feat: truncate SHA hashes inside circuits

l1-contracts/src/core/Rollup.sol

@@ -88,8 +88,8 @@ contract Rollup is IRollup {
     // @todo (issue #605) handle fee collector
     IInbox inbox = REGISTRY.getInbox();
     inbox.batchConsume(l1ToL2Msgs, msg.sender);
-
-    bytes32 inHash = NEW_INBOX.consume();
+    // We prepend a byte rather than cast bytes31(bytes32) to match Noir's to_be_bytes.
+    bytes32 inHash = bytes32(bytes.concat(new bytes(1), bytes31(NEW_INBOX.consume())));
     if (header.contentCommitment.inHash != inHash) {
       revert Errors.Rollup__InvalidInHash(inHash, header.contentCommitment.inHash);
     }

l1-contracts/src/core/libraries/ConstantsGen.sol

@@ -74,7 +74,7 @@ library Constants {
   uint256 internal constant L1_TO_L2_MSG_SUBTREE_HEIGHT = 4;
   uint256 internal constant L1_TO_L2_MSG_SUBTREE_SIBLING_PATH_LENGTH = 12;
   uint256 internal constant FUNCTION_SELECTOR_NUM_BYTES = 4;
-  uint256 internal constant NUM_FIELDS_PER_SHA256 = 2;
+  uint256 internal constant NUM_FIELDS_PER_SHA256 = 1;
   uint256 internal constant ARGS_HASH_CHUNK_LENGTH = 32;
   uint256 internal constant ARGS_HASH_CHUNK_COUNT = 32;
   uint256 internal constant INITIALIZATION_SLOT_SEPARATOR = 1000_000_000;
@@ -100,23 +100,23 @@ library Constants {
   uint256 internal constant VIEW_NOTE_ORACLE_RETURN_LENGTH = 212;
   uint256 internal constant AZTEC_ADDRESS_LENGTH = 1;
   uint256 internal constant CALL_CONTEXT_LENGTH = 7;
-  uint256 internal constant CONTENT_COMMITMENT_LENGTH = 7;
+  uint256 internal constant CONTENT_COMMITMENT_LENGTH = 4;
   uint256 internal constant CONTRACT_INSTANCE_LENGTH = 6;
   uint256 internal constant CONTRACT_STORAGE_READ_LENGTH = 2;
   uint256 internal constant CONTRACT_STORAGE_UPDATE_REQUEST_LENGTH = 2;
   uint256 internal constant ETH_ADDRESS_LENGTH = 1;
   uint256 internal constant FUNCTION_DATA_LENGTH = 4;
   uint256 internal constant FUNCTION_LEAF_PREIMAGE_LENGTH = 5;
   uint256 internal constant GLOBAL_VARIABLES_LENGTH = 6;
-  uint256 internal constant HEADER_LENGTH = 23;
+  uint256 internal constant HEADER_LENGTH = 20;
   uint256 internal constant L1_TO_L2_MESSAGE_LENGTH = 8;
   uint256 internal constant L2_TO_L1_MESSAGE_LENGTH = 2;
   uint256 internal constant NULLIFIER_KEY_VALIDATION_REQUEST_LENGTH = 4;
   uint256 internal constant NULLIFIER_KEY_VALIDATION_REQUEST_CONTEXT_LENGTH = 5;
   uint256 internal constant PARTIAL_STATE_REFERENCE_LENGTH = 6;
-  uint256 internal constant PRIVATE_CALL_STACK_ITEM_LENGTH = 215;
-  uint256 internal constant PRIVATE_CIRCUIT_PUBLIC_INPUTS_LENGTH = 210;
-  uint256 internal constant PUBLIC_CIRCUIT_PUBLIC_INPUTS_LENGTH = 202;
+  uint256 internal constant PRIVATE_CALL_STACK_ITEM_LENGTH = 210;
+  uint256 internal constant PRIVATE_CIRCUIT_PUBLIC_INPUTS_LENGTH = 205;
+  uint256 internal constant PUBLIC_CIRCUIT_PUBLIC_INPUTS_LENGTH = 198;
   uint256 internal constant STATE_REFERENCE_LENGTH = 8;
   uint256 internal constant TX_CONTEXT_DATA_LENGTH = 4;
   uint256 internal constant TX_REQUEST_LENGTH = 10;

l1-contracts/src/core/libraries/Hash.sol

@@ -18,7 +18,7 @@ library Hash {
    * @param _message - The L1 to L2 message to hash
    * @return The hash of the provided message as a field element
    */
-  function sha256ToField(DataStructures.L1ToL2Msg memory _message) internal pure returns (bytes32) {
+  function sha256ToField(DataStructures.L1ToL2Msg memory _message) internal pure returns (bytes31) {
     return sha256ToField(
       abi.encode(
         _message.sender,
@@ -31,28 +31,56 @@ library Hash {
     );
   }
 
+    /**
+   * @notice Computes the sha256 hash of the L1 to L2 message and converts it to a field element
+   * @param _message - The L1 to L2 message to hash
+   * @return The hash of the provided message as a field element
+   */
+  function sha256ToField32(DataStructures.L1ToL2Msg memory _message) internal pure returns (bytes32) {
+    return sha256ToField32(
+      abi.encode(
+        _message.sender,
+        _message.recipient,
+        _message.content,
+        _message.secretHash,
+        _message.deadline,
+        _message.fee
+      )
+    );
+  }
+
   /**
    * @notice Computes the sha256 hash of the L2 to L1 message and converts it to a field element
    * @param _message - The L2 to L1 message to hash
    * @return The hash of the provided message as a field element
    */
-  function sha256ToField(DataStructures.L2ToL1Msg memory _message) internal pure returns (bytes32) {
-    return sha256ToField(abi.encode(_message.sender, _message.recipient, _message.content));
+  function sha256ToField32(DataStructures.L2ToL1Msg memory _message) internal pure returns (bytes32) {
+    return sha256ToField32(abi.encode(_message.sender, _message.recipient, _message.content));
   }
 
   /**
    * @notice Computes the sha256 hash of the provided data and converts it to a field element
-   * @dev Using modulo to convert the hash to a field element.
+   * @dev Truncating one byte to convert the hash to a field element. We prepend a byte rather than cast bytes31(bytes32) to match Noir's to_be_bytes.
+   * @param _data - The bytes to hash
+   * @return The hash of the provided data as a field element
+   */
+  function sha256ToField32(bytes memory _data) internal pure returns (bytes32) {
+    return bytes32(bytes.concat(new bytes(1), bytes31(sha256(_data))));
+  }
+
+    /**
+   * @notice Computes the sha256 hash of the provided data and converts it to a field element
+   * @dev Truncating one byte to convert the hash to a field element.
    * @param _data - The bytes to hash
    * @return The hash of the provided data as a field element
    */
-  function sha256ToField(bytes memory _data) internal pure returns (bytes32) {
-    return bytes32(uint256(sha256(_data)) % Constants.P);
+  function sha256ToField(bytes memory _data) internal pure returns (bytes31) {
+    return bytes31(sha256(_data));
   }
 
   /**
    * @notice Computes the sha256 hash of the provided data and converts it to a field element
-   * @dev Using modulo to convert the hash to a field element.
+   * @dev Truncating one byte to convert the hash to a field element.
    * @param _data - A bytes32 value to hash
    * @return The hash of the provided data as a field element
    */

l1-contracts/src/core/libraries/HeaderLib.sol

@@ -94,7 +94,7 @@ library HeaderLib {
     GlobalVariables globalVariables;
   }
 
-  uint256 private constant HEADER_LENGTH = 0x1e8; // Header byte length
+  uint256 private constant HEADER_LENGTH = 0x1e5; // Header byte length
 
   /**
    * @notice Validates the header
@@ -154,31 +154,34 @@ library HeaderLib {
 
     // Reading ContentCommitment
     header.contentCommitment.txTreeHeight = uint256(bytes32(_header[0x0024:0x0044]));
-    header.contentCommitment.txsEffectsHash = bytes32(_header[0x0044:0x0064]);
-    header.contentCommitment.inHash = bytes32(_header[0x0064:0x0084]);
-    header.contentCommitment.outHash = bytes32(_header[0x0084:0x00a4]);
+    // All SHA hashes claculated in the circuit are truncated to 31 bytes
+    // Prepend a byte here to bring back to 32 bytes
+    header.contentCommitment.txsEffectsHash =
+      bytes32(bytes.concat(new bytes(1), _header[0x0044:0x0063]));
+    header.contentCommitment.inHash = bytes32(bytes.concat(new bytes(1), _header[0x0063:0x0082]));
+    header.contentCommitment.outHash = bytes32(bytes.concat(new bytes(1), _header[0x0082:0x00a1]));
 
     // Reading StateReference
     header.stateReference.l1ToL2MessageTree = AppendOnlyTreeSnapshot(
-      bytes32(_header[0x00a4:0x00c4]), uint32(bytes4(_header[0x00c4:0x00c8]))
+      bytes32(_header[0x00a1:0x00c1]), uint32(bytes4(_header[0x00c1:0x00c5]))
     );
     header.stateReference.partialStateReference.noteHashTree = AppendOnlyTreeSnapshot(
-      bytes32(_header[0x00c8:0x00e8]), uint32(bytes4(_header[0x00e8:0x00ec]))
+      bytes32(_header[0x00c5:0x00e5]), uint32(bytes4(_header[0x00e5:0x00e9]))
     );
     header.stateReference.partialStateReference.nullifierTree = AppendOnlyTreeSnapshot(
-      bytes32(_header[0x00ec:0x010c]), uint32(bytes4(_header[0x010c:0x0110]))
+      bytes32(_header[0x00e9:0x0109]), uint32(bytes4(_header[0x0109:0x010d]))
     );
     header.stateReference.partialStateReference.publicDataTree = AppendOnlyTreeSnapshot(
-      bytes32(_header[0x0110:0x0130]), uint32(bytes4(_header[0x0130:0x0134]))
+      bytes32(_header[0x010d:0x012d]), uint32(bytes4(_header[0x012d:0x0131]))
     );
 
     // Reading GlobalVariables
-    header.globalVariables.chainId = uint256(bytes32(_header[0x0134:0x0154]));
-    header.globalVariables.version = uint256(bytes32(_header[0x0154:0x0174]));
-    header.globalVariables.blockNumber = uint256(bytes32(_header[0x0174:0x0194]));
-    header.globalVariables.timestamp = uint256(bytes32(_header[0x0194:0x01b4]));
-    header.globalVariables.coinbase = address(bytes20(_header[0x01b4:0x01c8]));
-    header.globalVariables.feeRecipient = bytes32(_header[0x01c8:HEADER_LENGTH]);
+    header.globalVariables.chainId = uint256(bytes32(_header[0x0131:0x0151]));
+    header.globalVariables.version = uint256(bytes32(_header[0x0151:0x0171]));
+    header.globalVariables.blockNumber = uint256(bytes32(_header[0x0171:0x0191]));
+    header.globalVariables.timestamp = uint256(bytes32(_header[0x0191:0x01b1]));
+    header.globalVariables.coinbase = address(bytes20(_header[0x01b1:0x01c5]));
+    header.globalVariables.feeRecipient = bytes32(_header[0x01c5:HEADER_LENGTH]);
 
     return header;
   }

l1-contracts/src/core/libraries/decoders/MessagesDecoder.sol

@@ -135,8 +135,8 @@ library MessagesDecoder {
       offset += 0x4 + length;
     }
 
-    inHash = sha256(abi.encodePacked(l1ToL2Msgs));
-    outHash = sha256(abi.encodePacked(l2ToL1Msgs));
+    inHash = Hash.sha256ToField32(abi.encodePacked(l1ToL2Msgs));
+    outHash = Hash.sha256ToField32(abi.encodePacked(l2ToL1Msgs));
 
     return (inHash, outHash, l1ToL2Msgs, l2ToL1Msgs);
   }

l1-contracts/src/core/libraries/decoders/TxsDecoder.sol

@@ -62,7 +62,7 @@ library TxsDecoder {
 
   // Note: Used in `computeConsumables` to get around stack too deep errors.
   struct ConsumablesVars {
-    bytes32[] baseLeaves;
+    bytes31[] baseLeaves;
     bytes baseLeaf;
     bytes32 encryptedLogsHash;
     bytes32 unencryptedLogsHash;
@@ -87,7 +87,7 @@ library TxsDecoder {
 
       count = read4(_body, offset); // number of tx effects
       offset += 0x4;
-      vars.baseLeaves = new bytes32[](count);
+      vars.baseLeaves = new bytes31[](count);
     }
 
     // Data starts after header. Look at L2 Block Data specification at the top of this file.
@@ -173,14 +173,20 @@ library TxsDecoder {
               Constants.PUBLIC_DATA_WRITES_NUM_BYTES_PER_BASE_ROLLUP
             )
           ),
-          bytes.concat(vars.encryptedLogsHash, vars.unencryptedLogsHash)
+          // We prepend a byte rather than cast bytes31(bytes32) to match Noir's to_be_bytes.
+          bytes.concat(
+            new bytes(1),
+            bytes31(vars.encryptedLogsHash),
+            new bytes(1),
+            bytes31(vars.unencryptedLogsHash)
+          )
         );
 
-        vars.baseLeaves[i] = sha256(vars.baseLeaf);
+        vars.baseLeaves[i] = Hash.sha256ToField(vars.baseLeaf);
       }
     }
 
-    return computeRoot(vars.baseLeaves);
+    return bytes32(bytes.concat(new bytes(1), computeRoot(vars.baseLeaves)));
   }
 
   /**
@@ -218,13 +224,13 @@ library TxsDecoder {
   function computeKernelLogsHash(uint256 _offsetInBlock, bytes calldata _body)
     internal
     pure
-    returns (bytes32, uint256)
+    returns (bytes31, uint256)
   {
     uint256 offset = _offsetInBlock;
     uint256 remainingLogsLength = read4(_body, offset);
     offset += 0x4;
 
-    bytes32 kernelPublicInputsLogsHash; // The hash on the output of kernel iteration
+    bytes31 kernelPublicInputsLogsHash; // The hash on the output of kernel iteration
 
     // Iterate until all the logs were processed
     while (remainingLogsLength > 0) {
@@ -233,15 +239,18 @@ library TxsDecoder {
       offset += 0x4;
 
       // Hash the logs of this iteration's function call
-      bytes32 privateCircuitPublicInputsLogsHash =
-        sha256(slice(_body, offset, privateCircuitPublicInputLogsLength));
+      bytes31 privateCircuitPublicInputsLogsHash =
+        Hash.sha256ToField(slice(_body, offset, privateCircuitPublicInputLogsLength));
       offset += privateCircuitPublicInputLogsLength;
 
       // Decrease remaining logs length by this privateCircuitPublicInputsLogs's length (len(I?_LOGS)) and 4 bytes for I?_LOGS_LEN
       remainingLogsLength -= (privateCircuitPublicInputLogsLength + 0x4);
 
-      kernelPublicInputsLogsHash =
-        sha256(bytes.concat(kernelPublicInputsLogsHash, privateCircuitPublicInputsLogsHash));
+      kernelPublicInputsLogsHash = Hash.sha256ToField(
+        bytes.concat(
+          kernelPublicInputsLogsHash, bytes31(privateCircuitPublicInputsLogsHash)
+        )
+      );
     }
 
     return (kernelPublicInputsLogsHash, offset);
@@ -253,7 +262,7 @@ library TxsDecoder {
    * @param _leafs - The 32 bytes leafs to build the tree of.
    * @return The root of the Merkle tree.
    */
-  function computeRoot(bytes32[] memory _leafs) internal pure returns (bytes32) {
+  function computeRoot(bytes31[] memory _leafs) internal pure returns (bytes31) {
     // @todo Must pad the tree
     uint256 treeDepth = 0;
     while (2 ** treeDepth < _leafs.length) {
@@ -266,7 +275,7 @@ library TxsDecoder {
 
     for (uint256 i = 0; i < treeDepth; i++) {
       for (uint256 j = 0; j < treeSize; j += 2) {
-        _leafs[j / 2] = sha256(bytes.concat(_leafs[j], _leafs[j + 1]));
+        _leafs[j / 2] = Hash.sha256ToField(bytes.concat(bytes31(_leafs[j]), bytes31(_leafs[j + 1])));
       }
       treeSize /= 2;
     }

l1-contracts/src/core/messagebridge/Inbox.sol

@@ -186,7 +186,7 @@ contract Inbox is IInbox {
     override(IInbox)
     returns (bytes32)
   {
-    return _message.sha256ToField();
+    return _message.sha256ToField32();
   }
 
   /**

l1-contracts/src/core/messagebridge/NewInbox.sol

@@ -14,7 +14,7 @@ import {Errors} from "../libraries/Errors.sol";
 import {Hash} from "../libraries/Hash.sol";
 
 // Contracts
-import {FrontierMerkle} from "./frontier_tree/Frontier.sol";
+import {FrontierMerkleField} from "./frontier_tree/FrontierField.sol";
 
 /**
  * @title Inbox
@@ -45,7 +45,7 @@ contract NewInbox is INewInbox {
     SIZE = 2 ** _height;
 
     // We deploy the first tree
-    IFrontier firstTree = IFrontier(new FrontierMerkle(_height));
+    IFrontier firstTree = IFrontier(new FrontierMerkleField(_height));
     trees[inProgress] = firstTree;
 
     EMPTY_ROOT = firstTree.root();
@@ -77,7 +77,7 @@ contract NewInbox is INewInbox {
     IFrontier currentTree = trees[inProgress];
     if (currentTree.isFull()) {
       inProgress += 1;
-      currentTree = IFrontier(new FrontierMerkle(HEIGHT));
+      currentTree = IFrontier(new FrontierMerkleField(HEIGHT));
       trees[inProgress] = currentTree;
     }
 
@@ -91,7 +91,7 @@ contract NewInbox is INewInbox {
       fee: 0
     });
 
-    bytes32 leaf = message.sha256ToField();
+    bytes31 leaf = message.sha256ToField();
     uint256 index = currentTree.insertLeaf(leaf);
     emit LeafInserted(inProgress, index, leaf);
 
@@ -118,7 +118,7 @@ contract NewInbox is INewInbox {
     // If we are "catching up" we skip the tree creation as it is already there
     if (toConsume + 1 == inProgress) {
       inProgress += 1;
-      trees[inProgress] = IFrontier(new FrontierMerkle(HEIGHT));
+      trees[inProgress] = IFrontier(new FrontierMerkleField(HEIGHT));
     }
 
     toConsume += 1;

l1-contracts/src/core/messagebridge/Outbox.sol

@@ -103,7 +103,7 @@ contract Outbox is IOutbox {
     override(IOutbox)
     returns (bytes32)
   {
-    return _message.sha256ToField();
+    return _message.sha256ToField32();
   }
 
   /**