fix(kernel): bind tx_request_salt across the private kernels (#477)

AztecBot · web-flow · commit e56e4904ba75 · 2026-06-26T10:39:54.000+01:00
* fix(kernel): bind tx_request_salt across the private kernels * update PR #477 * update PR #477 * chore: regenerate protocol + mock pinned-build for tx_request_salt * test: thread tx_request_salt into kernel Prover.toml fixtures
diff --git a/noir-projects/mock-protocol-circuits/pinned-build.tar.gz b/noir-projects/mock-protocol-circuits/pinned-build.tar.gz
diff --git a/noir-projects/noir-protocol-circuits/crates/private-kernel-inner/Prover.toml b/noir-projects/noir-protocol-circuits/crates/private-kernel-inner/Prover.toml
@@ -186,6 +186,7 @@ claimed_first_nullifier = "0x18597ca0c71a7f7b36a69ff04d8096400a51c89f87e3c48da8f
 claimed_revertible_counter = "0x0000000000000000000000000000000000000000000000000000000000000004"
 
   [previous_kernel_public_inputs.constants]
+  tx_request_salt = "0x2deeb4d4a9cfc5a97e7403c4d21745f34e0c7971e29c38ac4a473bacbd10cac2"
   vk_tree_root = "0x1d81bf218cf88e95c51350b4b8de70a16798a155136d1eeb6e4f3ee05815a14d"
 
     [previous_kernel_public_inputs.constants.anchor_block_header]
diff --git a/noir-projects/noir-protocol-circuits/crates/private-kernel-lib/src/components/private_call_data_validator.nr b/noir-projects/noir-protocol-circuits/crates/private-kernel-lib/src/components/private_call_data_validator.nr
@@ -171,6 +171,7 @@ impl PrivateCallDataValidator {
             "anchor block header mismatch",
         );
         assert_eq(this_call.tx_context, constants.tx_context, "mismatch tx context");
+        assert_eq(this_call.tx_request_salt, constants.tx_request_salt, "mismatch tx_request_salt");
     }
 
     /// For Inner only.
diff --git a/noir-projects/noir-protocol-circuits/crates/private-kernel-lib/src/components/private_kernel_circuit_output_composer.nr b/noir-projects/noir-protocol-circuits/crates/private-kernel-lib/src/components/private_kernel_circuit_output_composer.nr
@@ -66,6 +66,7 @@ impl PrivateKernelCircuitOutputComposer {
     ) -> PrivateKernelCircuitPublicInputs {
         let constants = PrivateTxConstantData {
             tx_context: inputs.private_call.public_inputs.tx_context,
+            tx_request_salt: inputs.private_call.public_inputs.tx_request_salt,
             vk_tree_root: inputs.vk_tree_root,
             protocol_contracts: inputs.protocol_contracts,
             anchor_block_header: inputs.private_call.public_inputs.anchor_block_header,
diff --git a/noir-projects/noir-protocol-circuits/crates/private-kernel-lib/src/tests/private_kernel_inner/private_call_data/validate_against_previous_kernel_tests.nr b/noir-projects/noir-protocol-circuits/crates/private-kernel-lib/src/tests/private_kernel_inner/private_call_data/validate_against_previous_kernel_tests.nr
@@ -17,3 +17,14 @@ fn mismatch_chain_id() {
 
     builder.execute_and_fail();
 }
+
+// A nested private call must see the same `tx_request_salt` that the Init circuit bound to the transaction request.
+// A malicious prover that picks a different app-visible salt for the nested call must be rejected.
+#[test(should_fail_with = "mismatch tx_request_salt")]
+fn mismatch_tx_request_salt() {
+    let mut builder = TestBuilder::new();
+
+    builder.private_call.tx_request_salt += 1;
+
+    builder.execute_and_fail();
+}
diff --git a/noir-projects/noir-protocol-circuits/crates/private-kernel-reset-tail-to-public/Prover.toml b/noir-projects/noir-protocol-circuits/crates/private-kernel-reset-tail-to-public/Prover.toml
@@ -188,6 +188,7 @@ claimed_first_nullifier = "0x02561e4f8664bc0d3a511f46ff6de210cfb9fabb320bdc418a8
 claimed_revertible_counter = "0x0000000000000000000000000000000000000000000000000000000000000004"
 
   [previous_kernel_public_inputs.constants]
+  tx_request_salt = "0x2deeb4d4a9cfc5a97e7403c4d21745f34e0c7971e29c38ac4a473bacbd10cac2"
   vk_tree_root = "0x1d81bf218cf88e95c51350b4b8de70a16798a155136d1eeb6e4f3ee05815a14d"
 
     [previous_kernel_public_inputs.constants.anchor_block_header]
diff --git a/noir-projects/noir-protocol-circuits/crates/private-kernel-reset-tail/Prover.toml b/noir-projects/noir-protocol-circuits/crates/private-kernel-reset-tail/Prover.toml
@@ -188,6 +188,7 @@ claimed_first_nullifier = "0x2cf7c5914b1b832c41d256a7bb0eeee95eb11bb95c73c4dfb76
 claimed_revertible_counter = "0x0000000000000000000000000000000000000000000000000000000000000004"
 
   [previous_kernel_public_inputs.constants]
+  tx_request_salt = "0x2deeb4d4a9cfc5a97e7403c4d21745f34e0c7971e29c38ac4a473bacbd10cac2"
   vk_tree_root = "0x1d81bf218cf88e95c51350b4b8de70a16798a155136d1eeb6e4f3ee05815a14d"
 
     [previous_kernel_public_inputs.constants.anchor_block_header]
diff --git a/noir-projects/noir-protocol-circuits/crates/private-kernel-reset/Prover.toml b/noir-projects/noir-protocol-circuits/crates/private-kernel-reset/Prover.toml
@@ -186,6 +186,7 @@ claimed_first_nullifier = "0x2eb81a5a72d6816dd34b6330ce27e75a0faa44a3c8dcfb97b56
 claimed_revertible_counter = "0x0000000000000000000000000000000000000000000000000000000000000005"
 
   [previous_kernel_public_inputs.constants]
+  tx_request_salt = "0x2deeb4d4a9cfc5a97e7403c4d21745f34e0c7971e29c38ac4a473bacbd10cac2"
   vk_tree_root = "0x19e707b1c27292672391666e89b1deeeb36ab5bf508efef4f021df37bc224a21"
 
     [previous_kernel_public_inputs.constants.anchor_block_header]
diff --git a/noir-projects/noir-protocol-circuits/crates/protocol-test-utils/src/fixture_builder.nr b/noir-projects/noir-protocol-circuits/crates/protocol-test-utils/src/fixture_builder.nr
@@ -330,6 +330,7 @@ impl FixtureBuilder {
         PrivateTxConstantData {
             anchor_block_header: self.anchor_block_header,
             tx_context: self.tx_context,
+            tx_request_salt: self.tx_request_salt,
             vk_tree_root: self.vk_tree_root,
             protocol_contracts: self.protocol_contracts,
         }
diff --git a/noir-projects/noir-protocol-circuits/crates/types/src/abis/private_tx_constant_data.nr b/noir-projects/noir-protocol-circuits/crates/types/src/abis/private_tx_constant_data.nr
@@ -19,6 +19,9 @@ pub struct PrivateTxConstantData {
     // a situation we could be using header from a block before the upgrade took place but be using the updated
     // protocol to execute and prove the transaction.
     pub tx_context: TxContext,
+    // The transaction request salt, kept constant so each app circuit's `tx_request_salt` can be checked against it.
+    // Deliberately dropped by `to_tx_constant_data`, so it is never exposed beyond the private kernels.
+    pub tx_request_salt: Field,
     // The root of the vk tree for the protocol circuits. Used for validating the protocol circuits being used.
     // This value must remain the same throughout the private execution and the rollups. It will be output from the root
     // rollup and checked on L1.
@@ -46,6 +49,7 @@ impl Empty for PrivateTxConstantData {
         PrivateTxConstantData {
             anchor_block_header: BlockHeader::empty(),
             tx_context: TxContext::empty(),
+            tx_request_salt: 0,
             vk_tree_root: 0,
             protocol_contracts: ProtocolContracts::empty(),
         }
diff --git a/noir-projects/noir-protocol-circuits/pinned-build.tar.gz b/noir-projects/noir-protocol-circuits/pinned-build.tar.gz
diff --git a/yarn-project/noir-protocol-circuits-types/src/conversion/common.ts b/yarn-project/noir-protocol-circuits-types/src/conversion/common.ts
@@ -852,6 +852,7 @@ export function mapPrivateTxConstantDataToNoir(data: PrivateTxConstantData): Pri
   return {
     anchor_block_header: mapBlockHeaderToNoir(data.anchorBlockHeader),
     tx_context: mapTxContextToNoir(data.txContext),
+    tx_request_salt: mapFieldToNoir(data.txRequestSalt),
     vk_tree_root: mapFieldToNoir(data.vkTreeRoot),
     protocol_contracts: mapProtocolContractsToNoir(data.protocolContracts),
   };
@@ -861,6 +862,7 @@ export function mapPrivateTxConstantDataFromNoir(data: PrivateTxConstantDataNoir
   return new PrivateTxConstantData(
     mapBlockHeaderFromNoir(data.anchor_block_header),
     mapTxContextFromNoir(data.tx_context),
+    mapFieldFromNoir(data.tx_request_salt),
     mapFieldFromNoir(data.vk_tree_root),
     mapProtocolContractsFromNoir(data.protocol_contracts),
   );
diff --git a/yarn-project/stdlib/src/tx/private_tx_constant_data.ts b/yarn-project/stdlib/src/tx/private_tx_constant_data.ts
@@ -23,6 +23,14 @@ export class PrivateTxConstantData {
      * protocol to execute and prove the transaction.
      */
     public txContext: TxContext,
+    /**
+     * Salt of the transaction request (`TxRequest.salt`).
+     *
+     * Bound to the user's `tx_request` by the Init circuit and kept constant by every subsequent kernel so that each
+     * app circuit's `txRequestSalt` public input can be checked against it. It is intentionally not carried into
+     * `TxConstantData`: it is dropped by the Tail circuits rather than being exposed by the final (hiding) kernel.
+     */
+    public txRequestSalt: Fr,
     /**
      * Root of the vk tree for the protocol circuits.
      */
@@ -38,7 +46,13 @@ export class PrivateTxConstantData {
   }
 
   static getFields(fields: FieldsOf<PrivateTxConstantData>) {
-    return [fields.anchorBlockHeader, fields.txContext, fields.vkTreeRoot, fields.protocolContracts] as const;
+    return [
+      fields.anchorBlockHeader,
+      fields.txContext,
+      fields.txRequestSalt,
+      fields.vkTreeRoot,
+      fields.protocolContracts,
+    ] as const;
   }
 
   static fromFields(fields: Fr[] | FieldReader): PrivateTxConstantData {
@@ -47,6 +61,7 @@ export class PrivateTxConstantData {
       reader.readObject(BlockHeader),
       reader.readObject(TxContext),
       reader.readField(),
+      reader.readField(),
       reader.readObject(ProtocolContracts),
     );
   }
@@ -67,6 +82,7 @@ export class PrivateTxConstantData {
       reader.readObject(BlockHeader),
       reader.readObject(TxContext),
       Fr.fromBuffer(reader),
+      Fr.fromBuffer(reader),
       reader.readObject(ProtocolContracts),
     );
   }
@@ -76,13 +92,20 @@ export class PrivateTxConstantData {
   }
 
   static empty() {
-    return new PrivateTxConstantData(BlockHeader.empty(), TxContext.empty(), Fr.ZERO, ProtocolContracts.empty());
+    return new PrivateTxConstantData(
+      BlockHeader.empty(),
+      TxContext.empty(),
+      Fr.ZERO,
+      Fr.ZERO,
+      ProtocolContracts.empty(),
+    );
   }
 
   getSize() {
     return (
       this.anchorBlockHeader.getSize() +
       this.txContext.getSize() +
+      this.txRequestSalt.size +
       this.vkTreeRoot.size +
       this.protocolContracts.getSize()
     );

Original file line number	Diff line number	Diff line change
`@@ -171,6 +171,7 @@ impl PrivateCallDataValidator {`
`171`	`171`	`"anchor block header mismatch",`
`172`	`172`	`);`
`173`	`173`	`assert_eq(this_call.tx_context, constants.tx_context, "mismatch tx context");`
	`174`	`+ assert_eq(this_call.tx_request_salt, constants.tx_request_salt, "mismatch tx_request_salt");`
`174`	`175`	`}`
`175`	`176`
`176`	`177`	`/// For Inner only.`
Original file line number	Diff line number	Diff line change
`@@ -330,6 +330,7 @@ impl FixtureBuilder {`
`330`	`330`	`PrivateTxConstantData {`
`331`	`331`	`anchor_block_header: self.anchor_block_header,`
`332`	`332`	`tx_context: self.tx_context,`
	`333`	`+ tx_request_salt: self.tx_request_salt,`
`333`	`334`	`vk_tree_root: self.vk_tree_root,`
`334`	`335`	`protocol_contracts: self.protocol_contracts,`
`335`	`336`	`}`