chore: upgrade to 5.0.0 rc.2

[wei3erHase]

🤖 Linear

Closes AZT-XXX

Description

[qodo-code-review]

PR Summary by Qodo

Upgrade Aztec dependencies to v5.0.0-rc.2 and fix breaking API changes

⚙️ Configuration changes 🐞 Bug fix 🕐 20-40 Minutes

AI Description

• Bump JS and Noir Aztec dependencies from v5.0.0-rc.1 to v5.0.0-rc.2.
• Update Noir contract instances to match renamed class-id field in rc.2.
• Adjust TS test utilities for updated Aztec address construction API.

Diagram

graph TD
  A["package.json"] --> B[("Aztec JS packages\n@aztec/*")]
  A --> C[("Benchmark prerelease\ntgz")]
  D["Noir contracts\n(Nargo.toml)"] --> E[("aztec-packages\ngit tag rc.2")]
  F["Noir logic/tests"] --> D --> E
  G["TS test utils"] --> B
  subgraph Legend
    direction LR
    _cfg["Config / Manifest"] ~~~ _code["Code change"] ~~~ _ext[("External dependency")]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Use an npm-published benchmark version (semver) instead of a tarball URL

• ➕ Reproducible installs without relying on a specific GitHub release asset URL
• ➕ Cleaner dependency graph and lockfile diffs
• ➕ Better compatibility with tooling (audit, caching, registries)
• ➖ Requires publishing the prerelease to npm (or internal registry) first
• ➖ May slow down consumption of ad-hoc prereleases

2. Centralize Aztec version pinning via npm overrides/resolutions

• ➕ Single place to control Aztec versions across transitive deps
• ➕ Reduces risk of mixed rc.1/rc.2 sub-dependency graphs
• ➖ Does not help Noir (Nargo) dependencies
• ➖ Can mask incompatible transitive constraints and cause runtime surprises

3. Track aztec-packages by commit SHA instead of tag for Noir deps

• ➕ Maximum reproducibility (tags can be moved in rare cases)
• ➕ Enables pinning to a known-good commit if rc.2 tag has issues
• ➖ Harder to reason about compared to a public release tag
• ➖ More maintenance when updating versions

Recommendation: The PR’s approach (move everything to rc.2 and apply minimal compatibility fixes) is appropriate for an RC upgrade. The main improvement to consider is replacing the benchmark GitHub tarball dependency with an npm-published prerelease version when available to improve install reproducibility and tooling compatibility; otherwise, the current pin is acceptable as a temporary prerelease measure.

Files changed (14) +30 / -29

Bug fix (3) +4 / -3

logic.nrFix ContractInstance field rename for escrow instance derivation +1/-1

Fix ContractInstance field rename for escrow instance derivation

• Updates ContractInstance construction to use original_contract_class_id instead of contract_class_id, matching the rc.2 API/struct layout.

src/escrow_contract/src/library/logic.nr

utils.tsUse fromBigIntUnsafe for PRIVATE_ADDRESS constant +2/-1

Use fromBigIntUnsafe for PRIVATE_ADDRESS constant

• Updates the test constant construction to use AztecAddress.fromBigIntUnsafe, reflecting an API/validation change in the upgraded Aztec JS libraries.

src/ts/test/utils.ts

main.nrFix VaultDeployer ContractInstance field rename +1/-1

Fix VaultDeployer ContractInstance field rename

• Updates the deploy-time ContractInstance literal to set original_contract_class_id, matching the rc.2 struct field naming and fixing compilation.

src/vault_deployer/src/main.nr

Tests (2) +2 / -2

get_escrow.nrUpdate escrow test assertion for renamed class-id field +1/-1

Update escrow test assertion for renamed class-id field

• Adjusts test expectations to read original_contract_class_id instead of contract_class_id when validating the derived escrow ContractInstance.

src/escrow_contract/src/test/test_logic_contract/src/test/get_escrow.nr

utils.nrUpdate helper to return original_contract_class_id +1/-1

Update helper to return original_contract_class_id

• Aligns the test utility’s escrow class-id extraction with the rc.2 ContractInstance field rename.

src/escrow_contract/src/test/utils.nr

Other (9) +24 / -24

package.jsonBump Aztec JS deps to 5.0.0-rc.2 and update benchmark prerelease +11/-11

Bump Aztec JS deps to 5.0.0-rc.2 and update benchmark prerelease

• Updates the package version and Aztec-related dependencies from rc.1 to rc.2. Switches the benchmark dependency to a specific rc.2 prerelease tarball URL and updates the internal aztecVersion config.

package.json

Nargo.tomlPin dripper Noir dependency to aztec-packages v5.0.0-rc.2 +1/-1

Pin dripper Noir dependency to aztec-packages v5.0.0-rc.2

• Updates the Aztec Noir dependency tag from v5.0.0-rc.1 to v5.0.0-rc.2 to align contract compilation with the new release candidate.

src/dripper/Nargo.toml

Nargo.tomlUpgrade escrow Noir deps (aztec + serde) to v5.0.0-rc.2 +2/-2

Upgrade escrow Noir deps (aztec + serde) to v5.0.0-rc.2

• Bumps both the Aztec Noir library and the serde crate references to the v5.0.0-rc.2 tag to match Aztec rc.2 breaking changes.

src/escrow_contract/Nargo.toml

Nargo.tomlPin escrow test contract to aztec-packages v5.0.0-rc.2 +1/-1

Pin escrow test contract to aztec-packages v5.0.0-rc.2

• Updates the test contract’s Aztec dependency tag from rc.1 to rc.2 to ensure tests compile against the upgraded Noir libraries.

src/escrow_contract/src/test/test_logic_contract/Nargo.toml

Nargo.tomlPin generic_proxy Noir dependency to aztec-packages v5.0.0-rc.2 +1/-1

Pin generic_proxy Noir dependency to aztec-packages v5.0.0-rc.2

• Updates the Aztec Noir dependency tag to v5.0.0-rc.2 for the generic proxy contract.

src/generic_proxy/Nargo.toml

Nargo.tomlUpgrade nft_contract Noir deps (aztec + compressed_string) to rc.2 +2/-2

Upgrade nft_contract Noir deps (aztec + compressed_string) to rc.2

• Bumps Aztec and compressed_string Noir dependencies to v5.0.0-rc.2 to keep the NFT contract compatible with the upgraded Aztec toolchain.

src/nft_contract/Nargo.toml

Nargo.tomlUpgrade token_contract Noir deps to rc.2 +4/-4

Upgrade token_contract Noir deps to rc.2

• Updates Aztec, uint_note, balance_set, and compressed_string dependency tags to v5.0.0-rc.2 to align with the Aztec rc.2 ecosystem.

src/token_contract/Nargo.toml

Nargo.tomlPin vault_contract Noir dependency to aztec-packages v5.0.0-rc.2 +1/-1

Pin vault_contract Noir dependency to aztec-packages v5.0.0-rc.2

• Updates the vault contract’s Aztec Noir dependency tag to v5.0.0-rc.2 for compatibility with the new RC.

src/vault_contract/Nargo.toml

Nargo.tomlPin vault_deployer Noir dependency to aztec-packages v5.0.0-rc.2 +1/-1

Pin vault_deployer Noir dependency to aztec-packages v5.0.0-rc.2

• Updates the vault deployer contract’s Aztec Noir dependency tag from rc.1 to rc.2.

src/vault_deployer/Nargo.toml

[cubic-dev-ai]

No issues found across 15 files

_{Re-trigger cubic}

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. Tarball benchmark dependency 🐞 Bug ☼ Reliability

Description

package.json now depends on @defi-wonderland/aztec-benchmark via a GitHub release tarball URL, which
is less registry-standard and can be harder to mirror/cache in some environments. Since the package
is only referenced by benchmark code and the bench script, keeping it in runtime dependencies forces
all consumers to download it unnecessarily.

Code

package.json[37]

+    "@defi-wonderland/aztec-benchmark": "https://github.com/defi-wonderland/aztec-benchmark/releases/download/prerelease-a2add93/defi-wonderland-aztec-benchmark-5.0.0-rc.2-prerelease.a2add93.tgz",

Evidence

The PR switches the aztec-benchmark dependency to a GitHub tarball URL under runtime dependencies,
while repository usage shows it’s only imported by benchmark code and invoked via the bench script,
indicating it doesn’t need to be installed for normal consumption of the package.

package.json[11-40]
benchmarks/token_contract.benchmark.ts[8-13]
benchmarks/escrow_contract.benchmark.ts[8-19]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`@defi-wonderland/aztec-benchmark` is a GitHub tarball URL under `dependencies`, which impacts downstream consumers (extra install surface + URL-based fetch).

### Issue Context
The dependency is only used by benchmark sources and the `bench` script, not by library runtime code.

### Fix Focus Areas
- package.json[28-51]

### Suggested fix
1. Move `@defi-wonderland/aztec-benchmark` from `dependencies` to `devDependencies`.
2. Prefer a registry-published version (e.g., `5.0.0-rc.2`) when available; if a tarball is required temporarily, consider documenting why and how it’s pinned/released so consumers understand the provenance expectations.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

• Author self-review: I have reviewed the code review findings, and addressed the relevant ones.

[github-actions]

Benchmark Comparison

CPU	Cores	RAM	Arch
AMD EPYC 7763 64-Core Processor	16	63 GiB	x64

Contract: escrow

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
🔴	(partial) withdraw	342,525	512,944	+170,419 (+49.8%)	1,312	3,680	+2,368 (+180.5%)	495,400	587,800	+92,400 (+18.7%)	4,610	5,852	+1,242 (+26.9%)
🔴	withdraw	342,525	347,159	+4,634 (+1.4%)	736	768	+32 (+4.3%)	483,700	499,700	+16,000 (+3.3%)	4,616	4,650	+34 (+0.7%)
🔴	withdraw_nft	315,777	394,231	+78,454 (+24.8%)	736	1,376	+640 (+87.0%)	483,700	527,400	+43,700 (+9.0%)	4,525	5,102	+577 (+12.8%)

Contract: logic

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	get_escrow	361,213	361,213		128	128		456,000	456,000		4,838	4,833	-5 (-0.1%)
⚪	secret_key_to_public_keys	358,572	358,572		128	128		456,000	456,000		4,802	4,816	+14 (+0.3%)
🔴	share_escrow	262,376	323,430	+61,054 (+23.3%)	704	1,888	+1,184 (+168.2%)	474,500	520,700	+46,200 (+9.7%)	4,070	4,556	+486 (+11.9%)

Contract: nft

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
⚪	burn_private	295,258	295,258		416	416		661,196	661,196		4,286	4,289	+3 (+0.1%)
⚪	burn_public	244,717	244,717		448	448		670,172	670,172		3,976	3,935	-41 (-1.0%)
🔴	mint_to_private	311,232	359,887	+48,655 (+15.6%)	960	1,600	+640 (+66.7%)	652,069	735,444	+83,375 (+12.8%)	4,385	4,791	+406 (+9.3%)
⚪	mint_to_public	244,717	244,717		448	448		670,817	670,817		3,947	4,006	+59 (+1.5%)
🔴	transfer_private_to_private	268,358	270,211	+1,853 (+0.7%)	736	768	+32 (+4.3%)	483,700	499,700	+16,000 (+3.3%)	4,095	4,139	+44 (+1.1%)
⚪	transfer_private_to_public	295,287	295,287		416	416		659,276	659,276		4,301	4,294	-7 (-0.2%)
🔴	transfer_public_to_private	309,619	311,467	+1,848 (+0.6%)	960	992	+32 (+3.3%)	652,486	683,286	+30,800 (+4.7%)	4,364	4,404	+40 (+0.9%)
⚪	transfer_public_to_public	244,717	244,717		384	384		633,297	633,297		3,964	3,962	-2 (-0.1%)

Contract: token

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
🔴	burn_private	317,993	320,102	+2,109 (+0.7%)	992	1,024	+32 (+3.2%)	682,842	713,642	+30,800 (+4.5%)	4,451	4,456	+5 (+0.1%)
⚪	burn_public	244,717	244,717		448	448		668,966	668,966		3,974	3,957	-17 (-0.4%)
⚪	initialize_transfer_commitment	246,427	246,453	+26 (+0.0%)	704	704		474,500	474,500		3,980	3,983	+3 (+0.1%)
🔴	mint_to_private	312,126	373,245	+61,119 (+19.6%)	960	2,144	+1,184 (+123.3%)	651,880	737,755	+85,875 (+13.2%)	4,388	4,898	+510 (+11.6%)
⚪	mint_to_public	244,717	244,717		448	448		671,909	671,909		3,939	4,013	+74 (+1.9%)
🔴	transfer_private_to_commitment	276,109	278,576	+2,467 (+0.9%)	896	928	+32 (+3.6%)	495,400	511,400	+16,000 (+3.2%)	4,148	4,167	+19 (+0.5%)
🔴	transfer_private_to_private	295,100	367,131	+72,031 (+24.4%)	1,312	2,528	+1,216 (+92.7%)	495,400	557,600	+62,200 (+12.6%)	4,282	4,795	+513 (+12.0%)
🔴	transfer_private_to_public	318,022	320,131	+2,109 (+0.7%)	992	1,024	+32 (+3.2%)	683,067	713,867	+30,800 (+4.5%)	4,425	4,451	+26 (+0.6%)
🔴	transfer_private_to_public_with_commitment	321,316	323,454	+2,138 (+0.7%)	1,568	1,600	+32 (+2.0%)	716,367	747,167	+30,800 (+4.3%)	4,425	4,463	+38 (+0.9%)
⚪	transfer_public_to_commitment	244,717	244,717		576	576		659,022	659,022		3,947	3,965	+18 (+0.5%)
🔴	transfer_public_to_private	310,515	312,457	+1,942 (+0.6%)	960	992	+32 (+3.3%)	652,348	683,148	+30,800 (+4.7%)	4,384	4,391	+7 (+0.2%)
⚪	transfer_public_to_public	244,717	244,717		448	448		669,041	669,041		3,947	3,951	+4 (+0.1%)

Contract: vault

🚦	Function	Gates			DA Gas			L2 Gas			Proving Time (ms)
		Base	PR	Diff	Base	PR	Diff	Base	PR	Diff	Base	PR	Diff
🔴	deposit_private_to_private	538,347	541,388	+3,041 (+0.6%)	1,280	1,312	+32 (+2.5%)	846,659	877,459	+30,800 (+3.6%)	5,939	6,049	+110 (+1.9%)
🔴	deposit_private_to_private_exact	586,072	593,129	+7,057 (+1.2%)	1,856	1,888	+32 (+1.7%)	883,724	914,524	+30,800 (+3.5%)	6,426	6,515	+89 (+1.4%)
⚪	deposit_private_to_public	445,623	447,732	+2,109 (+0.5%)	768	768		861,481	861,481		5,399	5,433	+34 (+0.6%)
🔴	deposit_public_to_private	362,191	439,724	+77,533 (+21.4%)	1,344	1,984	+640 (+47.6%)	877,734	961,109	+83,375 (+9.5%)	4,779	5,387	+608 (+12.7%)
🔴	deposit_public_to_private_exact	461,232	462,190	+958 (+0.2%)	1,920	1,952	+32 (+1.7%)	914,730	945,530	+30,800 (+3.4%)	5,477	5,506	+29 (+0.5%)
⚪	deposit_public_to_public	244,717	244,717		832	832		893,624	893,624		3,932	3,937	+5 (+0.1%)
🔴	issue_private_to_private_exact	586,072	593,129	+7,057 (+1.2%)	1,856	1,888	+32 (+1.7%)	884,384	915,184	+30,800 (+3.5%)	6,437	6,516	+79 (+1.2%)
⚪	issue_private_to_public_exact	493,274	495,409	+2,135 (+0.4%)	1,344	1,344		899,200	899,200		5,688	5,758	+70 (+1.2%)
🔴	issue_public_to_private	386,634	387,566	+932 (+0.2%)	1,344	1,376	+32 (+2.4%)	886,928	917,728	+30,800 (+3.5%)	4,978	4,985	+7 (+0.1%)
⚪	issue_public_to_public	244,717	244,717		832	832		894,311	894,311		3,929	3,941	+12 (+0.3%)
🔴	redeem_private_to_private_exact	584,459	592,526	+8,067 (+1.4%)	1,856	1,888	+32 (+1.7%)	884,231	915,031	+30,800 (+3.5%)	6,400	6,459	+59 (+0.9%)
⚪	redeem_private_to_public	445,593	447,702	+2,109 (+0.5%)	768	768		858,577	858,577		5,394	5,457	+63 (+1.2%)
🔴	redeem_public_to_private_exact	437,087	461,617	+24,530 (+5.6%)	1,920	1,952	+32 (+1.7%)	915,054	945,854	+30,800 (+3.4%)	5,335	5,517	+182 (+3.4%)
⚪	redeem_public_to_public	244,717	244,717		832	832		890,801	890,801		3,927	3,963	+36 (+0.9%)
🔴	withdraw_private_to_private	536,734	540,785	+4,051 (+0.8%)	1,280	1,312	+32 (+2.5%)	846,869	877,669	+30,800 (+3.6%)	5,945	6,014	+69 (+1.2%)
🔴	withdraw_private_to_private_exact	584,459	592,526	+8,067 (+1.4%)	1,856	1,888	+32 (+1.7%)	884,177	914,977	+30,800 (+3.5%)	6,429	6,508	+79 (+1.2%)
⚪	withdraw_private_to_public_exact	493,244	495,379	+2,135 (+0.4%)	1,344	1,344		896,086	896,086		5,716	5,760	+44 (+0.8%)
🔴	withdraw_public_to_private	360,598	451,538	+90,940 (+25.2%)	1,344	2,528	+1,184 (+88.1%)	877,551	963,426	+85,875 (+9.8%)	4,769	5,470	+701 (+14.7%)
⚪	withdraw_public_to_public	244,717	244,717		832	832		891,104	891,104		3,925	3,938	+13 (+0.3%)