Merge pull request #278 from o1-labs/feature/constrain-party

Properly constrain zkApp party

src/lib/circuit_value.ts

@@ -326,7 +326,15 @@ let complexTypes = new Set(['object', 'function']);
 // TODO properly type this at the interface
 // create recursive type that describes JSON-like structures of circuit types
 // TODO unit-test this
-function circuitValue<T>(typeObj: any): AsFieldElements<T> {
+function circuitValue<T>(
+  typeObj: any,
+  options?: { customObjectKeys: string[] }
+): AsFieldElements<T> {
+  let objectKeys =
+    typeof typeObj === 'object'
+      ? options?.customObjectKeys ?? Object.keys(typeObj).sort()
+      : [];
+
   function sizeInFields(typeObj: any): number {
     if (!complexTypes.has(typeof typeObj) || typeObj === null) return 0;
     if (Array.isArray(typeObj))
@@ -341,10 +349,7 @@ function circuitValue<T>(typeObj: any): AsFieldElements<T> {
     if (Array.isArray(typeObj))
       return typeObj.map((t, i) => toFields(t, obj[i])).flat();
     if ('toFields' in typeObj) return typeObj.toFields(obj);
-    return Object.keys(typeObj)
-      .sort()
-      .map((k) => toFields(typeObj[k], obj[k]))
-      .flat();
+    return objectKeys.map((k) => toFields(typeObj[k], obj[k])).flat();
   }
   function ofFields(typeObj: any, fields: Field[]): any {
     if (!complexTypes.has(typeof typeObj) || typeObj === null) return null;
@@ -359,21 +364,18 @@ function circuitValue<T>(typeObj: any): AsFieldElements<T> {
       return array;
     }
     if ('ofFields' in typeObj) return typeObj.ofFields(fields);
-    let keys = Object.keys(typeObj).sort();
     let values = ofFields(
-      keys.map((k) => typeObj[k]),
+      objectKeys.map((k) => typeObj[k]),
       fields
     );
-    return Object.fromEntries(keys.map((k, i) => [k, values[i]]));
+    return Object.fromEntries(objectKeys.map((k, i) => [k, values[i]]));
   }
   function check(typeObj: any, obj: any): void {
     if (typeof typeObj !== 'object' || typeObj === null) return;
     if (Array.isArray(typeObj))
       return typeObj.forEach((t, i) => check(t, obj[i]));
     if ('check' in typeObj) return typeObj.check(obj);
-    return Object.keys(typeObj)
-      .sort()
-      .forEach((k) => check(typeObj[k], obj[k]));
+    return objectKeys.forEach((k) => check(typeObj[k], obj[k]));
   }
   return {
     sizeInFields: () => sizeInFields(typeObj),

src/lib/party.ts

@@ -30,6 +30,7 @@ export {
   ZkappStateLength,
   ZkappPublicInput,
   Events,
+  partyToPublicInput,
 };
 
 const ZkappStateLength = 8;
@@ -884,32 +885,42 @@ type PartiesProved = {
 };
 
 /**
- * The public input for zkApps consists of certain hashes of the transaction and of the proving Party which is constructed during method execution.
+ * The public input for zkApps consists of certain hashes of the proving Party (and its child parties) which is constructed during method execution.
 
-  In SmartContract.prove, a method is run twice: First outside the proof, to obtain the public input, and once in the prover,
+  For SmartContract proving, a method is run twice: First outside the proof, to obtain the public input, and once in the prover,
   which takes the public input as input. The current transaction is hashed again inside the prover, which asserts that the result equals the input public input,
   as part of the snark circuit. The block producer will also hash the transaction they receive and pass it as a public input to the verifier.
   Thus, the transaction is fully constrained by the proof - the proof couldn't be used to attest to a different transaction.
  */
-type ZkappPublicInput = [transaction: Field, atParty: Field];
-let ZkappPublicInput = circuitValue<ZkappPublicInput>([Field, Field]);
+type ZkappPublicInput = { party: Field; calls: Field };
+let ZkappPublicInput = circuitValue<ZkappPublicInput>(
+  { party: Field, calls: Field },
+  { customObjectKeys: ['party', 'calls'] }
+);
+
+function partyToPublicInput(self: Party): ZkappPublicInput {
+  // TODO compute `calls` from party's children
+  let party = self.hash();
+  let calls = Field.zero; // zero is the correct value if party has no children
+  return { party, calls };
+}
 
 async function addMissingProofs(parties: Parties): Promise<{
   parties: PartiesProved;
   proofs: (Proof<ZkappPublicInput> | undefined)[];
 }> {
-  let partiesJson = JSON.stringify(partiesToJson(parties));
   type PartyProved = Party & { authorization: Control | LazySignature };
 
-  async function addProof(party: Party, index: number) {
+  async function addProof(party: Party) {
     party = Party.clone(party);
     if (
       !('kind' in party.authorization) ||
       party.authorization.kind !== 'lazy-proof'
     )
       return { partyProved: party as PartyProved, proof: undefined };
     let { method, args, previousProofs, ZkappClass } = party.authorization;
-    let publicInput = Ledger.zkappPublicInput(partiesJson, index);
+    let publicInput = partyToPublicInput(party);
+    let publicInputFields = ZkappPublicInput.toFields(publicInput);
     if (ZkappClass._provers === undefined)
       throw Error(
         `Cannot prove execution of ${method.name}(), no prover found. ` +
@@ -928,7 +939,7 @@ async function addMissingProofs(parties: Parties): Promise<{
         witnesses: args,
         inProver: true,
       },
-      () => provers[i](publicInput, previousProofs)
+      () => provers[i](publicInputFields, previousProofs)
     );
     party.authorization = { proof: Pickles.proofToBase64Transaction(proof) };
     class ZkappProof extends Proof<ZkappPublicInput> {
@@ -947,8 +958,8 @@ async function addMissingProofs(parties: Parties): Promise<{
     authorization: Control | LazySignature;
   })[] = [];
   let proofs: (Proof<ZkappPublicInput> | undefined)[] = [];
-  for (let i = 0; i < otherParties.length; i++) {
-    let { partyProved, proof } = await addProof(otherParties[i], i);
+  for (let party of otherParties) {
+    let { partyProved, proof } = await addProof(party);
     otherPartiesProved.push(partyProved);
     proofs.push(proof);
   }

src/lib/zkapp.ts

@@ -17,6 +17,7 @@ import {
   SetOrKeep,
   ZkappPublicInput,
   Events,
+  partyToPublicInput,
 } from './party';
 import { PrivateKey, PublicKey } from './signature';
 import * as Mina from './mina';
@@ -126,13 +127,11 @@ function wrapMethod(
           // -- so we can add assertions about it
           let publicInput = actualArgs[0];
           actualArgs = actualArgs.slice(1);
-          // FIXME: figure out correct way to constrain public input https://github.com/o1-labs/snarkyjs/issues/98
-          let tail = Field.zero;
-          publicInput[0].assertEquals(publicInput[0]);
-          // checkPublicInput(publicInput, self, tail);
 
           // outside a transaction, just call the method, but check precondition invariants
           let result = method.apply(this, actualArgs);
+          checkPublicInput(publicInput, this.self);
+
           // check the self party right after calling the method
           // TODO: this needs to be done in a unified way for all parties that are created
           assertPreconditionInvariants(this.self);
@@ -175,21 +174,10 @@ function wrapMethod(
   };
 }
 
-function toPublicInput(self: Party, tail: Field) {
-  // TODO hash together party with tail in the right way
-  let atParty = self.hash();
-  let transaction = Ledger.hashTransactionChecked(atParty);
-  return { transaction, atParty };
-}
-function checkPublicInput(
-  [transaction, atParty]: ZkappPublicInput,
-  self: Party,
-  tail: Field
-) {
-  // ATM, we always compute the public input in checked mode to make assertEqual pass
-  let otherInput = toPublicInput(self, tail);
-  atParty.assertEquals(otherInput.atParty);
-  transaction.assertEquals(otherInput.transaction);
+function checkPublicInput({ party, calls }: ZkappPublicInput, self: Party) {
+  let otherInput = partyToPublicInput(self);
+  party.assertEquals(otherInput.party);
+  calls.assertEquals(otherInput.calls);
 }
 
 /**

src/snarky.d.ts

@@ -740,7 +740,7 @@ declare class Ledger {
   static zkappPublicInput(
     txJson: string,
     partyIndex: number
-  ): [transaction: Field, atParty: Field];
+  ): { party: Field; calls: Field };
   static signFieldElement(
     messageHash: Field,
     privateKey: { s: Scalar }