feat: auth registry

docs/docs/aztec/concepts/accounts/authwit.md

@@ -138,25 +138,30 @@ The above flow could be re-entered at token transfer. It is mainly for show to i
 
 ### What about public
 
-As noted earlier, we could use the ERC20 standard for public. But this seems like a waste when we have the ability to try righting some wrongs. Instead, we can expand our AuthWit scheme to also work in public. This is actually quite simple, instead of asking an oracle (which we can't do as easily because not private execution) we can just store the AuthWit in the account contract, and look it up when we need it. While this needs the storage to be updated ahead of time, we can quite easily do so by batching the AuthWit updates with the interaction - a benefit of Account Contracts.
+As noted earlier, we could use the ERC20 standard for public. But this seems like a waste when we have the ability to try righting some wrongs. Instead, we can expand our AuthWit scheme to also work in public. This is actually quite simple, instead of asking an oracle (which we can't do as easily because not private execution) we can just store the AuthWit in a shared registry, and look it up when we need it. While this needs the storage to be updated ahead of time (can be same tx), we can quite easily do so by batching the AuthWit updates with the interaction - a benefit of Account Contracts. A shared registry is used such that execution from the sequencers point of view will be more straight forward and predictable. Furthermore, since we have the authorization data directly in public state, if they are both set and unset (authorized and then used) in the same transaction, there will be no state effect after the transaction for the authorization which saves gas ⛽.
 
 ```mermaid
 sequenceDiagram
     actor Alice
     participant AC as Alice Account
+    participant AR as Auth Registry
     participant Token
+    participant Defi
     rect rgb(191, 223, 255)
     note right of Alice: Alice sends a batch
-    Alice->>AC: Allow Defi to call transfer(Alice, Defi, 1000);
+    Alice->>AC: Authorize Defi to call transfer(Alice, Defi, 1000);
     activate AC
     Alice->>AC: Defi.deposit(Token, 1000);
     end
+    AC->>AR: Authorize Defi to call transfer(Alice, Defi, 1000);
+    AR->>AR: add authorize to true
     AC->>Defi: deposit(Token, 1000);
     activate Defi
     Defi->>Token: transfer(Alice, Defi, 1000);
     activate Token
-    Token->>AC: Check if Defi may call transfer(Alice, Defi, 1000);
-    AC->>Token: AuthWit validity
+    Token->>AR: Check if Defi may call transfer(Alice, Defi, 1000);
+    AR->>AR: set authorize to false
+    AR->>Token: AuthWit validity
     Token->>Token: throw if invalid AuthWit
     Token->>Token: transfer(Alice, Defi, 1000);
     Token->>Defi: success

docs/docs/guides/smart_contracts/writing_contracts/authwit.md

@@ -70,16 +70,15 @@ sequenceDiagram
 Note in particular that the request for a witness is done by the token contract, and the user will have to provide it to the contract before it can continue execution. Since the request is made all the way into the contract where it is to be used, we don't need to pass it along as an extra input to the functions before it which gives us a cleaner interface.
 :::
 
-As part of `AuthWit` we are assuming that the `on_behalf_of` implements the private and/or public functions:
+As part of `AuthWit` we are assuming that the `on_behalf_of` implements the private function:
 
 ```rust
 #[aztec(private)]
 fn spend_private_authwit(inner_hash: Field) -> Field;
-
-#[aztec(public)]
-fn spend_public_authwit(inner_hash: Field) -> Field;
 ```
 
+For public authwit, we have a shared registry that is used, there we are using a `consume` function.
+
 Both return the value `0xabf64ad4` (`IS_VALID` selector) for a successful authentication, and `0x00000000` for a failed authentication. You might be wondering why we are expecting the return value to be a selector instead of a boolean. This is mainly to account for a case of selector collisions where the same selector is used for different functions, and we don't want an account to mistakenly allow a different function to be called on its behalf - it is hard to return the selector by mistake, but you might have other functions returning a bool.
 
 ## The `AuthWit` library.
@@ -113,7 +112,7 @@ This is to cover the case where the `on_behalf_of` might implemented some functi
 
 ### Utilities for public calls
 
-Very similar to the above, we have variations that work in the public domain. These functions are wrapped to give a similar flow for both cases, but behind the scenes the logic of the account contracts is slightly different since they cannot use the oracle as they are not in the private domain.
+Very similar to the above, we have variations that work in the public domain (`assert_current_call_valid_authwit_public`). These functions are wrapped to give a similar flow for both cases, but behind the scenes the logic is slightly different since the public goes to the auth registry, while the private flow calls the account contract.
 
 #### Example
 
@@ -167,7 +166,7 @@ With private functions covered, how can we use this in a public function? Well,
 
 #### Authenticating an action in TypeScript
 
-Authenticating an action in the public domain is quite similar to the private domain, with the difference that we are executing a function on the account contract to add the witness, if you recall, this is because we don't have access to the oracle in the public domain.
+Authenticating an action in the public domain is slightly different from the private domain, since we are executing a function on the auth registry contract to add the witness flag. As you might recall, this was to ensure that we don't need to call into the account contract from public, which is a potential DOS vector.
 
 In the snippet below, this is done as a separate contract call, but can also be done as part of a batch as mentioned in the [Accounts concepts](../../../aztec/concepts/accounts/authwit.md#what-about-public).
 
@@ -177,13 +176,11 @@ In the snippet below, this is done as a separate contract call, but can also be
 
 We have cases where we need a non-wallet contract to approve an action to be executed by another contract. One of the cases could be when making more complex defi where funds are passed along. When doing so, we need the intermediate contracts to support approving of actions on their behalf.
 
-To support this, we must implement the `spend_public_authwit` function as seen in the snippet below.
-
-#include_code authwit_uniswap_get /noir-projects/noir-contracts/contracts/uniswap_contract/src/main.nr rust
+This is fairly straight forward to do using the `auth` library which include logic for updating values in the public auth registry. Namely, you can prepare the `message_hash` using `compute_call_authwit_hash` and then simply feed it into the `set_authorized` function (both are in `auth` library) to update the value. 
 
-It also needs a way to update those storage values. Since we want the updates to be trustless, we can compute the action based on the function inputs, and then have the contract compute the key at which it must add a `true` to approve the action.
+When another contract later is consuming the authwit using `assert_current_call_valid_authwit_public` it will be calling the registry, and spend that authwit.
 
-An example of this would be our Uniswap example which performs a cross chain swap on L1. In here, we both do private and public auth witnesses, where the public is set by the uniswap L2 contract itself. In the below snippet, you can see that we compute the action hash, and then update an `approved_action` mapping with the hash as key and `true` as value. When we then call the `token_bridge` to execute afterwards, it reads this value, burns the tokens, and consumes the authentication.
+An example of this would be our Uniswap example which performs a cross chain swap on L1. In here, we both do private and public auth witnesses, where the public is set by the uniswap L2 contract itself. In the below snippet, you can see that we compute the action hash and update the value in the registry. When we then call the `token_bridge` to execute afterwards, it reads this value, burns the tokens, and consumes the authentication.
 
 #include_code authwit_uniswap_set /noir-projects/noir-contracts/contracts/uniswap_contract/src/main.nr rust
 

docs/docs/migration_notes.md

@@ -12,6 +12,26 @@ Aztec is in full-speed development. Literally every version breaks compatibility
 
 The `limit` parameter in `NoteGetterOptions` and `NoteViewerOptions` is now required to be a compile-time constant. This allows performing loops over this value, which leads to reduced circuit gate counts when setting a `limit` value.
 
+### [Aztec.nr] canonical public authwit registry
+
+The public authwits are moved into a shared registry (auth registry) to make it easier for sequencers to approve for their non-revertible (setup phase) whitelist. Previously, it was possible to DOS a sequencer by having a very expensive authwit validation that fails at the end, now the whitelist simple need the registry.
+
+Notable, this means that consuming a public authwit will no longer emit a nullifier in the account contract but instead update STORAGE in the public domain. This means that there is a larger difference between private and public again. However, it also means that if contracts need to approve, and use the approval in the same tx, it is transient and don't need to go to DA (saving 96 bytes).
+
+For the typescript wallets this is handled so the APIs don't change, but account contracts should get rid of their current setup with `approved_actions`.
+
+```diff
+- let actions = AccountActions::init(&mut context, ACCOUNT_ACTIONS_STORAGE_SLOT, is_valid_impl);
++ let actions = AccountActions::init(&mut context, is_valid_impl);
+```
+
+For contracts we have added a `set_authorized` function in the auth library that can be used to set values in the registry.
+
+```diff
+- storage.approved_action.at(message_hash).write(true);
++ set_authorized(&mut context, message_hash, true);
+```
+
 ### [Aztec.nr] emit encrypted logs
 
 Emitting or broadcasting encrypted notes are no longer done as part of the note creation, but must explicitly be either emitted or discarded instead.

l1-contracts/src/core/libraries/ConstantsGen.sol

@@ -100,6 +100,8 @@ library Constants {
   uint256 internal constant FIXED_DA_GAS = 512;
   uint256 internal constant CANONICAL_KEY_REGISTRY_ADDRESS =
     2153455745675440165069577621832684870696142028027528497509357256345838682961;
+  uint256 internal constant CANONICAL_AUTH_REGISTRY_ADDRESS =
+    18091885756106795278141309801070173692350235742979924147720536894670507925831;
   uint256 internal constant DEPLOYER_CONTRACT_ADDRESS =
     19511485909966796736993840362353440247573331327062358513665772226446629198132;
   uint256 internal constant REGISTERER_CONTRACT_ADDRESS =

noir-projects/aztec-nr/authwit/src/account.nr

@@ -1,5 +1,4 @@
 use dep::aztec::context::{PrivateContext, PublicContext};
-use dep::aztec::state_vars::{Map, PublicMutable};
 use dep::aztec::protocol_types::{address::AztecAddress, abis::function_selector::FunctionSelector, hash::pedersen_hash};
 
 use crate::entrypoint::{app::AppPayload, fee::FeePayload};
@@ -8,26 +7,11 @@ use crate::auth::{IS_VALID_SELECTOR, compute_outer_authwit_hash};
 struct AccountActions<Context> {
   context: Context,
   is_valid_impl: fn(&mut PrivateContext, Field) -> bool,
-  approved_action: Map<Field, PublicMutable<bool, Context>, Context>,
 }
 
 impl<Context> AccountActions<Context> {
-    pub fn init(
-        context: Context,
-        approved_action_storage_slot: Field,
-        is_valid_impl: fn(&mut PrivateContext, Field) -> bool
-    ) -> Self {
-        AccountActions {
-            context,
-            is_valid_impl,
-            approved_action: Map::new(
-                context,
-                approved_action_storage_slot,
-                |context, slot| {
-          PublicMutable::new(context, slot)
-        }
-            )
-        }
+    pub fn init(context: Context, is_valid_impl: fn(&mut PrivateContext, Field) -> bool) -> Self {
+        AccountActions { context, is_valid_impl }
     }
 }
 
@@ -65,29 +49,3 @@ impl AccountActions<&mut PrivateContext> {
     }
     // docs:end:spend_private_authwit
 }
-
-impl AccountActions<&mut PublicContext> {
-    // docs:start:spend_public_authwit
-    pub fn spend_public_authwit(self, inner_hash: Field) -> Field {
-        // The `inner_hash` is "siloed" with the `msg_sender` to ensure that only it can 
-        // consume the message.
-        // This ensures that contracts cannot consume messages that are not intended for them.
-        let message_hash = compute_outer_authwit_hash(
-            self.context.msg_sender(),
-            self.context.chain_id(),
-            self.context.version(),
-            inner_hash
-        );
-        let is_valid = self.approved_action.at(message_hash).read();
-        assert(is_valid == true, "Message not authorized by account");
-        self.context.push_new_nullifier(message_hash, 0);
-        IS_VALID_SELECTOR
-    }
-    // docs:end:spend_public_authwit
-
-    // docs:start:approve_public_authwit
-    pub fn approve_public_authwit(self, message_hash: Field) {
-        self.approved_action.at(message_hash).write(true);
-    }
-    // docs:end:approve_public_authwit
-}

noir-projects/aztec-nr/authwit/src/auth.nr

@@ -1,6 +1,7 @@
 use dep::aztec::protocol_types::{
     abis::function_selector::FunctionSelector, address::AztecAddress,
-    constants::{GENERATOR_INDEX__AUTHWIT_INNER, GENERATOR_INDEX__AUTHWIT_OUTER}, hash::pedersen_hash
+    constants::{GENERATOR_INDEX__AUTHWIT_INNER, GENERATOR_INDEX__AUTHWIT_OUTER, CANONICAL_AUTH_REGISTRY_ADDRESS},
+    hash::pedersen_hash
 };
 use dep::aztec::{prelude::Deserialize, context::{PrivateContext, PublicContext, gas::GasOpts}, hash::hash_args_array};
 
@@ -19,14 +20,14 @@ pub fn assert_current_call_valid_authwit(context: &mut PrivateContext, on_behalf
 // docs:start:assert_current_call_valid_authwit_public
 // Assert that `on_behalf_of` have authorized the current call in a public context
 pub fn assert_current_call_valid_authwit_public(context: &mut PublicContext, on_behalf_of: AztecAddress) {
-    let function_selector = FunctionSelector::from_signature("spend_public_authwit(Field)");
     let inner_hash = compute_inner_authwit_hash(
         [(*context).msg_sender().to_field(), (*context).selector().to_field(), (*context).get_args_hash()]
     );
+
     let result: Field = context.call_public_function(
-        on_behalf_of,
-        function_selector,
-        [inner_hash].as_slice(),
+        AztecAddress::from_field(CANONICAL_AUTH_REGISTRY_ADDRESS),
+        FunctionSelector::from_signature("consume((Field),Field)"),
+        [on_behalf_of.to_field(), inner_hash].as_slice(),
         GasOpts::default()
     ).deserialize_into();
     assert(result == IS_VALID_SELECTOR, "Message not authorized by account");
@@ -69,3 +70,32 @@ pub fn compute_outer_authwit_hash(
         GENERATOR_INDEX__AUTHWIT_OUTER
     )
 }
+
+/**
+ * Helper function to set the authorization status of a message hash
+ * 
+ * @param message_hash The hash of the message to authorize
+ * @param authorize True if the message should be authorized, false if it should be revoked
+ */
+pub fn set_authorized(context: &mut PublicContext, message_hash: Field, authorize: bool) {
+    context.call_public_function(
+        AztecAddress::from_field(CANONICAL_AUTH_REGISTRY_ADDRESS),
+        FunctionSelector::from_signature("set_authorized(Field,bool)"),
+        [message_hash, authorize as Field].as_slice(),
+        GasOpts::default()
+    ).assert_empty();
+}
+
+/**
+ * Helper function to reject all authwits
+ *
+ * @param reject True if all authwits should be rejected, false otherwise 
+ */
+pub fn set_reject_all(context: &mut PublicContext, reject: bool) {
+    context.call_public_function(
+        AztecAddress::from_field(CANONICAL_AUTH_REGISTRY_ADDRESS),
+        FunctionSelector::from_signature("set_reject_all(bool)"),
+        [context.this_address().to_field(), reject as Field].as_slice(),
+        GasOpts::default()
+    ).assert_empty();
+}

noir-projects/aztec-nr/aztec/src/context/unconstrained_context.nr

@@ -20,7 +20,7 @@ impl UnconstrainedContext {
         self.block_number
     }
 
-    fn contract_address(self) -> AztecAddress {
+    fn this_address(self) -> AztecAddress {
         self.contract_address
     }
 }

noir-projects/noir-contracts/Nargo.toml

@@ -2,6 +2,7 @@
 members = [
     "contracts/app_subscription_contract",
     "contracts/auth_contract",
+    "contracts/auth_registry_contract",
     "contracts/avm_initializer_test_contract",
     "contracts/avm_test_contract",
     "contracts/fpc_contract",

noir-projects/noir-contracts/contracts/app_subscription_contract/src/main.nr

@@ -12,7 +12,7 @@ contract AppSubscription {
         encrypted_logs::encrypted_note_emission::encode_and_encrypt,
         protocol_types::{traits::is_empty, grumpkin_point::GrumpkinPoint}
     },
-        authwit::{account::AccountActions, auth_witness::get_auth_witness, auth::assert_current_call_valid_authwit},
+        authwit::{auth_witness::get_auth_witness, auth::assert_current_call_valid_authwit},
         gas_token::GasToken, token::Token
     };
 

noir-projects/noir-contracts/contracts/auth_registry_contract/Nargo.toml

@@ -0,0 +1,9 @@
+[package]
+name = "auth_registry_contract"
+authors = [""]
+compiler_version = ">=0.25.0"
+type = "contract"
+
+[dependencies]
+aztec = { path = "../../../aztec-nr/aztec" }
+authwit = { path = "../../../aztec-nr/authwit" }