feat(fast-inbox): check the epoch proof's end inbox rolling hash explicitly (A-1384)

getEpochProofPublicInputs anchored only the start of the consumed rolling-hash
chain segment; a wrong endInboxRollingHash was caught transitively, surfacing as
a bare Rollup__InvalidProof. Compare it against the hash recorded at propose for
the epoch's last checkpoint and revert with Rollup__InvalidEndInboxRollingHash,
mirroring the endArchive check. Test helpers that submitted a zero end hash now
source it from the proposed header.

Author: spalladino

l1-contracts/src/core/libraries/Errors.sol

@@ -61,6 +61,7 @@ library Errors {
   error Rollup__InvalidInHash(bytes32 expected, bytes32 actual); // 0xcd6f4233
   error Rollup__InvalidInboxRollingHash(bytes32 expected, bytes32 actual); // 0xed1f7bb5
   error Rollup__InvalidPreviousInboxRollingHash(bytes32 expected, bytes32 actual); // 0x2fe7cae5
+  error Rollup__InvalidEndInboxRollingHash(bytes32 expected, bytes32 actual); // 0x4a9cdb72
   error Rollup__InboxBucketStillMutable(uint256 bucketSeq); // 0x7254b980
   error Rollup__UnconsumedInboxMessages(uint256 nextBucketSeq); // 0x2bd4bf10
   error Rollup__InboxConsumptionBehindParent(uint256 expected, uint256 actual); // 0x54e0c025

l1-contracts/src/core/libraries/rollup/EpochProofLib.sol

@@ -290,13 +290,13 @@ library EpochProofLib {
         );
       }
 
+      // Boundary anchoring for the Inbox rolling-hash chain (AZIP-22 Fast Inbox), mirroring previousArchive/endArchive:
+      // both ends of the claimed chain segment must match the rolling hashes recorded at propose for checkpoints
+      // _start - 1 and _end. The start needs this to be sound - the previous checkpoint's header is not among this
+      // proof's public inputs, so nothing else pins where the segment begins. The end is already pinned transitively
+      // (the checkpoint root binds end_inbox_rolling_hash to the last checkpoint header, whose hash verifyHeaders ties
+      // to storage), so checking it here only trades a bare proof-verification failure for a specific error.
       {
-        // Start-boundary anchoring for the Inbox rolling-hash chain (AZIP-22 Fast Inbox), mirroring previousArchive:
-        // the proof's claimed chain start must match the rolling hash recorded at propose for checkpoint _start - 1.
-        // No end-side check is needed: the checkpoint root writes the parity end into both the checkpoint header and
-        // end_inbox_rolling_hash, checkpoint merges assert start/end continuity, and verifyHeaders pins the supplied
-        // headers (whose hash covers inboxRollingHash) to the stored header hashes, so a wrong endInboxRollingHash
-        // fails proof verification.
         bytes32 expectedPreviousInboxRollingHash = STFLib.getInboxRollingHash(_start - 1);
         require(
           expectedPreviousInboxRollingHash == _args.previousInboxRollingHash,
@@ -305,6 +305,14 @@ library EpochProofLib {
           )
         );
       }
+
+      {
+        bytes32 expectedEndInboxRollingHash = STFLib.getInboxRollingHash(_end);
+        require(
+          expectedEndInboxRollingHash == _args.endInboxRollingHash,
+          Errors.Rollup__InvalidEndInboxRollingHash(expectedEndInboxRollingHash, _args.endInboxRollingHash)
+        );
+      }
     }
 
     bytes32[] memory publicInputs = new bytes32[](Constants.ROOT_ROLLUP_PUBLIC_INPUTS_LENGTH);

l1-contracts/test/Rollup.t.sol

@@ -905,7 +905,7 @@ contract RollupTest is RollupBase {
       endArchive: data.archive,
       outHash: data.header.outHash,
       previousInboxRollingHash: 0,
-      endInboxRollingHash: data.header.inboxRollingHash,
+      endInboxRollingHash: proposedHeaders[1].inboxRollingHash,
       proverId: address(0)
     });
 
@@ -954,7 +954,7 @@ contract RollupTest is RollupBase {
       endArchive: data.archive,
       outHash: data.header.outHash,
       previousInboxRollingHash: wrongPrevious,
-      endInboxRollingHash: data.header.inboxRollingHash,
+      endInboxRollingHash: proposedHeaders[1].inboxRollingHash,
       proverId: address(0)
     });
 
@@ -964,6 +964,33 @@ contract RollupTest is RollupBase {
     rollup.getEpochProofPublicInputs(1, 1, args, headers, data.batchedBlobInputs);
   }
 
+  // The end of the rolling-hash chain segment is pinned to the hash recorded at propose for the epoch's last
+  // checkpoint (AZIP-22 Fast Inbox), mirroring endArchive. A wrong endInboxRollingHash must be rejected here rather
+  // than surfacing as a generic proof-verification failure.
+  function testGetEpochProofPublicInputsRejectsWrongEndInboxRollingHash() public setUpFor("empty_checkpoint_1") {
+    _proposeCheckpoint("empty_checkpoint_1", 1);
+
+    DecoderBase.Data memory data = load("empty_checkpoint_1").checkpoint;
+    CheckpointLog memory checkpoint = rollup.getCheckpoint(0);
+
+    ProposedHeader[] memory headers = new ProposedHeader[](1);
+    headers[0] = proposedHeaders[1];
+
+    bytes32 expectedEnd = proposedHeaders[1].inboxRollingHash;
+    bytes32 wrongEnd = bytes32(uint256(expectedEnd) + 1);
+    PublicInputArgs memory args = PublicInputArgs({
+      previousArchive: checkpoint.archive,
+      endArchive: data.archive,
+      outHash: data.header.outHash,
+      previousInboxRollingHash: 0,
+      endInboxRollingHash: wrongEnd,
+      proverId: address(0)
+    });
+
+    vm.expectRevert(abi.encodeWithSelector(Errors.Rollup__InvalidEndInboxRollingHash.selector, expectedEnd, wrongEnd));
+    rollup.getEpochProofPublicInputs(1, 1, args, headers, data.batchedBlobInputs);
+  }
+
   function _submitEpochProof(
     uint256 _start,
     uint256 _end,
@@ -989,7 +1016,7 @@ contract RollupTest is RollupBase {
       endArchive: _archive,
       outHash: _outHash,
       previousInboxRollingHash: 0,
-      endInboxRollingHash: 0,
+      endInboxRollingHash: proposedHeaders[_end].inboxRollingHash,
       proverId: _prover
     });
 

l1-contracts/test/validator-selection/ValidatorSelection.t.sol

@@ -752,7 +752,7 @@ contract ValidatorSelectionTest is ValidatorSelectionTestBase {
       endArchive: endFull.checkpoint.archive,
       outHash: endFull.checkpoint.header.outHash,
       previousInboxRollingHash: 0,
-      endInboxRollingHash: 0,
+      endInboxRollingHash: proposedHeaders[endCheckpointNumber].inboxRollingHash,
       proverId: prover
     });