feat: upstream domain vk proving (#424)

Author: keyleu

Cargo.lock

@@ -1708,11 +1708,19 @@
               "execute_zk_authorization": {
                 "type": "object",
                 "required": [
+                  "domain_message",
+                  "domain_proof",
                   "label",
                   "message",
                   "proof"
                 ],
                 "properties": {
+                  "domain_message": {
+                    "$ref": "#/definitions/Binary"
+                  },
+                  "domain_proof": {
+                    "$ref": "#/definitions/Binary"
+                  },
                   "label": {
                     "type": "string"
                   },

contracts/authorization/schema/valence-authorization.json

@@ -176,7 +176,18 @@ pub fn execute(
                 label,
                 message,
                 proof,
-            } => execute_zk_authorization(deps, env, info, label, message, proof),
+                domain_message,
+                domain_proof,
+            } => execute_zk_authorization(
+                deps,
+                env,
+                info,
+                label,
+                message,
+                proof,
+                domain_message,
+                domain_proof,
+            ),
         },
         ExecuteMsg::InternalAuthorizationAction(internal_authorization_msg) => {
             match internal_authorization_msg {
@@ -910,13 +921,16 @@ fn set_verification_gateway(
         .add_attribute("verification_gateway", verification_gateway))
 }
 
+#[allow(clippy::too_many_arguments)]
 fn execute_zk_authorization(
     deps: DepsMut,
     env: Env,
     info: MessageInfo,
     label: String,
     message: Binary,
     proof: Binary,
+    domain_message: Binary,
+    domain_proof: Binary,
 ) -> Result<Response, ContractError> {
     let zk_authorization = ZK_AUTHORIZATIONS
         .load(deps.storage, label.clone())
@@ -946,7 +960,7 @@ fn execute_zk_authorization(
 
     // Verify the proof with the verification gateway
     let valid: bool = deps.querier.query_wasm_smart(
-        verification_gateway,
+        verification_gateway.clone(),
         &valence_verification_gateway::msg::QueryMsg::VerifyProof {
             vk: zk_authorization.vk,
             proof,
@@ -957,6 +971,27 @@ fn execute_zk_authorization(
         return Err(ContractError::ZK(ZKErrorReason::InvalidZKProof {}));
     }
 
+    // Verify the domain proof with the verification gateway
+    let valid_domain: bool = deps.querier.query_wasm_smart(
+        verification_gateway,
+        &valence_verification_gateway::msg::QueryMsg::VerifyDomainProof {
+            domain_proof,
+            domain_inputs: domain_message.clone(),
+        },
+    )?;
+    if !valid_domain {
+        return Err(ContractError::ZK(ZKErrorReason::InvalidZKProof {}));
+    }
+
+    // Compare the first 32 bytes of both messages to ensure the coprocessor root is the same
+    let message_slice = message.as_slice();
+    let domain_message_slice = domain_message.as_slice();
+    let message_coprocessor_root = &message_slice[..32];
+    let domain_message_coprocessor_root = &domain_message_slice[..32];
+    if message_coprocessor_root != domain_message_coprocessor_root {
+        return Err(ContractError::ZK(ZKErrorReason::InvalidCoprocessorRoot {}));
+    }
+
     // Now that proof is validated we are going to extract the ZkMessage from the message
     // This is done by discarding the first 32 bytes of the message which belong to the coprocessor root and I don't need
     let message_slice = message.as_slice();

contracts/authorization/src/contract.rs

@@ -155,4 +155,7 @@ pub enum ZKErrorReason {
 
     #[error("This message is not for this authorization contract!")]
     InvalidAuthorizationContract {},
+
+    #[error("Invalid Coprocessor root")]
+    InvalidCoprocessorRoot {},
 }

contracts/authorization/src/error.rs

@@ -12,7 +12,7 @@ impl NeutronTestAppBuilder {
     pub fn new() -> Self {
         NeutronTestAppBuilder {
             fee_denom: FEE_DENOM.to_string(),
-            initial_balance: 100_000_000_000,
+            initial_balance: 100_000_000_000_000,
             num_accounts: 5,
         }
     }

contracts/authorization/src/tests/builders.rs

@@ -1,3 +1,4 @@
+use cosmwasm_std::Binary;
 use margined_neutron_std::types::{
     cosmos::base::v1beta1::Coin,
     cosmwasm::wasm::v1::{
@@ -201,6 +202,8 @@ pub fn instantiate_and_set_verification_gateway(
     app: &NeutronTestApp,
     signer: &SigningAccount,
     authorization: String,
+    owner: String,
+    domain_vk: Binary,
 ) {
     let wasm = Wasm::new(app);
     let code_id = wasm
@@ -216,7 +219,7 @@ pub fn instantiate_and_set_verification_gateway(
     let verification_gateway = wasm
         .instantiate(
             code_id,
-            &valence_verification_gateway::msg::InstantiateMsg {},
+            &valence_verification_gateway::msg::InstantiateMsg { domain_vk, owner },
             None,
             "verification_gateway".into(),
             &[],

contracts/authorization/src/tests/helpers.rs

@@ -768,12 +768,6 @@ fn pause_and_resume_processor_using_zk_authorizations() {
         vec![],
     );
 
-    instantiate_and_set_verification_gateway(
-        &setup.app,
-        &setup.owner_accounts[0],
-        authorization.clone(),
-    );
-
     // VK of the program that accepts 2 registry values and creates a message to pause the processor for registry 1 and
     // creates a message to resume it for registry 2
     let program_vk = "LMOPRy+6Xxgx8zUgILvnM0dXQT4shd9cZs9UbVrVazpUvSAARnj1VX+iHQETTMo3wWZBFOK2U1ulExNWmKo8AxPLGxdMzm5rqCF/OF4QO0IfjGhF/GPMJNGeOi8CAAAAAAAAAAcAAAAAAAAAUHJvZ3JhbRMAAAAAAAAAAQAAAA4AAAAAAAAAAAAIAAAAAAAEAAAAAAAAAEJ5dGUQAAAAAAAAAAEAAAALAAAAAAAAAAAAAQAAAAAAAgAAAAAAAAAEAAAAAAAAAEJ5dGUBAAAAAAAAAAcAAAAAAAAAUHJvZ3JhbQAAAAAAAAAA";
@@ -797,6 +791,14 @@ fn pause_and_resume_processor_using_zk_authorizations() {
     )
     .unwrap();
 
+    instantiate_and_set_verification_gateway(
+        &setup.app,
+        &setup.owner_accounts[0],
+        authorization.clone(),
+        setup.owner_addr.to_string(),
+        Binary::from(sp1_vk.bytes32().into_bytes()),
+    );
+
     // Let's create two zk authorizations, one to pause the processor and another to resume it, pause will have registry 1 and resume will have registry 2
     let zk_authorization_pause = ZkAuthorizationInfo {
         label: "pause".to_string(),
@@ -843,6 +845,8 @@ fn pause_and_resume_processor_using_zk_authorizations() {
             label: "pause".to_string(),
             message: Binary::from(proof_pause_inputs.clone()),
             proof: Binary::from(proof_pause_bytes.clone()),
+            domain_message: Binary::from(proof_pause_inputs.clone()),
+            domain_proof: Binary::from(proof_pause_bytes.clone()),
         }),
         &[],
         &setup.user_accounts[0],
@@ -867,8 +871,10 @@ fn pause_and_resume_processor_using_zk_authorizations() {
         &authorization,
         &ExecuteMsg::PermissionlessAction(PermissionlessMsg::ExecuteZkAuthorization {
             label: "resume".to_string(),
-            message: Binary::from(proof_resume_inputs),
-            proof: Binary::from(proof_resume_bytes),
+            message: Binary::from(proof_resume_inputs.clone()),
+            proof: Binary::from(proof_resume_bytes.clone()),
+            domain_message: Binary::from(proof_resume_inputs),
+            domain_proof: Binary::from(proof_resume_bytes),
         }),
         &[],
         &setup.user_accounts[0],
@@ -903,8 +909,10 @@ fn pause_and_resume_processor_using_zk_authorizations() {
             &authorization,
             &ExecuteMsg::PermissionlessAction(PermissionlessMsg::ExecuteZkAuthorization {
                 label: "pause".to_string(),
-                message: Binary::from(proof_pause_inputs),
-                proof: Binary::from(proof_pause_bytes),
+                message: Binary::from(proof_pause_inputs.clone()),
+                proof: Binary::from(proof_pause_bytes.clone()),
+                domain_message: Binary::from(proof_pause_inputs),
+                domain_proof: Binary::from(proof_pause_bytes),
             }),
             &[],
             &setup.user_accounts[0],

contracts/authorization/src/tests/user_actions.rs

@@ -16,6 +16,8 @@ library = []
 [dependencies]
 cosmwasm-schema = { workspace = true }
 cosmwasm-std    = { workspace = true }
+cw-storage-plus = { workspace = true }
+cw-ownable      = { workspace = true }
 cw2             = { workspace = true }
 thiserror       = { workspace = true }
 sp1-verifier    = "5.0.0"