feat(multisig): verify sigs with secp256k1 ECDSA

Both shielded multisig presets accepted any signature: verification was
a `stubVerifySignature` circuit that returned true unconditionally.
Toolchain 0.34.0 ships `secp256k1EcdsaVerify`, so the fold callback now
performs a real check and the stub is gone from both files.

Signer commitments hash the public-key coordinates rather than an opaque
`Bytes<64>` key, because `Secp256k1Point` reaches the hash only through
the `secp256k1PointX`/`Y` accessors. Existing deployments would need
their commitments recomputed.

The primitives are only bound under ZKIR v3, so `compile:multisig`
passes `--feature-zkir-v3`.

`secp256k1EcdsaVerify` accepts high-s signatures and Compact has no
ordering on `Secp256k1Scalar`, so low-s is not enforced in circuit. Every
digest is nonce-bound and no signature is stored, which makes malleability
inert here.

Refs: #826

Author: 0xisk

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Verify `ShieldedMultiSigV2` and `ShieldedMultiSigV3` approvals with the `secp256k1EcdsaVerify` standard-library primitive, removing `stubVerifySignature` from both presets. `execute` / `mint` / `burn` now take `Vector<2, Secp256k1Point>` public keys and `Vector<2, Secp256k1EcdsaSignature>` signatures, and signer commitments hash the public-key coordinates (`pkX`, `pkY`) instead of a `Bytes<64>` key. These primitives require ZKIR v3, so `compile:multisig` now passes `--feature-zkir-v3`. (#826)
 - Upgrade the Compact toolchain and Midnight dependencies: compiler `0.31.0` → `0.34.0`, `@midnight-ntwrk/compact-runtime` `0.16.0` → `0.19.0`, `@midnight-ntwrk/ledger-v8` `8.1.0` → `@midnightntwrk/ledger-v9` `1.0.0-rc.3`, `@midnight-ntwrk/compact-js` `2.5.1` → `2.5.5-rc.8`, the `midnight-js` packages `4.1.1` → `5.0.0-beta.7`, and `@openzeppelin/compact-simulator` `^0.3.1` → `^0.4.0`. Contract `pragma language_version` raised `>= 0.23.0` → `>= 0.26.0` (the language version shipped with compiler 0.34.0). (#841)
 
 ## 0.3.0-alpha.2 (2026-08-11)

contracts/package.json

@@ -28,7 +28,7 @@
     "compile:access": "compact-compiler --dir access",
     "compile:archive": "compact-compiler --dir archive",
     "compile:crypto": "compact-compiler --dir crypto",
-    "compile:multisig": "compact-compiler --dir multisig",
+    "compile:multisig": "compact-compiler --dir multisig --feature-zkir-v3",
     "compile:security": "compact-compiler --dir security",
     "compile:token": "compact-compiler --dir token",
     "compile:utils": "compact-compiler --dir utils",

contracts/src/multisig/presets/ShieldedMultiSigV2.compact

@@ -41,11 +41,13 @@ export struct VerificationState {
 
 /**
  * @description Input to persistentHash for computing signer commitments.
- * Combines the ECDSA public key with an instance-specific salt and
- * domain separator to produce a unique, unlinkable commitment.
+ * Combines the signer's secp256k1 public-key coordinates with an
+ * instance-specific salt and domain separator to produce a unique,
+ * unlinkable commitment.
  */
 export struct SignerCommitmentInput {
-  pk: Bytes<64>,
+  pkX: Bytes<32>,
+  pkY: Bytes<32>,
   salt: Bytes<32>,
   domain: Bytes<32>
 }
@@ -62,8 +64,10 @@ ledger _instanceSalt: Bytes<32>;
  * a threshold.
  *
  * Each commitment is computed off-chain as:
- * persistentHash(SignerCommitmentInput { pk, instanceSalt, domain })
- * where domain is pad(32, "MultiSig:signer:").
+ * persistentHash(SignerCommitmentInput { pkX, pkY, instanceSalt, domain })
+ * where domain is pad(32, "MultiSig:signer:"). Use the exported
+ * `_calculateSignerId` circuit to derive them consistently with
+ * in-circuit verification.
  *
  * The instanceSalt should be a random value to prevent the same public
  * key from producing the same commitment across different multisig
@@ -127,9 +131,6 @@ export circuit deposit(coin: ShieldedCoinInfo): [] {
  * is verified against the message hash. Duplicate signers are rejected
  * via inequality check on adjacent commitments.
  *
- * @notice ECDSA verification is stubbed. Replace stubVerifySignature
- * with ecdsaVerify when Compact ECDSA primitives are available.
- *
  * @notice Duplicate detection via != only works for exactly 2 signers.
  * Production contracts with larger signer sets need a different
  * uniqueness enforcement mechanism.
@@ -144,17 +145,17 @@ export circuit deposit(coin: ShieldedCoinInfo): [] {
  * @param {Proposal_Recipient} to - The recipient.
  * @param {Uint<128>} amount - The amount to send.
  * @param {QualifiedShieldedCoinInfo} coin - The coin to spend (from operator's pool).
- * @param {Vector<2, Bytes<64>>} pubkeys - ECDSA public keys of approving signers.
- * @param {Vector<2, Bytes<64>>} signatures - ECDSA signatures over the operation.
+ * @param {Vector<2, Secp256k1Point>} pubkeys - Public keys of approving signers.
+ * @param {Vector<2, Secp256k1EcdsaSignature>} signatures - ECDSA signatures over the operation.
  *
  * @returns {ShieldedSendResult} The send result including any change.
  */
 export circuit execute(
   to: Proposal_Recipient,
   amount: Uint<128>,
   coin: QualifiedShieldedCoinInfo,
-  pubkeys: Vector<2, Bytes<64>>,
-  signatures: Vector<2, Bytes<64>>
+  pubkeys: Vector<2, Secp256k1Point>,
+  signatures: Vector<2, Secp256k1EcdsaSignature>
 ): ShieldedSendResult {
   // Increment nonce
   const currentNonce = _nonce;
@@ -192,16 +193,21 @@ export circuit execute(
  * instance salt, checks for duplicates against the previous commitment,
  * verifies registry membership, and validates the ECDSA signature.
  *
+ * @notice `secp256k1EcdsaVerify` accepts both low-s and high-s signatures, so a
+ * third party can maul an approval into a second valid encoding. That is inert
+ * here: every digest commits to the nonce, so a message authorizes at most one
+ * operation, and signatures are never stored or used as identifiers.
+ *
  * @param {VerificationState} state - Accumulator threaded through fold.
- * @param {Bytes<64>} pubkey - The signer's ECDSA public key.
- * @param {Bytes<64>} signature - The signer's signature over msgHash.
+ * @param {Secp256k1Point} pubkey - The signer's secp256k1 public key.
+ * @param {Secp256k1EcdsaSignature} signature - The signer's signature over msgHash.
  *
  * @returns {VerificationState} Updated accumulator.
  */
 circuit verifySignature(
   state: VerificationState,
-  pubkey: Bytes<64>,
-  signature: Bytes<64>
+  pubkey: Secp256k1Point,
+  signature: Secp256k1EcdsaSignature
 ): VerificationState {
   const commitment = _calculateSignerId(pubkey, _instanceSalt);
 
@@ -211,9 +217,7 @@ circuit verifySignature(
   // Verify this commitment is a registered signer
   Signer_assertSigner(commitment);
 
-  // TODO: Replace with actual ECDSA primitive when available
-  // assert(ecdsaVerify(pubkey, state.msgHash, signature), "Multisig: invalid signature");
-  assert(stubVerifySignature(pubkey, state.msgHash, signature), "Multisig: invalid signature");
+  assert(secp256k1EcdsaVerify(state.msgHash, signature, pubkey), "Multisig: invalid signature");
 
   return VerificationState {
     validCount: state.validCount + 1 as Uint<8>,
@@ -223,44 +227,37 @@ circuit verifySignature(
 }
 
 /**
- * @description Computes a signer commitment from an ECDSA public key.
+ * @description Computes a signer commitment from a secp256k1 public key.
  *
- * The commitment is persistentHash(pk, salt, domain) where:
- * - pk: the signer's ECDSA public key (64 bytes)
+ * The commitment is persistentHash(pkX, pkY, salt, domain) where:
+ * - pkX/pkY: the signer's secp256k1 public-key coordinates
  * - salt: instance-specific random value (prevents cross-contract correlation)
  * - domain: "MultiSig:signer:" (domain separation)
  *
  * This is a pure circuit. It can be called off-chain by the deployer
  * to compute commitments for the constructor.
  *
- * @param {Bytes<64>} pk - The ECDSA public key.
+ * Requirements:
+ *
+ * - `pk` must not be the secp256k1 identity point, which has no coordinates.
+ *
+ * @param {Secp256k1Point} pk - The secp256k1 public key.
  * @param {Bytes<32>} salt - The instance salt.
  *
  * @returns {Bytes<32>} The signer commitment.
  */
 export pure circuit _calculateSignerId(
-  pk: Bytes<64>,
+  pk: Secp256k1Point,
   salt: Bytes<32>
 ): Bytes<32> {
   return persistentHash<SignerCommitmentInput>(SignerCommitmentInput {
-    pk: pk,
+    pkX: secp256k1PointX(pk) as Bytes<32>,
+    pkY: secp256k1PointY(pk) as Bytes<32>,
     salt: salt,
     domain: pad(32, "MultiSig:signer:")
   });
 }
 
-/**
- * @description Stub for ECDSA signature verification.
- * Always returns true. MUST be replaced before any non-test deployment.
- */
-circuit stubVerifySignature(
-  pubkey: Bytes<64>,
-  msgHash: Bytes<32>,
-  signature: Bytes<64>
-): Boolean {
-  return true;
-}
-
 // ─── View ───────────────────────────────────────────────────────
 
 export circuit getNonce(): Uint<64> {

contracts/src/multisig/presets/ShieldedMultiSigV3.compact

@@ -33,9 +33,11 @@ pragma language_version >= 0.26.0;
  * hash prevent signatures for one operation type from being replayed as
  * the other.
  *
- * @notice ECDSA verification is stubbed. Replace `stubVerifySignature` with
- * `ecdsaVerify`, and `persistentHash` with `keccak256`, once the Compact
- * ECDSA and Keccak primitives are available.
+ * @notice Threshold authorization is enforced with secp256k1 ECDSA
+ * (`secp256k1EcdsaVerify`) over `persistentHash` digests.
+ *
+ * TODO: switch every digest to `keccak256` to match the custodian's HSM
+ * signing format (#827).
  */
 
 import CompactStandardLibrary;
@@ -60,11 +62,13 @@ struct VerificationState {
 
 /**
  * @description Input to persistentHash for computing signer commitments.
- * Combines the ECDSA public key with an instance-specific salt and
- * domain separator to produce a unique, unlinkable commitment.
+ * Combines the signer's secp256k1 public-key coordinates with an
+ * instance-specific salt and domain separator to produce a unique,
+ * unlinkable commitment.
  */
 struct SignerCommitmentInput {
-  pk: Bytes<64>,
+  pkX: Bytes<32>,
+  pkY: Bytes<32>,
   salt: Bytes<32>,
   domain: Bytes<32>
 }
@@ -83,8 +87,11 @@ export sealed ledger _tokenDomain: Bytes<32>;
  * a threshold of 2.
  *
  * Each commitment is computed off-chain as:
- *   `persistentHash(SignerCommitmentInput { pk, instanceSalt, domain })`
- * where domain is `pad(32, "multisig:signer:")`.
+ *   `persistentHash(SignerCommitmentInput { pkX, pkY, instanceSalt, domain })`
+ * where `pkX`/`pkY` are the signer's secp256k1 public-key coordinates and
+ * domain is `pad(32, "multisig:signer:")`. Use the exported
+ * `_calculateSignerId` circuit to derive them consistently with in-circuit
+ * verification.
  *
  * `tokenDomain` is used with `kernel.self()` to derive the token color
  * via `tokenType(_tokenDomain, kernel.self())`. Only coins of this color
@@ -136,10 +143,6 @@ constructor(
  * after the counter has been incremented, binding each mint's nonce to a
  * distinct counter value.
  *
- * @notice Replace `persistentHash` with `keccak256` and `stubVerifySignature`
- * with `ecdsaVerify` once the Compact ECDSA and Keccak primitives are
- * available, to match the custodian's HSM signing format.
- *
  * Requirements:
  *
  * - Both public keys must hash to registered signer commitments.
@@ -149,14 +152,14 @@ constructor(
  *
  * @param {Uint<64>} amount - The token amount to mint.
  * @param {Either<ZswapCoinPublicKey, ContractAddress>} recipient - The address to receive the minted tokens.
- * @param {Vector<2, Bytes<64>>} pubkeys - ECDSA public keys of approving signers.
- * @param {Vector<2, Bytes<64>>} signatures - ECDSA signatures over the mint hash.
+ * @param {Vector<2, Secp256k1Point>} pubkeys - Public keys of approving signers.
+ * @param {Vector<2, Secp256k1EcdsaSignature>} signatures - ECDSA signatures over the mint hash.
  */
 export circuit mint(
   amount: Uint<64>,
   recipient: Either<ZswapCoinPublicKey, ContractAddress>,
-  pubkeys: Vector<2, Bytes<64>>,
-  signatures: Vector<2, Bytes<64>>
+  pubkeys: Vector<2, Secp256k1Point>,
+  signatures: Vector<2, Secp256k1EcdsaSignature>
 ): [] {
   const opNonce = _counter;
   _counter.increment(1);
@@ -211,10 +214,6 @@ export circuit mint(
  * The "multisig:burn:" domain prefix ensures burn signatures cannot be replayed
  * as mint operations for the same parameters.
  *
- * @notice Replace `persistentHash` with `keccak256` and `stubVerifySignature`
- * with `ecdsaVerify` once the Compact ECDSA and Keccak primitives are
- * available, to match the custodian's HSM signing format.
- *
  * Requirements:
  *
  * - Both public keys must hash to registered signer commitments.
@@ -226,14 +225,14 @@ export circuit mint(
  *
  * @param {QualifiedShieldedCoinInfo} coin - The coin to burn (from operator's UTXO pool).
  * @param {Uint<64>} amount - The token amount to burn.
- * @param {Vector<2, Bytes<64>>} pubkeys - ECDSA public keys of approving signers.
- * @param {Vector<2, Bytes<64>>} signatures - ECDSA signatures over the burn hash.
+ * @param {Vector<2, Secp256k1Point>} pubkeys - Public keys of approving signers.
+ * @param {Vector<2, Secp256k1EcdsaSignature>} signatures - ECDSA signatures over the burn hash.
  */
 export circuit burn(
   coin: QualifiedShieldedCoinInfo,
   amount: Uint<64>,
-  pubkeys: Vector<2, Bytes<64>>,
-  signatures: Vector<2, Bytes<64>>
+  pubkeys: Vector<2, Secp256k1Point>,
+  signatures: Vector<2, Secp256k1EcdsaSignature>
 ): [] {
   const opNonce = _counter;
   _counter.increment(1);
@@ -276,15 +275,20 @@ export circuit burn(
  * (e.g. 3-of-N) requires a separate variant with a larger vector and a
  * different duplicate-detection mechanism (sorted commitments or bitmap).
  *
+ * @notice `secp256k1EcdsaVerify` accepts both low-s and high-s signatures, so a
+ * third party can maul an approval into a second valid encoding. That is inert
+ * here: every digest commits to the counter, so a message authorizes at most
+ * one operation, and signatures are never stored or used as identifiers.
+ *
  * @param {VerificationState} state - Accumulator threaded through fold.
- * @param {Bytes<64>} pubkey - The signer's ECDSA public key.
- * @param {Bytes<64>} signature - The signer's signature over msgHash.
+ * @param {Secp256k1Point} pubkey - The signer's secp256k1 public key.
+ * @param {Secp256k1EcdsaSignature} signature - The signer's signature over msgHash.
  * @returns {VerificationState} Updated accumulator.
  */
 circuit verifySignature(
   state: VerificationState,
-  pubkey: Bytes<64>,
-  signature: Bytes<64>
+  pubkey: Secp256k1Point,
+  signature: Secp256k1EcdsaSignature
 ): VerificationState {
   const commitment = _calculateSignerId(pubkey, _instanceSalt);
 
@@ -293,8 +297,7 @@ circuit verifySignature(
 
   Signer_assertSigner(commitment);
 
-  // TODO: Replace with ecdsaVerify + keccak256 when primitives are available
-  assert(stubVerifySignature(pubkey, state.msgHash, signature), "Multisig: invalid signature");
+  assert(secp256k1EcdsaVerify(state.msgHash, signature, pubkey), "Multisig: invalid signature");
 
   return VerificationState {
     validCount: state.validCount + 1 as Uint<8>,
@@ -304,43 +307,36 @@ circuit verifySignature(
 }
 
 /**
- * @description Computes a signer commitment from an ECDSA public key.
+ * @description Computes a signer commitment from a secp256k1 public key.
  *
- * The commitment is persistentHash(pk, salt, domain) where:
- * - pk: the signer's ECDSA public key (64 bytes)
+ * The commitment is persistentHash(pkX, pkY, salt, domain) where:
+ * - pkX/pkY: the signer's secp256k1 public-key coordinates
  * - salt: instance-specific random value (prevents cross-contract correlation)
  * - domain: "multisig:signer:" (domain separation)
  *
  * Pure circuit — callable off-chain by the deployer to compute
  * commitments for the constructor.
  *
- * @param {Bytes<64>} pk - The ECDSA public key.
+ * Requirements:
+ *
+ * - `pk` must not be the secp256k1 identity point, which has no coordinates.
+ *
+ * @param {Secp256k1Point} pk - The secp256k1 public key.
  * @param {Bytes<32>} salt - The instance salt.
  * @returns {Bytes<32>} The signer commitment.
  */
 export pure circuit _calculateSignerId(
-  pk: Bytes<64>,
+  pk: Secp256k1Point,
   salt: Bytes<32>
 ): Bytes<32> {
   return persistentHash<SignerCommitmentInput>(SignerCommitmentInput {
-    pk: pk,
+    pkX: secp256k1PointX(pk) as Bytes<32>,
+    pkY: secp256k1PointY(pk) as Bytes<32>,
     salt: salt,
     domain: pad(32, "multisig:signer:")
   });
 }
 
-/**
- * @description Stub for ECDSA signature verification.
- * Always returns true. MUST be replaced before any non-test deployment.
- */
-circuit stubVerifySignature(
-  pubkey: Bytes<64>,
-  msgHash: Bytes<32>,
-  signature: Bytes<64>
-): Boolean {
-  return true;
-}
-
 // ─── View ───────────────────────────────────────────────────────
 
 export circuit getNonce(): Uint<64> {