Perf/fri merkle folding

[diegokingston]

No description provided.

[github-actions]

Codex Code Review

Findings

• Low Security / Bug: proof.rs lets cap_height exceed depth when cap.len() > num_leaves, then depth - cap_height underflows at line 179. A malformed external cap can make verify_capped panic in debug builds, or behave incorrectly in release. Add an explicit guard after computing both values:

  if cap_height > depth {
      return false;
  }

No other real issues found in the PR diff.

I attempted to run cargo test -p crypto merkle_cap_tests --quiet, but the environment could not create rustup temp files under /home/runner/.rustup because it is read-only.

[claude]

Medium — DoS via usize underflow

depth - cap_height is an unchecked usize subtraction. If a caller passes a cap with more nodes than the tree has leaves (e.g. cap.len() = 2 * num_leaves), then cap_height > depth, which:

• debug builds: panics immediately.
• release builds: wraps to usize::MAX, causing the for loop to iterate ~2⁶⁴ times (effectively an infinite hang).

The is_power_of_two guard a few lines up doesn't prevent this — it only ensures the cap is a power of two, not that it's ≤ num_leaves.

The verifier is meant to be called with untrusted inputs, so this needs a bounds check before the arithmetic:

Suggested change

	for _ in 0..depth - cap_height {
	let depth = num_leaves.trailing_zeros() as usize;
	let cap_height = cap.len().trailing_zeros() as usize;
	if cap_height > depth {
	return false;
	}
	// Process level by level, from the leaves up to the cap level, same as
	// `get_batch_auth_path_positions`.
	for _ in 0..depth - cap_height {