feat: WIP integrate batched blobs into l1 contracts + ts

l1-contracts/src/core/Rollup.sol

@@ -317,7 +317,7 @@ contract Rollup is IStaking, IValidatorSelection, IRollup, RollupCore {
     external
     view
     override(IRollup)
-    returns (bytes32[] memory, bytes32, bytes32)
+    returns (bytes32[] memory, bytes32, bytes[] memory)
   {
     return ExtRollupLib.validateBlobs(_blobsInput, checkBlob);
   }
@@ -358,13 +358,18 @@ contract Rollup is IStaking, IValidatorSelection, IRollup, RollupCore {
     return FeeHeaderLib.decompress(FeeLib.getStorage().feeHeaders[_blockNumber]);
   }
 
-  function getBlobPublicInputsHash(uint256 _blockNumber)
+  function getBlobCommitmentsHash(uint256 _blockNumber)
     external
     view
     override(IRollup)
     returns (bytes32)
   {
-    return STFLib.getStorage().blobPublicInputsHashes[_blockNumber];
+    return STFLib.getStorage().blobCommitmentsHash[_blockNumber];
+  }
+
+  function getCurrentBlobCommitmentsHash() external view override(IRollup) returns (bytes32) {
+    RollupStore storage rollupStore = STFLib.getStorage();
+    return rollupStore.blobCommitmentsHash[rollupStore.tips.pendingBlockNumber];
   }
 
   function getProposerAtIndex(uint256 _index) external view override(IStaking) returns (address) {

l1-contracts/src/core/interfaces/IRollup.sol

@@ -27,7 +27,7 @@ struct SubmitEpochRootProofArgs {
   uint256 end; // inclusive
   PublicInputArgs args;
   bytes32[] fees;
-  bytes blobPublicInputs;
+  bytes blobInputs;
   bytes proof;
 }
 
@@ -93,18 +93,18 @@ struct RollupConfig {
   uint256 version;
 }
 
-// The below blobPublicInputsHashes are filled when proposing a block, then used to verify an epoch proof.
-// TODO(#8955): When implementing batched kzg proofs, store one instance per epoch rather than block
 struct RollupStore {
   ChainTips tips; // put first such that the struct slot structure is easy to follow for cheatcodes
   mapping(uint256 blockNumber => BlockLog log) blocks;
-  mapping(uint256 blockNumber => bytes32) blobPublicInputsHashes;
   mapping(address => uint256) sequencerRewards;
   mapping(Epoch => EpochRewards) epochRewards;
   // @todo Below can be optimised with a bitmap as we can benefit from provers likely proving for epochs close
   // to one another.
   mapping(address prover => mapping(Epoch epoch => bool claimed)) proverClaimed;
   RollupConfig config;
+  // TODO(MW): We only ever need to store AZTEC_MAX_EPOCH_DURATION values below => make fixed length and overwrite once we start a new epoch
+  // Requires us to clear values on successful proven epoch and check when a block starts a new epoch.
+  mapping(uint256 blockNumber => bytes32) blobCommitmentsHash; // = H(...H(H(commitment_0), commitment_1).... commitment_n - used to validate we are using the same blob commitments on L1 and in the rollup circuit
 }
 
 interface ITestRollup {
@@ -184,7 +184,7 @@ interface IRollup is IRollupCore {
   function validateBlobs(bytes calldata _blobsInputs)
     external
     view
-    returns (bytes32[] memory, bytes32, bytes32);
+    returns (bytes32[] memory, bytes32, bytes[] memory);
 
   function getManaBaseFeeComponentsAt(Timestamp _timestamp, bool _inFeeAsset)
     external
@@ -203,7 +203,8 @@ interface IRollup is IRollupCore {
   function getPendingBlockNumber() external view returns (uint256);
   function getBlock(uint256 _blockNumber) external view returns (BlockLog memory);
   function getFeeHeader(uint256 _blockNumber) external view returns (FeeHeader memory);
-  function getBlobPublicInputsHash(uint256 _blockNumber) external view returns (bytes32);
+  function getBlobCommitmentsHash(uint256 _blockNumber) external view returns (bytes32);
+  function getCurrentBlobCommitmentsHash() external view returns (bytes32);
 
   function getSequencerRewards(address _sequencer) external view returns (uint256);
   function getCollectiveProverRewardsForEpoch(Epoch _epoch) external view returns (uint256);

l1-contracts/src/core/libraries/ConstantsGen.sol

@@ -23,10 +23,9 @@ library Constants {
   uint256 internal constant GENESIS_ARCHIVE_ROOT =
     1002640778211850180189505934749257244705296832326768971348723156503780793518;
   uint256 internal constant FEE_JUICE_ADDRESS = 5;
-  uint256 internal constant BLOB_PUBLIC_INPUTS = 6;
-  uint256 internal constant BLOB_PUBLIC_INPUTS_BYTES = 112;
+  uint256 internal constant BLS12_POINT_COMPRESSED_BYTES = 48;
   uint256 internal constant PROPOSED_BLOCK_HEADER_LENGTH_BYTES = 348;
-  uint256 internal constant ROOT_ROLLUP_PUBLIC_INPUTS_LENGTH = 1015;
+  uint256 internal constant ROOT_ROLLUP_PUBLIC_INPUTS_LENGTH = 158;
   uint256 internal constant NUM_MSGS_PER_BASE_PARITY = 4;
   uint256 internal constant NUM_BASE_PARITY_PER_ROOT_PARITY = 4;
 }

l1-contracts/src/core/libraries/Errors.sol

@@ -57,9 +57,8 @@ library Errors {
   error Rollup__InvalidProof(); // 0xa5b2ba17
   error Rollup__InvalidProposedArchive(bytes32 expected, bytes32 actual); // 0x32532e73
   error Rollup__InvalidTimestamp(Timestamp expected, Timestamp actual); // 0x3132e895
-  error Rollup__InvalidBlobHash(bytes32 blobHash); // 0xc4a168c6
+  error Rollup__InvalidBlobHash(bytes32 expected, bytes32 actual); // 0x13031e6a
   error Rollup__InvalidBlobProof(bytes32 blobHash); // 0x5ca17bef
-  error Rollup__InvalidBlobPublicInputsHash(bytes32 expected, bytes32 actual); // 0xfe6b4994
   error Rollup__NoEpochToProve(); // 0xcbaa3951
   error Rollup__NonSequentialProving(); // 0x1e5be132
   error Rollup__NothingToPrune(); // 0x850defd3
@@ -71,9 +70,10 @@ library Errors {
   error Rollup__NonZeroDaFee(); // 0xd9c75f52
   error Rollup__InvalidBasisPointFee(uint256 basisPointFee); // 0x4292d136
   error Rollup__InvalidManaBaseFee(uint256 expected, uint256 actual); // 0x73b6d896
-  error Rollup__StartAndEndNotSameEpoch(Epoch start, Epoch end);
-  error Rollup__StartIsNotFirstBlockOfEpoch();
-  error Rollup__StartIsNotBuildingOnProven();
+  error Rollup__StartAndEndNotSameEpoch(Epoch start, Epoch end); // 0xb64ec33e
+  error Rollup__StartIsNotFirstBlockOfEpoch(); // 0x4ef11e0d
+  error Rollup__StartIsNotBuildingOnProven(); // 0x4a59f42e
+  error Rollup__TooManyBlocksInEpoch(uint256 expected, uint256 actual); // 0x7d5b1408
   error Rollup__AlreadyClaimed(address prover, Epoch epoch);
   error Rollup__NotPastDeadline(Slot deadline, Slot currentSlot);
   error Rollup__PastDeadline(Slot deadline, Slot currentSlot);

l1-contracts/src/core/libraries/rollup/BlobLib.sol

@@ -29,8 +29,8 @@ library BlobLib {
    * @notice  Validate an L2 block's blobs and return the hashed blobHashes and public inputs.
    * Input bytes:
    * input[:1] - num blobs in block
-   * input[1:] - 192 * num blobs of the above _blobInput
-   * @param _blobsInput - The above bytes to verify a blob
+   * input[1:] - blob commitments (48 bytes * num blobs in block)
+   * @param _blobsInput - The above bytes to verify our input blob commitments match real blobs
    */
   function validateBlobs(bytes calldata _blobsInput, bool _checkBlob)
     internal
@@ -39,64 +39,59 @@ library BlobLib {
       // All of the blob hashes included in this blob
       bytes32[] memory blobHashes,
       bytes32 blobsHashesCommitment,
-      bytes32 blobPublicInputsHash
+      bytes[] memory blobCommitments
     )
   {
     // We cannot input the incorrect number of blobs below, as the blobsHash
     // and epoch proof verification will fail.
     uint8 numBlobs = uint8(_blobsInput[0]);
     blobHashes = new bytes32[](numBlobs);
-    bytes memory blobPublicInputs;
+    blobCommitments = new bytes[](numBlobs);
+    bytes32 blobHash;
+    // Add 1 for the numBlobs prefix
+    uint256 blobInputStart = 1;
     for (uint256 i = 0; i < numBlobs; i++) {
-      // Add 1 for the numBlobs prefix
-      uint256 blobInputStart = i * 192 + 1;
-      // Since an invalid blob hash here would fail the consensus checks of
-      // the header, the `blobInput` is implicitly accepted by consensus as well.
-      blobHashes[i] = validateBlob(_blobsInput[blobInputStart:blobInputStart + 192], i, _checkBlob);
-      // We want to extract the 112 bytes we use for public inputs:
-      //  * input[32:64]   - z
-      //  * input[64:96]   - y
-      //  * input[96:144]  - commitment C
-      // Out of 192 bytes per blob.
-      blobPublicInputs = abi.encodePacked(
-        blobPublicInputs,
-        _blobsInput[blobInputStart + 32:blobInputStart + 32 + Constants.BLOB_PUBLIC_INPUTS_BYTES]
+      // Commitments = arrays of bytes48 compressed points
+      blobCommitments[i] = abi.encodePacked(
+        _blobsInput[blobInputStart:blobInputStart + Constants.BLS12_POINT_COMPRESSED_BYTES]
       );
+      blobInputStart += Constants.BLS12_POINT_COMPRESSED_BYTES;
+
+      // TODO(MW): Use kzg_to_versioned_hash & VERSIONED_HASH_VERSION_KZG
+      // Using bytes32 array to force bytes into memory
+      bytes32[1] memory blobHashCheck = [sha256(blobCommitments[i])];
+      assembly {
+        mstore8(blobHashCheck, 0x01)
+      }
+      if (_checkBlob) {
+        assembly {
+          blobHash := blobhash(i)
+        }
+        require(
+          blobHash == blobHashCheck[0], Errors.Rollup__InvalidBlobHash(blobHash, blobHashCheck[0])
+        );
+      } else {
+        blobHash = blobHashCheck[0];
+      }
+      blobHashes[i] = blobHash;
     }
-    // Return the hash of all z, y, and Cs, so we can use them in proof verification later
-    blobPublicInputsHash = sha256(blobPublicInputs);
     // Hash the EVM blob hashes for the block header
     blobsHashesCommitment = Hash.sha256ToField(abi.encodePacked(blobHashes));
   }
 
   /**
-   * @notice  Validate a blob.
+   * @notice  Validate a batched blob.
    * Input bytes:
-   * input[:32]     - versioned_hash
-   * input[32:64]   - z
-   * input[64:96]   - y
-   * input[96:144]  - commitment C
-   * input[144:192] - proof (a commitment to the quotient polynomial q(X))
-   *  - This can be relaxed to happen at the time of `submitProof` instead
-   * @notice Apparently there is no guarantee that the blobs will be processed in the order sent
-   * so the use of blobhash(_blobNumber) may fail in production
-   * @param _blobInput - The above bytes to verify a blob
+   * input[:32]     - versioned_hash - NB for a batched blob, this is simply the versioned hash of the batched commitment
+   * input[32:64]   - z = poseidon2( ...poseidon2(poseidon2(z_0, z_1), z_2) ... z_n)
+   * input[64:96]   - y = y_0 + gamma * y_1 + gamma^2 * y_2 + ... + gamma^n * y_n
+   * input[96:144]  - commitment C = C_0 + gamma * C_1 + gamma^2 * C_2 + ... + gamma^n * C_n
+   * input[144:192] - proof (a commitment to the quotient polynomial q(X)) = Q_0 + gamma * C_1 + gamma^2 * C_2 + ... + gamma^n * C_n
+   * @param _blobInput - The above bytes to verify a batched blob
    */
-  function validateBlob(bytes calldata _blobInput, uint256 _blobNumber, bool _checkBlob)
-    internal
-    view
-    returns (bytes32 blobHash)
-  {
-    if (!_checkBlob) {
-      return bytes32(_blobInput[0:32]);
-    }
-    assembly {
-      blobHash := blobhash(_blobNumber)
-    }
-    require(blobHash == bytes32(_blobInput[0:32]), Errors.Rollup__InvalidBlobHash(blobHash));
-
+  function validateBatchedBlob(bytes calldata _blobInput) internal view returns (bool success) {
     // Staticcall the point eval precompile https://eips.ethereum.org/EIPS/eip-4844#point-evaluation-precompile :
-    (bool success,) = address(0x0a).staticcall(_blobInput);
-    require(success, Errors.Rollup__InvalidBlobProof(blobHash));
+    (success,) = address(0x0a).staticcall(_blobInput);
+    require(success, Errors.Rollup__InvalidBlobProof(bytes32(_blobInput[0:32])));
   }
 }