fix(nft)!: align note-hashing with upstream aztec-nr scheme - #37
Draft
alejoamiras wants to merge 3 commits into
Draft
fix(nft)!: align note-hashing with upstream aztec-nr scheme#37alejoamiras wants to merge 3 commits into
alejoamiras wants to merge 3 commits into
Conversation
This was referenced Aug 19, 2026
Documentation follow-ups from the 2026-08 security audit. No contract logic changes. - Vault (main.nr): a prominent block comment at the top records that the ~15 `Order matters: … reentrancy` orderings are necessary but NOT sufficient — they do not hold when the asset or shares token has an ARC-403 hook, because the hook runs inside the transfer before the balance moves (audit F-001/F-002). The recurring inline phrase "to neutralize ARC-403 reentrancy" asserted a guarantee the code does not provide; corrected to point at that note. - MultiToken (README): add a status warning. It was the only token contract with no per-file caveat, yet it carries the commitment trust-model issue (a commitment binds neither id nor amount, so it is not a payment guarantee). Kept severity-accurate: it references the repo-wide unaudited status rather than implying it is as unfinished as the Vault. - Dripper (README): the existing "dev/testing only" note did not name the mechanism. Sharpened to state it is an uncapped, permissionless minter whose sole safety boundary is never being a valuable token's minter (audit F-006). Validated: aztec-nargo fmt --check clean, aztec compile OK.
Upstream-parity function present in every upstream reference token
contract but absent from all three of ours. Without it, a private
authwit that has been granted but not yet consumed cannot be revoked.
Ported verbatim from the upstream Token/NFT contracts (aztec-packages
v5.1.0):
#[external("private")]
fn cancel_authwit(inner_hash: Field) {
let on_behalf_of = self.msg_sender();
let nullifier = compute_authwit_nullifier(on_behalf_of, inner_hash);
self.context.push_nullifier_unsafe(nullifier);
}
Cancellation pre-emits the same authwit nullifier the consume path
emits, so a later authwit-gated call fails with a duplicate nullifier.
Three tests per contract: the negative case (cancel then attempt to
consume -> duplicate nullifiers), a positive control (same flow without
the cancel succeeds, attributing the failure to the cancel), and caller
isolation (a foreign account cancelling with the owner's exact inner
hash does NOT revoke the owner's authwit, since the nullifier is bound
to msg_sender). READMEs list the new function.
Additive: a new selector, no existing ABI touched.
Validated: token 84 / nft 64 / multitoken 80 Noir tests, aztec compile
OK. Codex adversarial review: safe and upstream-equivalent; its two
suggestions (tighten the negative assertion, add the caller-isolation
test) are applied — note its proposed error string 'already present'
was empirically wrong, the matchable revert is 'duplicate nullifiers'.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
BREAKING: changes NFTNote hashes, so a fixed contract deploys under a new class id. Existing on-chain NFT notes were created under the old scheme and will not match; in-flight partial notes must be drained or abandoned before upgrading code at an existing address, and PXE/wallet note databases must use the artifact matching each deployed class. nft_note.nr used a pre-refactor hashing scheme that diverged from both upstream and this repo's own multitoken_note.nr: - compute_partial_commitment used the generic DOM_SEP__NOTE_HASH; now uses the dedicated DOM_SEP__PARTIAL_NOTE_COMMITMENT. - compute_complete_note_hash hand-rolled the preimage with the storage slot in the middle ([commitment, storage_slot, token_id]); now calls aztec-nr's compute_note_hash(storage_slot, [commitment, token_id]), which fixes the slot first (preventing cross-slot collisions). Both the direct note-hash path and the partial-note completion path route through the same two functions, so directly-created and completed-partial notes remain indistinguishable. Ported upstream's note_hash_matches_completed_partial_note_hash test to lock that invariant, and corrected two comments that wrongly claimed the partial commitment includes the storage slot. Validated: nft_contract 65 Noir tests, NFT TS integration suite 9/9 against a local sandbox (proving PXE note discovery works with the new scheme), aztec compile OK. Codex adversarial review: matches upstream, correct, internally consistent. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
alejoamiras
force-pushed
the
stack/closeout-nft-notehash
branch
from
August 19, 2026 16:16
d17b64d to
252c352
Compare
Benchmark Comparison
Contract: escrow
Contract: logic
Contract: multitoken
Contract: nft
Contract: token
Contract: vault
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A fixed contract deploys under a new class id. Existing on-chain
NFTNotes were created under the old scheme and will not match. Practically:What changed
nft_note.nrused a pre-refactor hashing scheme that diverged from upstream and from this repo's ownmultitoken_note.nr— two custom notes in one repo disagreeing for no reason:compute_partial_commitmentDOM_SEP__NOTE_HASHDOM_SEP__PARTIAL_NOTE_COMMITMENTcompute_complete_note_hash[commitment, storage_slot, token_id](slot in the middle)compute_note_hash(storage_slot, [commitment, token_id])— the aztec-nr util, slot firstBoth the direct note-hash path and the partial-note completion path route through these two functions, so directly-created and completed-partial notes stay indistinguishable. Ported upstream's
note_hash_matches_completed_partial_note_hashtest to lock that invariant, and corrected two comments that wrongly claimed the partial commitment includes the storage slot.Validation
nft_contract65 Noir tests · NFT TS integration 9/9 against a local sandbox — the load-bearing proof that PXE note discovery works under the new scheme ·aztec compileOK.Codex adversarial review: "matches upstream, correct, internally consistent."