feat: truncate SHA hashes inside circuits

l1-contracts/src/core/libraries/ConstantsGen.sol

@@ -74,7 +74,7 @@ library Constants {
   uint256 internal constant L1_TO_L2_MSG_SUBTREE_HEIGHT = 4;
   uint256 internal constant L1_TO_L2_MSG_SUBTREE_SIBLING_PATH_LENGTH = 12;
   uint256 internal constant FUNCTION_SELECTOR_NUM_BYTES = 4;
-  uint256 internal constant NUM_FIELDS_PER_SHA256 = 2;
+  uint256 internal constant NUM_FIELDS_PER_SHA256 = 1;
   uint256 internal constant ARGS_HASH_CHUNK_LENGTH = 32;
   uint256 internal constant ARGS_HASH_CHUNK_COUNT = 32;
   uint256 internal constant INITIALIZATION_SLOT_SEPARATOR = 1000_000_000;
@@ -100,23 +100,23 @@ library Constants {
   uint256 internal constant VIEW_NOTE_ORACLE_RETURN_LENGTH = 212;
   uint256 internal constant AZTEC_ADDRESS_LENGTH = 1;
   uint256 internal constant CALL_CONTEXT_LENGTH = 7;
-  uint256 internal constant CONTENT_COMMITMENT_LENGTH = 7;
+  uint256 internal constant CONTENT_COMMITMENT_LENGTH = 4;
   uint256 internal constant CONTRACT_INSTANCE_LENGTH = 6;
   uint256 internal constant CONTRACT_STORAGE_READ_LENGTH = 2;
   uint256 internal constant CONTRACT_STORAGE_UPDATE_REQUEST_LENGTH = 2;
   uint256 internal constant ETH_ADDRESS_LENGTH = 1;
   uint256 internal constant FUNCTION_DATA_LENGTH = 4;
   uint256 internal constant FUNCTION_LEAF_PREIMAGE_LENGTH = 5;
   uint256 internal constant GLOBAL_VARIABLES_LENGTH = 6;
-  uint256 internal constant HEADER_LENGTH = 23;
+  uint256 internal constant HEADER_LENGTH = 20;
   uint256 internal constant L1_TO_L2_MESSAGE_LENGTH = 8;
   uint256 internal constant L2_TO_L1_MESSAGE_LENGTH = 2;
   uint256 internal constant NULLIFIER_KEY_VALIDATION_REQUEST_LENGTH = 4;
   uint256 internal constant NULLIFIER_KEY_VALIDATION_REQUEST_CONTEXT_LENGTH = 5;
   uint256 internal constant PARTIAL_STATE_REFERENCE_LENGTH = 6;
-  uint256 internal constant PRIVATE_CALL_STACK_ITEM_LENGTH = 215;
-  uint256 internal constant PRIVATE_CIRCUIT_PUBLIC_INPUTS_LENGTH = 210;
-  uint256 internal constant PUBLIC_CIRCUIT_PUBLIC_INPUTS_LENGTH = 202;
+  uint256 internal constant PRIVATE_CALL_STACK_ITEM_LENGTH = 210;
+  uint256 internal constant PRIVATE_CIRCUIT_PUBLIC_INPUTS_LENGTH = 205;
+  uint256 internal constant PUBLIC_CIRCUIT_PUBLIC_INPUTS_LENGTH = 198;
   uint256 internal constant STATE_REFERENCE_LENGTH = 8;
   uint256 internal constant TX_CONTEXT_DATA_LENGTH = 4;
   uint256 internal constant TX_REQUEST_LENGTH = 10;

l1-contracts/src/core/libraries/Hash.sol

@@ -42,17 +42,17 @@ library Hash {
 
   /**
    * @notice Computes the sha256 hash of the provided data and converts it to a field element
-   * @dev Using modulo to convert the hash to a field element.
+   * @dev Truncating one byte to convert the hash to a field element.
    * @param _data - The bytes to hash
    * @return The hash of the provided data as a field element
    */
   function sha256ToField(bytes memory _data) internal pure returns (bytes32) {
-    return bytes32(uint256(sha256(_data)) % Constants.P);
+    return bytes32(bytes.concat(new bytes(1), bytes31(sha256(_data))));
   }
 
   /**
    * @notice Computes the sha256 hash of the provided data and converts it to a field element
-   * @dev Using modulo to convert the hash to a field element.
+   * @dev Truncating one byte to convert the hash to a field element.
    * @param _data - A bytes32 value to hash
    * @return The hash of the provided data as a field element
    */

l1-contracts/src/core/libraries/HeaderLib.sol

@@ -94,7 +94,7 @@ library HeaderLib {
     GlobalVariables globalVariables;
   }
 
-  uint256 private constant HEADER_LENGTH = 0x1e8; // Header byte length
+  uint256 private constant HEADER_LENGTH = 0x1e5; // Header byte length
 
   /**
    * @notice Validates the header
@@ -154,31 +154,34 @@ library HeaderLib {
 
     // Reading ContentCommitment
     header.contentCommitment.txTreeHeight = uint256(bytes32(_header[0x0024:0x0044]));
-    header.contentCommitment.txsEffectsHash = bytes32(_header[0x0044:0x0064]);
-    header.contentCommitment.inHash = bytes32(_header[0x0064:0x0084]);
-    header.contentCommitment.outHash = bytes32(_header[0x0084:0x00a4]);
+    // All SHA hashes claculated in the circuit are truncated to 31 bytes
+    // Prepend a byte here to bring back to 32 bytes
+    header.contentCommitment.txsEffectsHash =
+      bytes32(bytes.concat(new bytes(1), _header[0x0044:0x0063]));
+    header.contentCommitment.inHash = bytes32(bytes.concat(new bytes(1), _header[0x0063:0x0082]));
+    header.contentCommitment.outHash = bytes32(bytes.concat(new bytes(1), _header[0x0082:0x00a1]));
 
     // Reading StateReference
     header.stateReference.l1ToL2MessageTree = AppendOnlyTreeSnapshot(
-      bytes32(_header[0x00a4:0x00c4]), uint32(bytes4(_header[0x00c4:0x00c8]))
+      bytes32(_header[0x00a1:0x00c1]), uint32(bytes4(_header[0x00c1:0x00c5]))
     );
     header.stateReference.partialStateReference.noteHashTree = AppendOnlyTreeSnapshot(
-      bytes32(_header[0x00c8:0x00e8]), uint32(bytes4(_header[0x00e8:0x00ec]))
+      bytes32(_header[0x00c5:0x00e5]), uint32(bytes4(_header[0x00e5:0x00e9]))
     );
     header.stateReference.partialStateReference.nullifierTree = AppendOnlyTreeSnapshot(
-      bytes32(_header[0x00ec:0x010c]), uint32(bytes4(_header[0x010c:0x0110]))
+      bytes32(_header[0x00e9:0x0109]), uint32(bytes4(_header[0x0109:0x010d]))
     );
     header.stateReference.partialStateReference.publicDataTree = AppendOnlyTreeSnapshot(
-      bytes32(_header[0x0110:0x0130]), uint32(bytes4(_header[0x0130:0x0134]))
+      bytes32(_header[0x010d:0x012d]), uint32(bytes4(_header[0x012d:0x0131]))
     );
 
     // Reading GlobalVariables
-    header.globalVariables.chainId = uint256(bytes32(_header[0x0134:0x0154]));
-    header.globalVariables.version = uint256(bytes32(_header[0x0154:0x0174]));
-    header.globalVariables.blockNumber = uint256(bytes32(_header[0x0174:0x0194]));
-    header.globalVariables.timestamp = uint256(bytes32(_header[0x0194:0x01b4]));
-    header.globalVariables.coinbase = address(bytes20(_header[0x01b4:0x01c8]));
-    header.globalVariables.feeRecipient = bytes32(_header[0x01c8:HEADER_LENGTH]);
+    header.globalVariables.chainId = uint256(bytes32(_header[0x0131:0x0151]));
+    header.globalVariables.version = uint256(bytes32(_header[0x0151:0x0171]));
+    header.globalVariables.blockNumber = uint256(bytes32(_header[0x0171:0x0191]));
+    header.globalVariables.timestamp = uint256(bytes32(_header[0x0191:0x01b1]));
+    header.globalVariables.coinbase = address(bytes20(_header[0x01b1:0x01c5]));
+    header.globalVariables.feeRecipient = bytes32(_header[0x01c5:HEADER_LENGTH]);
 
     return header;
   }

l1-contracts/src/core/libraries/decoders/MessagesDecoder.sol

@@ -135,8 +135,9 @@ library MessagesDecoder {
       offset += 0x4 + length;
     }
 
-    inHash = sha256(abi.encodePacked(l1ToL2Msgs));
-    outHash = sha256(abi.encodePacked(l2ToL1Msgs));
+    // The below are currently never used
+    inHash = Hash.sha256ToField(abi.encodePacked(l1ToL2Msgs));
+    outHash = Hash.sha256ToField(abi.encodePacked(l2ToL1Msgs));
 
     return (inHash, outHash, l1ToL2Msgs, l2ToL1Msgs);
   }

l1-contracts/src/core/libraries/decoders/TxsDecoder.sol

@@ -62,7 +62,7 @@ library TxsDecoder {
 
   // Note: Used in `computeConsumables` to get around stack too deep errors.
   struct ConsumablesVars {
-    bytes32[] baseLeaves;
+    bytes31[] baseLeaves;
     bytes baseLeaf;
     bytes32 encryptedLogsHash;
     bytes32 unencryptedLogsHash;
@@ -87,7 +87,7 @@ library TxsDecoder {
 
       count = read4(_body, offset); // number of tx effects
       offset += 0x4;
-      vars.baseLeaves = new bytes32[](count);
+      vars.baseLeaves = new bytes31[](count);
     }
 
     // Data starts after header. Look at L2 Block Data specification at the top of this file.
@@ -173,14 +173,19 @@ library TxsDecoder {
               Constants.PUBLIC_DATA_WRITES_NUM_BYTES_PER_BASE_ROLLUP
             )
           ),
-          bytes.concat(vars.encryptedLogsHash, vars.unencryptedLogsHash)
+          bytes.concat(
+            new bytes(1),
+            bytes31(vars.encryptedLogsHash),
+            new bytes(1),
+            bytes31(vars.unencryptedLogsHash)
+          )
         );
 
-        vars.baseLeaves[i] = sha256(vars.baseLeaf);
+        vars.baseLeaves[i] = bytes31(sha256(vars.baseLeaf));
       }
     }
 
-    return computeRoot(vars.baseLeaves);
+    return bytes32(bytes.concat(new bytes(1), computeRoot(vars.baseLeaves)));
   }
 
   /**
@@ -240,8 +245,11 @@ library TxsDecoder {
       // Decrease remaining logs length by this privateCircuitPublicInputsLogs's length (len(I?_LOGS)) and 4 bytes for I?_LOGS_LEN
       remainingLogsLength -= (privateCircuitPublicInputLogsLength + 0x4);
 
-      kernelPublicInputsLogsHash =
-        sha256(bytes.concat(kernelPublicInputsLogsHash, privateCircuitPublicInputsLogsHash));
+      kernelPublicInputsLogsHash = sha256(
+        bytes.concat(
+          bytes31(kernelPublicInputsLogsHash), bytes31(privateCircuitPublicInputsLogsHash)
+        )
+      );
     }
 
     return (kernelPublicInputsLogsHash, offset);
@@ -253,7 +261,7 @@ library TxsDecoder {
    * @param _leafs - The 32 bytes leafs to build the tree of.
    * @return The root of the Merkle tree.
    */
-  function computeRoot(bytes32[] memory _leafs) internal pure returns (bytes32) {
+  function computeRoot(bytes31[] memory _leafs) internal pure returns (bytes31) {
     // @todo Must pad the tree
     uint256 treeDepth = 0;
     while (2 ** treeDepth < _leafs.length) {
@@ -266,7 +274,7 @@ library TxsDecoder {
 
     for (uint256 i = 0; i < treeDepth; i++) {
       for (uint256 j = 0; j < treeSize; j += 2) {
-        _leafs[j / 2] = sha256(bytes.concat(_leafs[j], _leafs[j + 1]));
+        _leafs[j / 2] = bytes31(sha256(bytes.concat(bytes31(_leafs[j]), bytes31(_leafs[j + 1]))));
       }
       treeSize /= 2;
     }

l1-contracts/test/Rollup.t.sol

@@ -63,7 +63,7 @@ contract RollupTest is DecoderBase {
 
     assembly {
       // TODO: Hardcoding offsets in the middle of tests is annoying to say the least.
-      mstore(add(header, add(0x20, 0x0134)), 0x420)
+      mstore(add(header, add(0x20, 0x0131)), 0x420)
     }
 
     availabilityOracle.publish(body);
@@ -79,7 +79,7 @@ contract RollupTest is DecoderBase {
     bytes memory body = data.body;
 
     assembly {
-      mstore(add(header, add(0x20, 0x0154)), 0x420)
+      mstore(add(header, add(0x20, 0x0151)), 0x420)
     }
 
     availabilityOracle.publish(body);
@@ -96,7 +96,7 @@ contract RollupTest is DecoderBase {
 
     uint256 ts = block.timestamp + 1;
     assembly {
-      mstore(add(header, add(0x20, 0x0194)), ts)
+      mstore(add(header, add(0x20, 0x0191)), ts)
     }
 
     availabilityOracle.publish(body);

l1-contracts/test/decoders/Decoders.t.sol

@@ -203,8 +203,8 @@ contract DecodersTest is DecoderBase {
 
     (bytes32 logsHash, uint256 bytesAdvanced) = txsHelper.computeKernelLogsHash(encodedLogs);
 
-    bytes32 kernelPublicInputsLogsHash = bytes32(0);
-    bytes32 privateCircuitPublicInputsLogsHash = sha256(new bytes(0));
+    bytes31 kernelPublicInputsLogsHash = bytes31(0);
+    bytes31 privateCircuitPublicInputsLogsHash = bytes31(sha256(new bytes(0)));
 
     bytes32 referenceLogsHash =
       sha256(abi.encodePacked(kernelPublicInputsLogsHash, privateCircuitPublicInputsLogsHash));
@@ -224,8 +224,8 @@ contract DecodersTest is DecoderBase {
     (bytes32 logsHash, uint256 bytesAdvanced) = txsHelper.computeKernelLogsHash(encodedLogs);
 
     // Zero because this is the first iteration
-    bytes32 previousKernelPublicInputsLogsHash = bytes32(0);
-    bytes32 privateCircuitPublicInputsLogsHashFirstCall = sha256(firstFunctionCallLogs);
+    bytes31 previousKernelPublicInputsLogsHash = bytes31(0);
+    bytes31 privateCircuitPublicInputsLogsHashFirstCall = bytes31(sha256(firstFunctionCallLogs));
 
     bytes32 referenceLogsHash = sha256(
       abi.encodePacked(
@@ -252,13 +252,14 @@ contract DecodersTest is DecoderBase {
     (bytes32 logsHash, uint256 bytesAdvanced) = txsHelper.computeKernelLogsHash(encodedLogs);
 
     bytes32 referenceLogsHashFromIteration1 =
-      sha256(abi.encodePacked(bytes32(0), sha256(firstFunctionCallLogs)));
+      sha256(abi.encodePacked(bytes31(0), bytes31(sha256(firstFunctionCallLogs))));
 
     bytes32 privateCircuitPublicInputsLogsHashSecondCall = sha256(secondFunctionCallLogs);
 
     bytes32 referenceLogsHashFromIteration2 = sha256(
       abi.encodePacked(
-        referenceLogsHashFromIteration1, privateCircuitPublicInputsLogsHashSecondCall
+        bytes31(referenceLogsHashFromIteration1),
+        bytes31(privateCircuitPublicInputsLogsHashSecondCall)
       )
     );
 
@@ -289,20 +290,24 @@ contract DecodersTest is DecoderBase {
     (bytes32 logsHash, uint256 bytesAdvanced) = txsHelper.computeKernelLogsHash(encodedLogs);
 
     bytes32 referenceLogsHashFromIteration1 =
-      sha256(abi.encodePacked(bytes32(0), sha256(firstFunctionCallLogs)));
+      sha256(abi.encodePacked(bytes31(0), bytes31(sha256(firstFunctionCallLogs))));
 
     bytes32 privateCircuitPublicInputsLogsHashSecondCall = sha256(secondFunctionCallLogs);
 
     bytes32 referenceLogsHashFromIteration2 = sha256(
       abi.encodePacked(
-        referenceLogsHashFromIteration1, privateCircuitPublicInputsLogsHashSecondCall
+        bytes31(referenceLogsHashFromIteration1),
+        bytes31(privateCircuitPublicInputsLogsHashSecondCall)
       )
     );
 
     bytes32 privateCircuitPublicInputsLogsHashThirdCall = sha256(thirdFunctionCallLogs);
 
     bytes32 referenceLogsHashFromIteration3 = sha256(
-      abi.encodePacked(referenceLogsHashFromIteration2, privateCircuitPublicInputsLogsHashThirdCall)
+      abi.encodePacked(
+        bytes31(referenceLogsHashFromIteration2),
+        bytes31(privateCircuitPublicInputsLogsHashThirdCall)
+      )
     );
 
     assertEq(bytesAdvanced, encodedLogs.length, "Advanced by an incorrect number of bytes");

l1-contracts/test/fixtures/empty_block_0.json

@@ -35,27 +35,27 @@
     ]
   },
   "block": {
-    "archive": "0x2c80dc48494603ac15fa1ea88e3cd79565bdd54cf067a9bb4da9849870b60c69",
+    "archive": "0x0c870a5f7dcfc7e96ed11a20ecb624d69a718a4e425ec9c8c5cea2e3b16948b1",
     "body": "0x00000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-    "txsEffectsHash": "0x9139297703640b243028d35c29ae8c0667886c4edc8db5f879c260d2051bb8a9",
+    "txsEffectsHash": "0x007413567406cde76d283299d7130130019c26be78413b05ff12eb01811643ae",
     "decodedHeader": {
       "contentCommitment": {
         "inHash": "0x0000000000000000000000000000000000000000000000000000000000000000",
-        "outHash": "0xc78009fdf07fc56a11f122370658a353aaa542ed63e44c4bc15ff4cd105ab33c",
+        "outHash": "0x00d4d7e4813d75604a84bcf423b2fefbba46a7a445ca8d8f391d469bf84daff5",
         "txTreeHeight": 2,
-        "txsEffectsHash": "0x9139297703640b243028d35c29ae8c0667886c4edc8db5f879c260d2051bb8a9"
+        "txsEffectsHash": "0x007413567406cde76d283299d7130130019c26be78413b05ff12eb01811643ae"
       },
       "globalVariables": {
         "blockNumber": 1,
         "chainId": 31337,
         "timestamp": 0,
         "version": 1,
-        "coinbase": "0x66440eb666440eb666440eb666440eb666440eb6",
-        "feeRecipient": "0x061ca689507c7f1ccc68c2ad086c9d5d94f50869cb1b718c6a46aaf77a4500ba"
+        "coinbase": "0xc9d0a127a930ac845a21ed584d234da1e17cbdfd",
+        "feeRecipient": "0x17f67889fc55ffe1d5c3b06967f92ce9f7ca8160c670b1dff6be0d0746788864"
       },
       "lastArchive": {
         "nextAvailableLeafIndex": 1,
-        "root": "0x012a86560737adb075e12af8253fb09abf17aa841fb56d180bc89f0d2d473c7f"
+        "root": "0x1e3523d3bd50ae6204e1ec2ee1bdf8af4c6217ec80900052d2cf4259379dd130"
       },
       "stateReference": {
         "l1ToL2MessageTree": {
@@ -78,8 +78,8 @@
         }
       }
     },
-    "header": "0x012a86560737adb075e12af8253fb09abf17aa841fb56d180bc89f0d2d473c7f0000000100000000000000000000000000000000000000000000000000000000000000029139297703640b243028d35c29ae8c0667886c4edc8db5f879c260d2051bb8a90000000000000000000000000000000000000000000000000000000000000000c78009fdf07fc56a11f122370658a353aaa542ed63e44c4bc15ff4cd105ab33c1864fcdaa80ff2719154fa7c8a9050662972707168d69eac9db6fd3110829f800000001016642d9ccd8346c403aa4c3fa451178b22534a27035cdaa6ec34ae53b29c50cb000001000bcfa3e9f1a8922ee92c6dc964d6595907c1804a86753774322b468f69d4f278000001800572c8db882674dd026b8877fbba1b700a4407da3ae9ce5fa43215a28163362b000000c00000000000000000000000000000000000000000000000000000000000007a6900000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000066440eb666440eb666440eb666440eb666440eb6061ca689507c7f1ccc68c2ad086c9d5d94f50869cb1b718c6a46aaf77a4500ba",
-    "l1ToL2MessagesHash": "0x076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560",
-    "publicInputsHash": "0x22fb6cb24475c172eea140a775dd4ca748f8dda94fda256d5f76c09cb913ecf0"
+    "header": "0x1e3523d3bd50ae6204e1ec2ee1bdf8af4c6217ec80900052d2cf4259379dd1300000000100000000000000000000000000000000000000000000000000000000000000027413567406cde76d283299d7130130019c26be78413b05ff12eb01811643ae00000000000000000000000000000000000000000000000000000000000000d4d7e4813d75604a84bcf423b2fefbba46a7a445ca8d8f391d469bf84daff51864fcdaa80ff2719154fa7c8a9050662972707168d69eac9db6fd3110829f800000001016642d9ccd8346c403aa4c3fa451178b22534a27035cdaa6ec34ae53b29c50cb000001000bcfa3e9f1a8922ee92c6dc964d6595907c1804a86753774322b468f69d4f278000001800572c8db882674dd026b8877fbba1b700a4407da3ae9ce5fa43215a28163362b000000c00000000000000000000000000000000000000000000000000000000000007a69000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000c9d0a127a930ac845a21ed584d234da1e17cbdfd17f67889fc55ffe1d5c3b06967f92ce9f7ca8160c670b1dff6be0d0746788864",
+    "l1ToL2MessagesHash": "0x00076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f365",
+    "publicInputsHash": "0x00b08ca7d719d4850b551e61edec29863b39871851c5ce9092a63f070c61743a"
   }
 }