test(fast-inbox): cover block-root message appends at a non-zero tree index (A-1374)

Author: spalladino

noir-projects/noir-protocol-circuits/crates/rollup-lib/src/block_root/tests/message_bundle_tests.nr

@@ -0,0 +1,54 @@
+use super::TestBuilder;
+use types::constants::{PRIVATE_TX_BASE_ROLLUP_VK_INDEX, PUBLIC_TX_BASE_ROLLUP_VK_INDEX};
+
+global IS_FIRST_BLOCK_ROOT: bool = true;
+
+// A start index that is a right child at some levels and a left child at others, so the append has to merge the batch
+// into a real frontier rather than drop an aligned subtree into an empty slot.
+global NON_ALIGNED_START_INDEX: u32 = 5;
+
+fn builder_at_non_aligned_index(is_first_block_root: bool) -> TestBuilder {
+    TestBuilder::new_at_l1_to_l2_index(
+        PRIVATE_TX_BASE_ROLLUP_VK_INDEX,
+        1,
+        PUBLIC_TX_BASE_ROLLUP_VK_INDEX,
+        1,
+        is_first_block_root,
+        NON_ALIGNED_START_INDEX,
+    )
+}
+
+#[test]
+fn first_block_appends_at_non_aligned_index() {
+    let builder = builder_at_non_aligned_index(IS_FIRST_BLOCK_ROOT);
+    let pi = builder.execute();
+    builder.assert_expected_public_inputs(pi);
+}
+
+#[test]
+fn non_first_block_appends_at_non_aligned_index() {
+    let builder = builder_at_non_aligned_index(!IS_FIRST_BLOCK_ROOT);
+    let pi = builder.execute();
+    builder.assert_expected_public_inputs(pi);
+}
+
+#[test]
+fn unpinned_frontier_hint_lane_is_ignored() {
+    // Index 5 is a left child at level 1, so the snapshot root cannot pin that hint lane. The append overwrites it
+    // with the batch's own node before anything reads it, so a wrong value there must not change the result.
+    let mut builder = builder_at_non_aligned_index(!IS_FIRST_BLOCK_ROOT);
+    builder.l1_to_l2_message_frontier_hint[1] += 1;
+
+    let pi = builder.execute();
+    builder.assert_expected_public_inputs(pi);
+}
+
+#[test(should_fail_with = "Frontier hint does not match the snapshot root")]
+fn corrupted_pinned_frontier_hint_lane_fails() {
+    // Index 5 is a right child at level 0, so that hint lane is pinned by the snapshot root and cannot be tampered
+    // with. Note this is only testable at a non-zero start index: appending into an empty tree pins no lane at all.
+    let mut builder = builder_at_non_aligned_index(!IS_FIRST_BLOCK_ROOT);
+    builder.l1_to_l2_message_frontier_hint[0] += 1;
+
+    builder.execute_and_fail();
+}

noir-projects/noir-protocol-circuits/crates/rollup-lib/src/block_root/tests/mod.nr

@@ -1,6 +1,7 @@
 mod child_proof_vk_tests;
 mod consecutive_rollups_tests;
 mod failures_tests;
+mod message_bundle_tests;
 mod rollup_structure_tests;
 
 use crate::{
@@ -85,6 +86,26 @@ impl TestBuilder {
         right_rollup_vk_index: u32,
         num_right_txs: u16,
         is_first_block_root: bool,
+    ) -> Self {
+        Self::new_at_l1_to_l2_index(
+            left_rollup_vk_index,
+            num_left_txs,
+            right_rollup_vk_index,
+            num_right_txs,
+            is_first_block_root,
+            0,
+        )
+    }
+
+    /// Same as `new`, but the block's bundle is appended into an l1-to-l2 tree that already holds
+    /// `l1_to_l2_start_index` leaves instead of into an empty one.
+    pub fn new_at_l1_to_l2_index(
+        left_rollup_vk_index: u32,
+        num_left_txs: u16,
+        right_rollup_vk_index: u32,
+        num_right_txs: u16,
+        is_first_block_root: bool,
+        l1_to_l2_start_index: u32,
     ) -> Self {
         Self::validate_input_vk_index(left_rollup_vk_index, num_left_txs);
         Self::validate_input_vk_index(right_rollup_vk_index, num_right_txs);
@@ -103,9 +124,9 @@ impl TestBuilder {
 
         let slot_number = fixture_builder.start_slot_number;
 
-        // Build the block's message bundle appended to an empty l1-to-l2 tree.
-        let (previous_l1_to_l2, l1_to_l2_messages, l1_to_l2_message_frontier_hint, new_l1_to_l2) =
-            fixture_builder.build_l1_to_l2_message_bundle(TEST_NUM_MSGS);
+        // Build the block's message bundle appended at the l1-to-l2 tree's next available index.
+        let (previous_l1_to_l2, l1_to_l2_messages, l1_to_l2_message_frontier_hint, new_l1_to_l2) = fixture_builder
+            .build_l1_to_l2_message_bundle_at_index(TEST_NUM_MSGS, l1_to_l2_start_index);
 
         // The l1-to-l2 tree snapshot carried in the constants is the pre-append snapshot for non-first blocks (the tree
         // where this block picks up), and the post-append snapshot for first blocks (checked by the circuit against the

noir-projects/noir-protocol-circuits/crates/rollup-lib/src/tests/rollup_fixture_builder.nr

@@ -35,6 +35,11 @@ use types::{
     traits::{Deserialize, Empty, Hash},
 };
 
+// The fixture pre-fills l1-to-l2 leaves into a single subtree of 2^3 = 8 leaves, which bounds how far into the tree a
+// block's bundle can be made to start. The bundle append itself is not aligned to that subtree.
+global PRE_EXISTING_L1_TO_L2_SUBTREE_HEIGHT: u32 = 3;
+global PRE_EXISTING_L1_TO_L2_LEAF_COUNT: u32 = 8;
+
 pub struct RollupFixtureBuilder {
     // Epoch constants.
     pub chain_id: Field,
@@ -181,23 +186,51 @@ impl RollupFixtureBuilder {
     }
 
     /// Builds a per-block L1-to-L2 message bundle appended to an empty tree, returning
-    /// `(previous_snapshot, leaves, num_msgs, frontier_hint, new_snapshot)`. The empty tree has an all-zero frontier,
-    /// and the resulting `new_snapshot` is exactly what the block root circuit recomputes from the same inputs.
+    /// `(previous_snapshot, leaves, frontier_hint, new_snapshot)`. The resulting `new_snapshot` is exactly what the
+    /// block root circuit recomputes from the same inputs.
     pub fn build_l1_to_l2_message_bundle(
+        self,
+        num_msgs: u32,
+    ) -> (AppendOnlyTreeSnapshot, [Field; MAX_L1_TO_L2_MSGS_PER_BLOCK], [Field; L1_TO_L2_MSG_TREE_HEIGHT], AppendOnlyTreeSnapshot) {
+        self.build_l1_to_l2_message_bundle_at_index(num_msgs, 0)
+    }
+
+    /// Same as `build_l1_to_l2_message_bundle`, but appending into a tree that already holds `start_index` leaves —
+    /// the compact, unaligned append every block after the very first one performs. The pre-existing leaves sit in a
+    /// single subtree of `PRE_EXISTING_L1_TO_L2_LEAF_COUNT` leaves, so `start_index` must stay below that. The frontier
+    /// hint is the tree's sibling path at `start_index`, which is how a tree database answers for it: the pending left
+    /// sibling at every level where the index is a right child, and the zero-subtree root everywhere else.
+    pub fn build_l1_to_l2_message_bundle_at_index(
         _self: Self,
         num_msgs: u32,
+        start_index: u32,
     ) -> (AppendOnlyTreeSnapshot, [Field; MAX_L1_TO_L2_MSGS_PER_BLOCK], [Field; L1_TO_L2_MSG_TREE_HEIGHT], AppendOnlyTreeSnapshot) {
+        assert(
+            start_index < PRE_EXISTING_L1_TO_L2_LEAF_COUNT,
+            "The fixture cannot pre-fill that many l1-to-l2 leaves",
+        );
+
+        let mut pre_existing = [0; PRE_EXISTING_L1_TO_L2_LEAF_COUNT];
+        for i in 0..PRE_EXISTING_L1_TO_L2_LEAF_COUNT {
+            if i < start_index {
+                pre_existing[i] = (i + 1) as Field * 7;
+            }
+        }
+        let tree = SingleSubtreeMerkleTree::<PRE_EXISTING_L1_TO_L2_LEAF_COUNT, PRE_EXISTING_L1_TO_L2_SUBTREE_HEIGHT, L1_TO_L2_MSG_TREE_HEIGHT>::new(
+            pre_existing,
+        );
+
         let mut leaves = [0; MAX_L1_TO_L2_MSGS_PER_BLOCK];
         for i in 0..MAX_L1_TO_L2_MSGS_PER_BLOCK {
             if i < num_msgs {
                 leaves[i] = (i + 1) as Field * 100;
             }
         }
         let previous = AppendOnlyTreeSnapshot {
-            root: compute_empty_tree_root::<L1_TO_L2_MSG_TREE_HEIGHT>(),
-            next_available_leaf_index: 0,
+            root: tree.get_root(),
+            next_available_leaf_index: start_index as Field,
         };
-        let frontier_hint = [0; L1_TO_L2_MSG_TREE_HEIGHT];
+        let frontier_hint = tree.get_sibling_path(start_index as Field);
         let new = append_leaves_to_snapshot::<L1_TO_L2_MSG_TREE_HEIGHT, MAX_L1_TO_L2_MSGS_PER_BLOCK>(
             previous,
             leaves,