feat: calldata length validation of public setup function allowlist by mrzeszutko · Pull Request #21139 · AztecProtocol/aztec-packages

mrzeszutko · 2026-03-04T20:27:19Z

Summary

Add calldata length validation to the public setup function allowlist in PhasesTxValidator, preventing setup calls with malformed arguments from being accepted
Extend AllowedElement with an optional calldataLength field and compute expected lengths dynamically from contract artifacts (AuthRegistry, FeeJuice, Token)
Reject setup calls where calldata length doesn't match the expected length for the matched allowlist entry, returning a new TX_ERROR_SETUP_WRONG_CALLDATA_LENGTH error

Details

Even when a setup function call matches the allowlist by address/class and selector, it can still revert if the arguments are malformed. Since Aztec's ABI has no variable-size inputs, validating that the calldata length matches the expected length for a given selector is sufficient to guarantee the arguments are deserializable.

AllowedElement type (stdlib): Added optional calldataLength?: number to both AllowedInstanceFunction and AllowedClassFunction, plus corresponding Zod schema updates.

PhasesTxValidator (p2p): After matching an entry by address or class+selector, checks entry.calldataLength against publicCall.calldata.length before proceeding to onlySelf/rejectNullMsgSender checks. When calldataLength is not set, any length is accepted (backwards compatible).

Default allowlist (p2p): Uses getFunctionArtifactByName + countArgumentsSize from stdlib/abi to compute expected calldata lengths from AuthRegistryArtifact, FeeJuiceArtifact, and TokenContractArtifact.

Fixes A-612

spalladino

Looks good! My only concern is if the public calldata encoding does not behave as we expect in countArgumentsSize. But I understand that would be caught by one of the e2e_fees tests that depend on the allowlist, right?

spalladino · 2026-03-04T20:36:38Z

yarn-project/p2p/src/msg_validators/tx_validator/allowed_public_setup.ts


+/** Returns the expected calldata length for a function: 1 (selector) + arguments size. */
+function getCalldataLength(artifact: ContractArtifact, functionName: string): number {
+  return 1 + countArgumentsSize(getFunctionArtifactByName(artifact, functionName));


Hmm seems like CI is choking here. We may need to look more into getFunctionArtifactByName.

yes, I noticed, looking if I can fix it quickly, the other option is to hardcode the expected length for the allowlist as we know it, wdyt?

Let's not rush it

mrzeszutko · 2026-03-04T21:02:47Z

Looks good! My only concern is if the public calldata encoding does not behave as we expect in countArgumentsSize. But I understand that would be caught by one of the e2e_fees tests that depend on the allowlist, right?

Right - number of e2e tests would fail (as we actually already saw)

…21139) ## Summary - Add calldata length validation to the public setup function allowlist in `PhasesTxValidator`, preventing setup calls with malformed arguments from being accepted - Extend `AllowedElement` with an optional `calldataLength` field and compute expected lengths dynamically from contract artifacts (`AuthRegistry`, `FeeJuice`, `Token`) - Reject setup calls where calldata length doesn't match the expected length for the matched allowlist entry, returning a new `TX_ERROR_SETUP_WRONG_CALLDATA_LENGTH` error ## Details Even when a setup function call matches the allowlist by address/class and selector, it can still revert if the arguments are malformed. Since Aztec's ABI has no variable-size inputs, validating that the calldata length matches the expected length for a given selector is sufficient to guarantee the arguments are deserializable. **AllowedElement type** (`stdlib`): Added optional `calldataLength?: number` to both `AllowedInstanceFunction` and `AllowedClassFunction`, plus corresponding Zod schema updates. **PhasesTxValidator** (`p2p`): After matching an entry by address or class+selector, checks `entry.calldataLength` against `publicCall.calldata.length` before proceeding to `onlySelf`/`rejectNullMsgSender` checks. When `calldataLength` is not set, any length is accepted (backwards compatible). **Default allowlist** (`p2p`): Uses `getFunctionArtifactByName` + `countArgumentsSize` from `stdlib/abi` to compute expected calldata lengths from `AuthRegistryArtifact`, `FeeJuiceArtifact`, and `TokenContractArtifact`. Fixes A-612

AztecBot · 2026-03-04T21:21:28Z

✅ Successfully backported to backport-to-v4-staging #21064.

BEGIN_COMMIT_OVERRIDE chore: chonk proof compression poc (#20645) feat: Update L1 to L2 message APIs (#20913) fix: adapt chonk proof compression for v4 Translator layout (#21067) fix: omit bigint priceBumpPercentage from IPC config in testbench worker (#21086) feat: standby mode for prover broker (#21098) fix(p2p): remove default block handler in favor of block handler (#21105) chore: prepare barretenberg-rs for crates.io publishing (#20496) feat: reenable function selectors + additional validation in public setup allowlist (backport #20909, #21122) (#21129) chore: remove stale aes comments (#21133) chore: remove auto-tag job (#21127) feat: calldata length validation of public setup function allowlist (#21139) feat: run AVM NAPI simulations on dedicated threads instead of libuv pool (#21138) feat: Remove non-protocol contracts from public setup allowlist (#21154) END_COMMIT_OVERRIDE --------- Co-authored-by: ledwards2225 <ledwards2225@users.noreply.github.com> Co-authored-by: PhilWindle <PhilWindle@users.noreply.github.com> Co-authored-by: ludamad <adam.domurad@gmail.com> Co-authored-by: mrzeszutko <mrzeszutko@users.noreply.github.com> Co-authored-by: spalladino <spalladino@users.noreply.github.com> Co-authored-by: johnathan79717 <johnathan79717@users.noreply.github.com> Co-authored-by: nventuro <nventuro@users.noreply.github.com> Co-authored-by: alexghr <alexghr@users.noreply.github.com> Co-authored-by: AztecBot <AztecBot@users.noreply.github.com> Co-authored-by: Martin Verzilli <martin@aztec-labs.com>

BEGIN_COMMIT_OVERRIDE test: update proving-real test to mbps (#20991) chore: epoch proving log analyzer (#21033) chore: update pause script to allow resume (#21032) feat: price bump for RPC transaction replacement (#20806) refactor: remove update checker, retain version checks (#20898) fix: (A-592) p2p client proposal tx collector test (#20998) refactor: use publishers-per-pod in deployments (#21039) chore: web3signer refreshes keystore (#21045) feat(sequencer): set block building limits from checkpoint limits (#20974) chore(e2e): fix e2e bot L1 tx nonce reuse (#21052) feat: Update L1 to L2 message APIs (#20913) fix: (A-589) epochs l1 reorgs test (#20999) feat(sequencer): add SEQ_MAX_TX_PER_CHECKPOINT config (#21016) fix: drop --pid=host from docker_isolate (#21081) feat: standby mode for prover broker (#21098) fix(p2p): remove default block handler in favor of block handler (#21105) feat(validator): add VALIDATOR_ env vars for independent block limits (#21060) refactor(p2p): decouple proposal validators from base class via composition (#21075) feat: additional validation in public setup allowlist (onlySelf + null msg sender) (#21122) fix: (A-591) aztecProofSubmissionEpochs incorrectly named as aztecProofSubmissionWindow (#21108) refactor(sequencer): rename SEQ_GAS_PER_BLOCK_ALLOCATION_MULTIPLIER to SEQ_PER_BLOCK_ALLOCATION_MULTIPLIER (#21125) fix: unbound variable in check_doc_references.sh with set -u (#21126) feat: calldata length validation of public setup function allowlist (#21139) fix: include mismatched values in tx metadata validation errors (#21147) feat: single-node implementation of slash-protection signer (#20894) feat: Remove non-protocol contracts from public setup allowlist (#21154) chore: More updated Alpha configuration (#21155) chore: tally slashing pruning improvements (#21161) fix: update dependencies (#20997) fix: omit bigint priceBumpPercentage from IPC config in testbench worker (#21169) refactor(p2p): (A-588) maintain sorted array in tx pool instead of sorting on read (#21079) fix(p2p): report most severe failure in runValidations (#21185) fix: use dedicated L1 account for bot bridge resume tests to avoid nonce race (#21148) fix: parse error.message in formatViemError (#21163) fix: bump lighthouse consensus client v7.1.0 -> v8.0.1 (#21170) chore: code decuplication + refactor (public setup allowlist) (#21200) END_COMMIT_OVERRIDE

BEGIN_COMMIT_OVERRIDE chore: chonk proof compression poc (#20645) feat: Update L1 to L2 message APIs (#20913) fix: adapt chonk proof compression for v4 Translator layout (#21067) fix: omit bigint priceBumpPercentage from IPC config in testbench worker (#21086) feat: standby mode for prover broker (#21098) fix(p2p): remove default block handler in favor of block handler (#21105) chore: prepare barretenberg-rs for crates.io publishing (#20496) feat: reenable function selectors + additional validation in public setup allowlist (backport #20909, #21122) (#21129) chore: remove stale aes comments (#21133) chore: remove auto-tag job (#21127) feat: calldata length validation of public setup function allowlist (#21139) feat: run AVM NAPI simulations on dedicated threads instead of libuv pool (#21138) feat: Remove non-protocol contracts from public setup allowlist (#21154) feat!: Expose offchain effects when simulating/sending txs (backport #20563) (#21110) chore: bump minor version (#21171) chore: backport #21161 (tally slashing pruning improvements) to v4 (#21166) chore: More updated Alpha configuration (backport #21155) (#21165) fix(p2p): report most severe failure in runValidations (#21185) feat: add ergonomic conversions for Noir's `Option<T>` (#21107) docs: clarifying Noir fields vs struct fields in event metadata (#21172) fix: bump lighthouse consensus client v7.1.0 -> v8.0.1 (#21170) fix: update dependencies (#20997) chore: New alpha-net environment (#20800) (#21202) chore: code decuplication + refactor (public setup allowlist) (#21200) feat: mask all ciphertext fields with Poseidon2-derived values (backport #21009) (#21140) chore: disable sponsored FPC in testnet (#21235) feat!: exposing pub event pagination on wallet (#21197) refactor(pxe): narrow tryGetPublicKeysAndPartialAddress return type (backport #21208) (#21236) feat: orchestrator enqueues via serial queue (#21247) feat: rollup mana limit gas validation (#21219) chore: deploy SPONSORED_FPC in test networks (#21254) fix(sequencer): fix log when not enough txs (#21297) END_COMMIT_OVERRIDE --------- Co-authored-by: ledwards2225 <ledwards2225@users.noreply.github.com> Co-authored-by: PhilWindle <PhilWindle@users.noreply.github.com> Co-authored-by: ludamad <adam.domurad@gmail.com> Co-authored-by: mrzeszutko <mrzeszutko@users.noreply.github.com> Co-authored-by: spalladino <spalladino@users.noreply.github.com> Co-authored-by: johnathan79717 <johnathan79717@users.noreply.github.com> Co-authored-by: nventuro <nventuro@users.noreply.github.com> Co-authored-by: alexghr <alexghr@users.noreply.github.com> Co-authored-by: AztecBot <AztecBot@users.noreply.github.com> Co-authored-by: Martin Verzilli <martin@aztec-labs.com> Co-authored-by: PhilWindle <60546371+PhilWindle@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: mverzilli <mverzilli@users.noreply.github.com> Co-authored-by: benesjan <benesjan@users.noreply.github.com> Co-authored-by: danielntmd <danielntmd@users.noreply.github.com> Co-authored-by: deffrian <deffrian@users.noreply.github.com> Co-authored-by: benesjan <janbenes1234@gmail.com>

BEGIN_COMMIT_OVERRIDE chore: chonk proof compression poc (#20645) feat: Update L1 to L2 message APIs (#20913) fix: adapt chonk proof compression for v4 Translator layout (#21067) fix: omit bigint priceBumpPercentage from IPC config in testbench worker (#21086) feat: standby mode for prover broker (#21098) fix(p2p): remove default block handler in favor of block handler (#21105) chore: prepare barretenberg-rs for crates.io publishing (#20496) feat: reenable function selectors + additional validation in public setup allowlist (backport #20909, #21122) (#21129) chore: remove stale aes comments (#21133) chore: remove auto-tag job (#21127) feat: calldata length validation of public setup function allowlist (#21139) feat: run AVM NAPI simulations on dedicated threads instead of libuv pool (#21138) feat: Remove non-protocol contracts from public setup allowlist (#21154) feat!: Expose offchain effects when simulating/sending txs (backport #20563) (#21110) chore: bump minor version (#21171) chore: backport #21161 (tally slashing pruning improvements) to v4 (#21166) chore: More updated Alpha configuration (backport #21155) (#21165) fix(p2p): report most severe failure in runValidations (#21185) feat: add ergonomic conversions for Noir's `Option<T>` (#21107) docs: clarifying Noir fields vs struct fields in event metadata (#21172) fix: bump lighthouse consensus client v7.1.0 -> v8.0.1 (#21170) fix: update dependencies (#20997) chore: New alpha-net environment (#20800) (#21202) chore: code decuplication + refactor (public setup allowlist) (#21200) feat: mask all ciphertext fields with Poseidon2-derived values (backport #21009) (#21140) chore: disable sponsored FPC in testnet (#21235) feat!: exposing pub event pagination on wallet (#21197) refactor(pxe): narrow tryGetPublicKeysAndPartialAddress return type (backport #21208) (#21236) feat: orchestrator enqueues via serial queue (#21247) feat: rollup mana limit gas validation (#21219) chore: deploy SPONSORED_FPC in test networks (#21254) fix(sequencer): fix log when not enough txs (#21297) fix: Simulate gas in n tps test. Set min txs per block to 1 (backport #21312) (#21329) fix(log): do not log validation error if unregistered handler (#21111) fix(node): fix index misalignment in findLeavesIndexes (#21327) fix: limit parallel blocks in prover to max AVM parallel simulations (#21320) fix: use native sha256 to speed up proving job id generation (#21292) fix(validator): wait for l1 sync before processing block proposals (#21336) fix(txpool): cap priority fee with max fees when computing priority (#21279) chore: reduce severity of errors due to HA node not acquiring signature (#21311) fix: (A-643) add buffer to maxFeePerBlobGas for gas estimation and fix bump loop truncation (#21323) END_COMMIT_OVERRIDE

mrzeszutko added 2 commits March 4, 2026 20:25

feat: calldata length validation of public setup function allowlist

bbac9c0

Merge branch 'merge-train/spartan' into mr/validate-setup-args-shape

0355fd5

spalladino approved these changes Mar 4, 2026

View reviewed changes

spalladino added the backport-to-v4 label Mar 4, 2026

spalladino reviewed Mar 4, 2026

View reviewed changes

fixed calldata lenght validation

ab2a63f

AztecBot requested a review from a team March 4, 2026 21:08

spalladino approved these changes Mar 4, 2026

View reviewed changes

spalladino merged commit b7d9cd4 into merge-train/spartan Mar 4, 2026
12 checks passed

spalladino deleted the mr/validate-setup-args-shape branch March 4, 2026 21:19

AztecBot mentioned this pull request Mar 4, 2026

feat: merge-train/spartan #21034

Merged

AztecBot mentioned this pull request Mar 5, 2026

chore: Accumulated backports to v4 #21064

Merged

This was referenced Mar 5, 2026

chore(v4): release 4.1.1 #20979

Open

chore: Accumulated backports to v4 #21187

Merged

AztecBot mentioned this pull request Mar 11, 2026

chore: Accumulated backports to v4 #21355

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: calldata length validation of public setup function allowlist#21139

feat: calldata length validation of public setup function allowlist#21139
spalladino merged 3 commits intomerge-train/spartanfrom
mr/validate-setup-args-shape

mrzeszutko commented Mar 4, 2026 •

edited

Loading

Uh oh!

spalladino left a comment

Uh oh!

spalladino Mar 4, 2026

Uh oh!

mrzeszutko Mar 4, 2026

Uh oh!

spalladino Mar 4, 2026

Uh oh!

mrzeszutko Mar 4, 2026

Uh oh!

mrzeszutko commented Mar 4, 2026

Uh oh!

Uh oh!

AztecBot commented Mar 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

mrzeszutko commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Details

Uh oh!

spalladino left a comment

Choose a reason for hiding this comment

Uh oh!

spalladino Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

mrzeszutko Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

spalladino Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

mrzeszutko Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

mrzeszutko commented Mar 4, 2026

Uh oh!

Uh oh!

AztecBot commented Mar 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mrzeszutko commented Mar 4, 2026 •

edited

Loading