feat(l2): remove public inputs from verify() function in OnChainProposer #4147

pedrobergamini · 2025-08-25T00:28:48Z

Motivation

This PR implements the removal of public inputs from the verifyBatch() function in the OnChainProposer contract. Public inputs are now retrieved from the committed batch data instead of being passed as parameters.

Description

This PR removes public inputs from the verifyBatch function signature and reconstructs them from already-committed batch data. This simplifies the interface and reduces calldata size.

OnChainProposer.sol

Modified verifyBatch signature: Removed the RISC0 journal parameter. Final signature:
- verifyBatch(uint256 batchNumber, bytes risc0BlockProof, bytes sp1ProofBytes, bytes tdxSignature)
SP1: Only sp1ProofBytes is provided. SP1 public values are constructed on-chain as abi.encodePacked(uint64(publicInputs.length), publicInputs), and public data checks use sp1PublicValues[8:].
TDX: Only tdxSignature is provided.
Note: Pico has been removed from the codebase in main.
Added _getPublicInputsFromCommitment: Internal helper that reconstructs 256-byte public inputs from committed batch data:
- bytes 0–32: Initial state root (from last verified batch)
- bytes 32–64: Final state root (from current batch)
- bytes 64–96: Withdrawals merkle root
- bytes 96–128: Processed privileged transactions rolling hash
- bytes 128–160: Blob versioned hash (stateDiff KZG versioned hash)
- bytes 160–192: Last block hash
- bytes 192–224: Chain ID (big-endian)
- bytes 224–256: Non-privileged transactions count (set to 0)
Verifiers updated to use reconstructed public inputs:
- RISC0: sha256(publicInputs)
- SP1: sp1PublicValues = 8-byte length prefix + publicInputs; validation over sp1PublicValues[8:]
- TDX: publicInputs verified against tdxSignature

zkVM Interface Updates

SP1 guest: Commits the 256-byte contract public inputs via commit_slice(output.encode_contract_pis()).
RISC0 guest: Commits the 256-byte contract public inputs via commit_slice(output.encode_contract_pis()).
TDX: Quote generator signs the same 256-byte contract public inputs (encode_contract_pis()).

l1_proof_sender.rs

Updated VERIFY_FUNCTION_SIGNATURE to "verifyBatch(uint256,bytes,bytes,bytes)".
Removed RISC0 journal from calldata.
Simplified calldata construction.

Proving systems

Updated empty_calldata() for proving systems:
- RISC0: Only the Groth16 seal.
- SP1: Only sp1ProofBytes.
- TDX: Only the signature.
- Pico was removed in main.

Previous PR
Closes #2804

…ice; align interfaces

…e sequencer and prover; drop calldata public values

…r to 256-byte PIs

xqft · 2025-08-26T17:28:34Z

crates/l2/contracts/src/l1/OnChainProposer.sol

+            publicInputs[192 + i] = bytes1(uint8(uint256(chainIdBytes) >> (8 * (31 - i))));
+        }
+
+        // Non-privileged transactions count = 0 (bytes 224..256 already zeroed)


this shouldn't be fixed to zero right? the field processedPrivilegedTransactionsRollingHash in the batch commitment contains this value: it's the first two bytes (it's used in line 280 of this file too)

Thanks for flagging this. The last 32 bytes in the contract public inputs are intentionally zero, right? The privileged transaction count is taken from a different place, it’s encoded in the first two bytes of processedPrivilegedTransactionsRollingHash (which we already read to remove pending privileged transactions). Separately, we enforce onchain that if privileged transactions have expired, then the non‑privileged count must be zero. I clarified this intent in comments and kept the last 32 bytes zero by design. Could you confirm you agree the privileged count comes from the rolling‑hash prefix and that the final 32‑byte slot should remai zero?

Sorry! I mixed privileged count up with non-privileged count. Yes it's correct that the non-privileged count should be 0, but in the case where the privileged transaction inclusion time has expired, else the non-privileged count can be any other number, and because it's part of the public inputs of the proof, we need it for verification.

Problem here is that we don't have this number as part of the block commitment, or anywhere in the L1 (we do have the privileged count but we can't derive the non-privileged from that alone), so by removing the public inputs parameter from the verify() function we don't have a way to access this value.

We talked internally with @avilagaston9 and the solution here should be to add the non-privileged count as a new field of the batch commitment. This would require, if I didn't miss anything:

Adding this new field to the BatchCommitmentInfo struct in Solidity

Adding the field as a parameter of the commitBatch() function

Update the send_commitment() function of the L1 commiter module in Rust to add the new field

I think this is necessary to finish this PR so those changes could be added in this same branch. If you have any questions don't hesitate on asking us!

(about the "expire time" thing: this is a mechanism in which we give the sequencer some amount of time to process privileged transactions, else it won't be able to settle non-privileged transactions, so no new transactions until it processes the pending privileged transactions, this is a way to avoid the sequencer to censor L1->L2 messages. For example, if a user deposits some ETH from L1 to L2, they know that the sequencer will include that deposit and their funds won't be lost, else the whole L2 stops)

Thanks for the clarifications sir! All clear, pushing the update in a sec

crates/l2/contracts/src/l1/OnChainProposer.sol

xqft · 2025-08-26T17:35:59Z

crates/l2/prover/zkvm/interface/src/io.rs

+    /// Encode public inputs exactly as expected by the on-chain contract (256 bytes total).
+    /// Layout:
+    /// - 0..32: initial_state_hash
+    /// - 32..64: final_state_hash
+    /// - 64..96: l1messages_merkle_root (withdrawals root)
+    /// - 96..128: privileged_transactions_hash (processed privileged rolling hash)
+    /// - 128..160: blob_versioned_hash
+    /// - 160..192: last_block_hash
+    /// - 192..224: chain_id (big-endian, 32 bytes)
+    /// - 224..256: zeroes (force non-privileged count to 0)
+    #[cfg(feature = "l2")]
+    pub fn encode_contract_pis(&self) -> Vec<u8> {
+        [
+            self.initial_state_hash.to_fixed_bytes(),
+            self.final_state_hash.to_fixed_bytes(),
+            self.l1messages_merkle_root.to_fixed_bytes(),
+            self.privileged_transactions_hash.to_fixed_bytes(),
+            self.blob_versioned_hash.to_fixed_bytes(),
+            self.last_block_hash.to_fixed_bytes(),
+            self.chain_id.to_big_endian(),
+            [0u8; 32],
+        ]
+        .concat()
+    }


this is part of the other comment, I see that the reason this function exists is to hardcode the non-privileged tx count to 0

crates/l2/contracts/src/l1/based/OnChainProposer.sol

crates/l2/prover/zkvm/interface/risc0/src/main.rs

avilagaston9

Hi @pedrobergamini! Thanks for your contribution. Left some comments

avilagaston9 · 2025-09-01T20:55:15Z

crates/l2/contracts/src/l1/OnChainProposer.sol

            );
        }

        if (SP1VERIFIER != DEV_MODE) {
            // If the verification fails, it will revert.
-            _verifyPublicData(batchNumber, sp1PublicValues[8:]);
+            _verifyPublicData(batchNumber, publicInputs);


Given that we are constructing the publicInputs from the values of BatchCommitmentInfo there is no need to call _verifyPublicData() as it will always pass. We can remove the function. The only check that should remain is the hasExpiredPrivilegedTransactions() call.

The comment applies for both based and non-based contract.

avilagaston9 · 2025-09-01T21:03:56Z

crates/l2/prover/zkvm/interface/sp1/src/main.rs

+    // Commit the contract public inputs
+    sp1_zkvm::io::commit_slice(&output.encode_contract_pis());


Let's restore this, remove the encode_contract_pis() function, and update the ProgramOutput::encode() method to reflect the new changes instead. This change will break the proving of L1 blocks.

I would keep the commit_slice() function though, so not entirely restore the line but just change it to commit_slice(output.encode())

avilagaston9 · 2025-09-01T21:26:10Z

crates/l2/sequencer/l1_committer.rs

+        // Compute non-privileged transactions count for the batch
+        let mut total_txs: u64 = 0;
+        let mut privileged_txs: u64 = 0;
+
+        for i in batch.first_block..=batch.last_block {
+            let block_body = self
+                .store
+                .get_block_body(i)
+                .await
+                .map_err(CommitterError::from)?
+                .ok_or(CommitterError::FailedToRetrieveDataFromStorage)?;
+
+            let txs_in_block: u64 = block_body
+                .transactions
+                .len()
+                .try_into()
+                .unwrap_or(u64::MAX);
+            total_txs = total_txs.saturating_add(txs_in_block);
+            let priv_in_block = get_block_privileged_transactions(&block_body.transactions);
+            let priv_in_block_count: u64 = priv_in_block.len().try_into().unwrap_or(u64::MAX);
+            privileged_txs = privileged_txs.saturating_add(priv_in_block_count);
+        }
+        let non_privileged_count = total_txs.saturating_sub(privileged_txs);
+


We can add a new field, non_privileged_count, to our Batch struct and return its value as the result of prepare_batch_from_block() to avoid fetching and iterating over the blocks again.

avilagaston9 · 2025-09-01T21:28:56Z

crates/l2/sequencer/l1_committer.rs

+            // Insert count before encoded blocks for based ABI
+            calldata_values.push(Value::Uint(U256::from(non_privileged_count)));
            calldata_values.push(Value::Array(
                encoded_blocks.into_iter().map(Value::Bytes).collect(),
            ));

            (COMMIT_FUNCTION_SIGNATURE_BASED, calldata_values)
        } else {
+            // Append count as last arg for non-based ABI
+            calldata_values.push(Value::Uint(U256::from(non_privileged_count)));


We can call calldata_values.push(Value::Uint(U256::from(non_privileged_count))); only once before line 460.

xqft · 2025-09-02T14:35:46Z

crates/l2/contracts/src/l1/based/OnChainProposer.sol

+        // Note: the last 32 bytes encode the non-privileged transaction count.
+        // The privileged transaction count is encoded separately in the first two bytes of
+        // `processedPrivilegedTransactionsRollingHash` and is handled during verification.
+        return abi.encodePacked(


in the non-based version you used bytes.concat() here, we should use the same function for both implementations, I think bytes.concat() is clearer

pedrobergamini added 3 commits August 24, 2025 19:55

feat(l2): remove public inputs from verifyBatch; update SP1 commit_sl…

ac3fc56

…ice; align interfaces

feat(l2): reconstruct public inputs on-chain; sp1 commit_slice; updat…

f85dd16

…e sequencer and prover; drop calldata public values

feat(l2): remove PIs from verifyBatch; align RISC0/SP1/TDX + sequence…

6b5aa11

…r to 256-byte PIs

pedrobergamini requested review from jrchatruc, ManuelBilbao and a team as code owners August 25, 2025 00:28

chore: delete pico/Cargo.lock

3a62308

pedrobergamini changed the title ~~Feat/remove public inputs clean~~ feat(l2): remove public inputs from verify() function in OnChainProposer Aug 25, 2025

xqft reviewed Aug 26, 2025

View reviewed changes

pedrobergamini added 6 commits August 26, 2025 17:19

chore: address review comments

977c476

chore: use bytes.concat

b937328

chore: remove unnecessary slicing

34258d3

fix: pass publicInputs instead of slicing-off the first 8 bytes

3c9ab65

fix: CI issues

961ce11

feat(l2): include non-privileged tx count in commitment/PIs

73b88d8

avilagaston9 requested changes Sep 1, 2025

View reviewed changes

xqft reviewed Sep 2, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(l2): remove public inputs from verify() function in OnChainProposer #4147

feat(l2): remove public inputs from verify() function in OnChainProposer #4147

pedrobergamini commented Aug 25, 2025

Uh oh!

xqft Aug 26, 2025

Uh oh!

pedrobergamini Aug 26, 2025 •

edited

Loading

Uh oh!

xqft Aug 27, 2025 •

edited

Loading

Uh oh!

pedrobergamini Aug 28, 2025

Uh oh!

Uh oh!

xqft Aug 26, 2025

Uh oh!

Uh oh!

Uh oh!

avilagaston9 left a comment

Uh oh!

avilagaston9 Sep 1, 2025

Uh oh!

avilagaston9 Sep 1, 2025

Uh oh!

avilagaston9 Sep 1, 2025

Uh oh!

xqft Sep 2, 2025

Uh oh!

avilagaston9 Sep 1, 2025

Uh oh!

avilagaston9 Sep 1, 2025

Uh oh!

xqft Sep 2, 2025

Uh oh!

Uh oh!

		// Commit the contract public inputs
		sp1_zkvm::io::commit_slice(&output.encode_contract_pis());

feat(l2): remove public inputs from verify() function in OnChainProposer #4147

Are you sure you want to change the base?

feat(l2): remove public inputs from verify() function in OnChainProposer #4147

Conversation

pedrobergamini commented Aug 25, 2025

Motivation

Description

OnChainProposer.sol

zkVM Interface Updates

l1_proof_sender.rs

Proving systems

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pedrobergamini Aug 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

xqft Aug 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

avilagaston9 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pedrobergamini Aug 26, 2025 •

edited

Loading

xqft Aug 27, 2025 •

edited

Loading