feat!: demote public_checks to non-protocol contract

barretenberg/cpp/pil/vm2/constants_gen.pil

@@ -19,7 +19,6 @@ namespace constants;
     pol CONTRACT_CLASS_REGISTRY_CONTRACT_ADDRESS = 3;
     pol MULTI_CALL_ENTRYPOINT_ADDRESS = 4;
     pol FEE_JUICE_ADDRESS = 5;
-    pol PUBLIC_CHECKS_ADDRESS = 6;
     pol FEE_JUICE_BALANCES_SLOT = 1;
     pol UPDATED_CLASS_IDS_SLOT = 1;
     pol FLAT_PUBLIC_LOGS_HEADER_LENGTH = 1;

barretenberg/cpp/src/barretenberg/aztec/aztec_constants.hpp

@@ -25,7 +25,6 @@
 #define CONTRACT_CLASS_REGISTRY_CONTRACT_ADDRESS 3
 #define MULTI_CALL_ENTRYPOINT_ADDRESS 4
 #define FEE_JUICE_ADDRESS 5
-#define PUBLIC_CHECKS_ADDRESS 6
 #define FEE_JUICE_BALANCES_SLOT 1
 #define UPDATED_CLASS_IDS_SLOT 1
 #define FLAT_PUBLIC_LOGS_HEADER_LENGTH 1

noir-projects/aztec-nr/aztec/Nargo.toml

@@ -6,5 +6,6 @@ type = "lib"
 
 [dependencies]
 protocol_types = { path = "../../noir-protocol-circuits/crates/types" }
+standard_addresses = { path = "../standard_addresses" }
 sha256 = { tag = "v0.3.0", git = "https://github.com/noir-lang/sha256" }
 poseidon = { tag = "v0.3.0", git = "https://github.com/noir-lang/poseidon" }

noir-projects/aztec-nr/aztec/src/lib.nr

@@ -47,6 +47,7 @@ pub(crate) mod logging;
 pub mod utils;
 pub mod authwit;
 pub mod public_checks;
+pub mod public_checks_interface;
 pub mod macros;
 
 pub mod test;

noir-projects/aztec-nr/aztec/src/public_checks.nr

@@ -1,7 +1,6 @@
-use crate::context::calls::PublicStaticCall;
 use crate::context::PrivateContext;
-use crate::protocol::abis::function_selector::FunctionSelector;
-use crate::protocol::constants::PUBLIC_CHECKS_ADDRESS;
+use crate::public_checks_interface::PublicChecksInterface;
+use standard_addresses::PUBLIC_CHECKS_ADDRESS;
 
 // docs:start:helper_public_checks_functions
 /// Asserts that the current timestamp in the enqueued public call enqueued by `check_timestamp` satisfies
@@ -10,14 +9,7 @@ use crate::protocol::constants::PUBLIC_CHECKS_ADDRESS;
 /// This conceals an address of the calling contract by setting `context.msg_sender` to the public checks contract
 /// address.
 pub fn privately_check_timestamp(operation: u8, value: u64, context: &mut PrivateContext) {
-    let selector = comptime { FunctionSelector::from_signature("check_timestamp(u8,u64)") };
-    PublicStaticCall::<15, 2, ()>::new(
-        PUBLIC_CHECKS_ADDRESS,
-        selector,
-        "check_timestamp",
-        [operation as Field, value as Field],
-    )
-        .enqueue_view_incognito(context);
+    PublicChecksInterface::at(PUBLIC_CHECKS_ADDRESS).check_timestamp(operation, value).enqueue_view_incognito(context);
 }
 
 /// Asserts that the current block number in the enqueued public call enqueued by `check_block_number` satisfies
@@ -27,14 +19,7 @@ pub fn privately_check_timestamp(operation: u8, value: u64, context: &mut Privat
 /// address.
 pub fn privately_check_block_number(operation: u8, value: u32, context: &mut PrivateContext) {
     // docs:start:enqueueing
-    let selector = comptime { FunctionSelector::from_signature("check_block_number(u8,u32)") };
-    PublicStaticCall::<18, 2, ()>::new(
-        PUBLIC_CHECKS_ADDRESS,
-        selector,
-        "check_block_number",
-        [operation as Field, value as Field],
-    )
-        .enqueue_view_incognito(context);
+    PublicChecksInterface::at(PUBLIC_CHECKS_ADDRESS).check_block_number(operation, value).enqueue_view_incognito(context);
     // docs:end:enqueueing
 }
 // docs:end:helper_public_checks_functions

noir-projects/aztec-nr/aztec/src/public_checks_interface.nr

@@ -0,0 +1,41 @@
+use crate::context::calls::PublicStaticCall;
+use crate::protocol::abis::function_selector::FunctionSelector;
+use crate::protocol::address::AztecAddress;
+
+/// Hand-written interface stub for the `PublicChecks` standard contract.
+///
+/// The `PublicChecks` contract exposes two view functions that can be enqueued
+/// from private context via `enqueue_view_incognito` to assert timestamp or
+/// block-number constraints without revealing the calling contract address.
+///
+/// The selectors are derived with `comptime { FunctionSelector::from_signature(...) }`,
+/// which matches exactly what the `#[aztec]` macro generates for the real contract.
+pub struct PublicChecksInterface {
+    pub target_contract: AztecAddress,
+}
+
+impl PublicChecksInterface {
+    pub fn at(target_contract: AztecAddress) -> Self {
+        Self { target_contract }
+    }
+
+    pub fn check_timestamp(self, operation: u8, value: u64) -> PublicStaticCall<15, 2, ()> {
+        let selector = comptime { FunctionSelector::from_signature("check_timestamp(u8,u64)") };
+        PublicStaticCall::new(
+            self.target_contract,
+            selector,
+            "check_timestamp",
+            [operation as Field, value as Field],
+        )
+    }
+
+    pub fn check_block_number(self, operation: u8, value: u32) -> PublicStaticCall<18, 2, ()> {
+        let selector = comptime { FunctionSelector::from_signature("check_block_number(u8,u32)") };
+        PublicStaticCall::new(
+            self.target_contract,
+            selector,
+            "check_block_number",
+            [operation as Field, value as Field],
+        )
+    }
+}

noir-projects/aztec-nr/standard_addresses/src/lib.nr

@@ -7,5 +7,7 @@
 // stamp is generated.
 
 pub mod auth_registry;
+pub mod public_checks;
 
 pub use auth_registry::AUTH_REGISTRY_ADDRESS;
+pub use public_checks::PUBLIC_CHECKS_ADDRESS;

noir-projects/aztec-nr/standard_addresses/src/public_checks.nr

@@ -0,0 +1,17 @@
+// GENERATED FILE - DO NOT EDIT
+//
+// Written by `yarn-project/standard-contracts/src/scripts/derive_public_checks.ts` once
+// `public_checks_contract` has been compiled. Regenerate with
+// `yarn workspace @aztec/standard-contracts run regen:public-checks-address`.
+//
+// public_checks_contract MAY depend on this crate transitively through `aztec-nr/aztec`,
+// but the contract's external functions MUST NOT reference its own address.
+//
+// artifactHash    = 0x2b11692497c9a3f1f44f4694d1ffb1e521d8cd6ba0e2ef3878026fe9c12fd854
+// srcContentHash  = 0x638366fe20febfd0f3940a0afd47c19738d102f2b116fa5cc8854f16b22841dd
+
+use protocol_types::{address::AztecAddress, traits::FromField};
+
+pub global PUBLIC_CHECKS_ADDRESS: AztecAddress = AztecAddress::from_field(
+    0x0ed9aa9b8262bd0afb923764799e058ad10cf0de3e01dcf955055b11fdb20d70,
+);

noir-projects/noir-contracts/Nargo.toml

@@ -28,11 +28,11 @@ members = [
     "contracts/fees/sponsored_fpc_contract",
     "contracts/message_discovery/handshake_registry_contract",
     "contracts/standard/auth_registry_contract",
+    "contracts/standard/public_checks_contract",
     "contracts/protocol/contract_class_registry_contract",
     "contracts/protocol/contract_instance_registry_contract",
     "contracts/protocol/fee_juice_contract",
     "contracts/protocol/multi_call_entrypoint_contract",
-    "contracts/protocol/public_checks_contract",
     "contracts/protocol_interface/contract_instance_registry_interface",
     "contracts/protocol_interface/fee_juice_interface",
     "contracts/test/generic_proxy_contract",

noir-projects/noir-contracts/protocol_contracts.json

@@ -2,6 +2,5 @@
   "contract_instance_registry_contract-ContractInstanceRegistry",
   "contract_class_registry_contract-ContractClassRegistry",
   "multi_call_entrypoint_contract-MultiCallEntrypoint",
-  "fee_juice_contract-FeeJuice",
-  "public_checks_contract-PublicChecks"
+  "fee_juice_contract-FeeJuice"
 ]

noir-projects/noir-protocol-circuits/crates/types/src/constants.nr

@@ -224,11 +224,14 @@ pub global MAX_PROTOCOL_CONTRACTS: u32 = 11;
 // Address 1 is reserved (auth_registry was previously published here as a protocol contract; it is
 // now deployed as a regular contract at an artifact-derived address, see
 // `noir-projects/aztec-nr/standard_addresses`).
+// Address 6 is reserved (public_checks was previously published here as a protocol contract; it is
+// now deployed as a regular contract at an artifact-derived address; see
+// `noir-projects/aztec-nr/standard_addresses` for the Noir stamp and
+// `yarn-project/standard-contracts/src/public-checks` for the TS twin).
 pub global CONTRACT_INSTANCE_REGISTRY_CONTRACT_ADDRESS: AztecAddress = AztecAddress::from_field(2);
 pub global CONTRACT_CLASS_REGISTRY_CONTRACT_ADDRESS: AztecAddress = AztecAddress::from_field(3);
 pub global MULTI_CALL_ENTRYPOINT_ADDRESS: AztecAddress = AztecAddress::from_field(4);
 pub global FEE_JUICE_ADDRESS: AztecAddress = AztecAddress::from_field(5);
-pub global PUBLIC_CHECKS_ADDRESS: AztecAddress = AztecAddress::from_field(6);
 
 // `SIDE_EFFECT_MASKING_ADDRESS` is used by the protocol circuits to silo the padding side effects. It's not a protocol
 // contract (hence its address is greater than `MAX_PROTOCOL_CONTRACTS`).

yarn-project/aztec.js/src/api/protocol.ts

@@ -5,4 +5,3 @@ export { ContractClassRegistryContract } from '../contract/protocol_contracts/co
 export { ContractInstanceRegistryContract } from '../contract/protocol_contracts/contract-instance-registry.js';
 export { FeeJuiceContract } from '../contract/protocol_contracts/fee-juice.js';
 export { MultiCallEntrypointContract } from '../contract/protocol_contracts/multi-call-entrypoint.js';
-export { PublicChecksContract } from '../contract/protocol_contracts/public-checks.js';

yarn-project/constants/src/constants.gen.ts

@@ -116,7 +116,6 @@ export const CONTRACT_INSTANCE_REGISTRY_CONTRACT_ADDRESS = 2;
 export const CONTRACT_CLASS_REGISTRY_CONTRACT_ADDRESS = 3;
 export const MULTI_CALL_ENTRYPOINT_ADDRESS = 4;
 export const FEE_JUICE_ADDRESS = 5;
-export const PUBLIC_CHECKS_ADDRESS = 6;
 export const SIDE_EFFECT_MASKING_ADDRESS = 19523154334483583633304358390644137470227519736821975910774528428729027989987n;
 export const NULL_MSG_SENDER_CONTRACT_ADDRESS = 21888242871839275222246405745257275088548364400416034343698204186575808495616n;
 export const CONTRACT_CLASS_REGISTRY_BYTECODE_CAPSULE_SLOT = 14193106819744442689484501689686180698286338820089744102289275815863062044599n;

yarn-project/constants/src/scripts/constants.in.ts

@@ -28,7 +28,6 @@ const CPP_CONSTANTS = [
   'MULTI_CALL_ENTRYPOINT_ADDRESS',
   'FEE_JUICE_ADDRESS',
   'TX_DA_GAS_OVERHEAD',
-  'PUBLIC_CHECKS_ADDRESS',
   'FEE_JUICE_BALANCES_SLOT',
   'UPDATED_CLASS_IDS_SLOT',
   'UPDATES_DELAYED_PUBLIC_MUTABLE_VALUES_LEN',
@@ -175,7 +174,6 @@ const PIL_CONSTANTS = [
   'CONTRACT_CLASS_REGISTRY_CONTRACT_ADDRESS',
   'MULTI_CALL_ENTRYPOINT_ADDRESS',
   'FEE_JUICE_ADDRESS',
-  'PUBLIC_CHECKS_ADDRESS',
   'FEE_JUICE_BALANCES_SLOT',
   'TIMESTAMP_OF_CHANGE_BIT_SIZE',
   'UPDATES_DELAYED_PUBLIC_MUTABLE_METADATA_BIT_SIZE',

yarn-project/protocol-contracts/src/provider/bundle.ts

@@ -7,15 +7,13 @@ import { makeProtocolContract } from '../make_protocol_contract.js';
 import { MultiCallEntrypointArtifact } from '../multi-call-entrypoint/index.js';
 import type { ProtocolContract } from '../protocol_contract.js';
 import type { ProtocolContractName } from '../protocol_contract_data.js';
-import { PublicChecksArtifact } from '../public-checks/index.js';
 import type { ProtocolContractsProvider } from './protocol_contracts_provider.js';
 
 export const ProtocolContractArtifact: Record<ProtocolContractName, ContractArtifact> = {
   ContractInstanceRegistry: ContractInstanceRegistryArtifact,
   ContractClassRegistry: ContractClassRegistryArtifact,
   MultiCallEntrypoint: MultiCallEntrypointArtifact,
   FeeJuice: FeeJuiceArtifact,
-  PublicChecks: PublicChecksArtifact,
 };
 
 export class BundledProtocolContractsProvider implements ProtocolContractsProvider {

yarn-project/protocol-contracts/src/provider/lazy.ts

@@ -4,7 +4,6 @@ import { getCanonicalInstanceRegistry } from '../instance-registry/lazy.js';
 import { getCanonicalMultiCallEntrypoint } from '../multi-call-entrypoint/lazy.js';
 import type { ProtocolContract } from '../protocol_contract.js';
 import type { ProtocolContractName } from '../protocol_contract_data.js';
-import { getCanonicalPublicChecks } from '../public-checks/lazy.js';
 import type { ProtocolContractsProvider } from './protocol_contracts_provider.js';
 
 export class LazyProtocolContractsProvider implements ProtocolContractsProvider {
@@ -18,8 +17,6 @@ export class LazyProtocolContractsProvider implements ProtocolContractsProvider
         return getCanonicalMultiCallEntrypoint();
       case 'FeeJuice':
         return getCanonicalFeeJuice();
-      case 'PublicChecks':
-        return getCanonicalPublicChecks();
       default:
         throw new Error(`Unknown protocol contract name: ${name}`);
     }

yarn-project/protocol-contracts/src/scripts/generate_data.ts

@@ -9,7 +9,6 @@ import {
   FEE_JUICE_ADDRESS,
   MAX_PROTOCOL_CONTRACTS,
   MULTI_CALL_ENTRYPOINT_ADDRESS,
-  PUBLIC_CHECKS_ADDRESS,
 } from '@aztec/constants';
 import { makeTuple } from '@aztec/foundation/array';
 import { Fr } from '@aztec/foundation/curves/bn254';
@@ -43,7 +42,6 @@ const contractAddressMapping: { [name: string]: number } = {
   ContractClassRegistry: CONTRACT_CLASS_REGISTRY_CONTRACT_ADDRESS,
   MultiCallEntrypoint: MULTI_CALL_ENTRYPOINT_ADDRESS,
   FeeJuice: FEE_JUICE_ADDRESS,
-  PublicChecks: PUBLIC_CHECKS_ADDRESS,
 };
 
 async function clearDestDir() {

yarn-project/standard-contracts/package.json

@@ -8,13 +8,15 @@
     ".": "./dest/index.js",
     "./*": "./dest/*/index.js",
     "./*/lazy": "./dest/*/lazy.js",
-    "./auth-registry/address": "./dest/auth-registry/address.gen.js"
+    "./auth-registry/address": "./dest/auth-registry/address.gen.js",
+    "./public-checks/address": "./dest/public-checks/address.gen.js"
   },
   "scripts": {
     "build": "yarn clean && yarn generate && ../scripts/tsc.sh",
     "generate": "yarn generate:data",
     "generate:data": "node --no-warnings --loader @swc-node/register/esm src/scripts/generate_data.ts",
     "regen:auth-registry-address": "node --experimental-vm-modules dest/scripts/derive_auth_registry.js",
+    "regen:public-checks-address": "node --experimental-vm-modules dest/scripts/derive_public_checks.js",
     "build:dev": "../scripts/tsc.sh --watch",
     "build:ts": "../scripts/tsc.sh",
     "clean": "rm -rf ./dest .tsbuildinfo ./artifacts",

yarn-project/standard-contracts/src/auth-registry/derive_auth_registry.test.ts

@@ -49,10 +49,10 @@ describe('derive_auth_registry renderers', () => {
 
   it('TS twin parses as expected exports', () => {
     const ts = renderTsTwin(stamp);
-    expect(ts).toContain(`AUTH_REGISTRY_ADDRESS: AztecAddress = AztecAddress.fromString(`);
-    expect(ts).toContain(`'${stamp.address.toString()}'`);
-    expect(ts).toContain(`AUTH_REGISTRY_CLASS_ID: Fr = Fr.fromString(`);
-    expect(ts).toContain(`'${stamp.classId.toString()}'`);
+    expect(ts).toContain(stamp.address.toString());
+    expect(ts).toContain(stamp.classId.toString());
+    expect(ts).toContain('AUTH_REGISTRY_ADDRESS: AztecAddress = AztecAddress.fromString(');
+    expect(ts).toContain('AUTH_REGISTRY_CLASS_ID: Fr = Fr.fromString(');
   });
 });
 

yarn-project/standard-contracts/src/index.ts

@@ -1 +1,2 @@
 export * from './auth-registry/index.js';
+export * from './public-checks/index.js';

yarn-project/standard-contracts/src/public-checks/README.md

@@ -0,0 +1,14 @@
+# public_checks stamp
+
+`derive_public_checks.test.ts` is the freshness gate: it re-derives the public_checks address and classId from the freshly-built artifact and asserts they match what is committed in:
+
+- `noir-projects/aztec-nr/standard_addresses/src/public_checks.nr` — `PUBLIC_CHECKS_ADDRESS` (Noir global, consumed by app contracts via `public_checks::utils`)
+- `yarn-project/standard-contracts/src/public-checks/address.gen.ts` — TS twin
+
+If this test fails, it usually means `public_checks_contract` source or the Noir/bb toolchain changed. Regenerate the stamp from `yarn-project/`:
+
+    yarn workspace @aztec/standard-contracts run regen:public-checks-address
+
+Then commit the resulting diffs in `public_checks.nr` and `address.gen.ts`.
+
+(You need a built artifact at `noir-projects/noir-contracts/target/public_checks_contract-PublicChecks.json` — `./bootstrap.sh build` from the git root produces it.)

yarn-project/standard-contracts/src/public-checks/address.gen.ts

@@ -0,0 +1,11 @@
+// GENERATED FILE - DO NOT EDIT.
+// Written by `yarn-project/standard-contracts/src/scripts/derive_public_checks.ts`.
+import { Fr } from '@aztec/foundation/curves/bn254';
+import { AztecAddress } from '@aztec/stdlib/aztec-address';
+
+export const PUBLIC_CHECKS_ADDRESS: AztecAddress = AztecAddress.fromString(
+  '0x0ed9aa9b8262bd0afb923764799e058ad10cf0de3e01dcf955055b11fdb20d70',
+);
+export const PUBLIC_CHECKS_CLASS_ID: Fr = Fr.fromString(
+  '0x1853dc3b22d13d7fb93a089c366125098bf0f4a169255e12fc3765b3c08c3b6d',
+);