.global_variables,
+                                                                     protocol_contracts));
     } catch (const std::exception& e) {
-        ws_mgr.revert();
-        fuzz_info("simulate_fast_with_existing_ws threw an exception: ", e.what());
+        fuzz_info("simulate_fast_internal threw an exception: ", e.what());
         return {};
     }
 
-    // 2. Run simulate_for_hint_collection
-    ws_mgr.checkpoint();
+    // 2. Run hint-collecting simulation against a fresh copy of the in-memory merkle DB.
+    simulation::MemoryMerkleDB hint_merkle_db = ws_mgr.get_memory_merkle_db();
     TxSimulationResult hint_result = AVM_TRACK_TIME_V(
         "fuzzer/simulate_hints",
-        helper.simulate_for_hint_collection(
-            contract_db, ws_rev, ws, sim_hint_config, tx_data.tx, tx_data.global_variables, protocol_contracts));
-    ws_mgr.revert();
+        helper.simulate_for_hint_collection_internal(
+            contract_db, hint_merkle_db, sim_hint_config, tx_data.tx, tx_data.global_variables, protocol_contracts));
 
     // 2a. Construct proving inputs from hint result
     bb::avm2::AvmProvingInputs proving_inputs{

barretenberg/cpp/src/barretenberg/avm_fuzzer/harness/emit_public_log.fuzzer.cpp

@@ -305,15 +305,15 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
     if (!error) {
         // TODO(MW): use below to check values:
         // auto public_logs = side_effect_tracker.get_side_effects().public_logs;
-        trace.set(avm2::Column::public_inputs_cols_0_, pi_row, log_fields.size());
-        trace.set(avm2::Column::public_inputs_sel, pi_row, 1);
+        trace.set(bb::avm2::Column::public_inputs_cols_0_, pi_row, log_fields.size());
+        trace.set(bb::avm2::Column::public_inputs_sel, pi_row, 1);
 
         // Set public input columns
         for (FF log_field : log_fields) {
             pi_row++;
-            trace.set(avm2::Column::public_inputs_sel, pi_row, 1);
+            trace.set(bb::avm2::Column::public_inputs_sel, pi_row, 1);
             // Logs only use cols_0
-            trace.set(avm2::Column::public_inputs_cols_0_, pi_row, log_field);
+            trace.set(bb::avm2::Column::public_inputs_cols_0_, pi_row, log_field);
         }
     }
 
@@ -330,10 +330,10 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
                                 .inputs = { MemoryValue::from<uint32_t>(input.log_size) },
                                 .after_context_event = fill_context_event(context) };
     ex_builder.process({ ex_event }, trace);
-    auto exec_log_row = trace.get_column_rows(avm2::Column::execution_sel_exec_dispatch_emit_public_log);
-    trace.set(avm2::Column::execution_rop_1_, exec_log_row - 1, input.log_offset);
-    trace.set(avm2::Column::execution_register_0_, exec_log_row - 1, input.log_size);
-    trace.set(avm2::Column::execution_sel_opcode_error, exec_log_row - 1, error ? 1 : 0);
+    auto exec_log_row = trace.get_column_rows(bb::avm2::Column::execution_sel_exec_dispatch_emit_public_log);
+    trace.set(bb::avm2::Column::execution_rop_1_, exec_log_row - 1, input.log_offset);
+    trace.set(bb::avm2::Column::execution_register_0_, exec_log_row - 1, input.log_size);
+    trace.set(bb::avm2::Column::execution_sel_opcode_error, exec_log_row - 1, error ? 1 : 0);
 
     range_check_builder.process(context_helper.range_check_emitter.dump_events(), trace);
     field_gt_builder.process(context_helper.field_gt_emitter.dump_events(), trace);