CertVerifier updates

api/clients/v2/payload_disperser.go

@@ -271,7 +271,11 @@ func (pd *PayloadDisperser) buildEigenDACert(
 
 	timeoutCtx, cancel := context.WithTimeout(ctx, pd.config.ContractCallTimeout)
 	defer cancel()
-	nonSignerStakesAndSignature, err := pd.certVerifier.GetNonSignerStakesAndSignature(
+
+	// TODO (litt3): @reviewers I think this method (buildEigenDACert) is the main end user of GetNonSignerStakesAndSignature,
+	//  and we are just discarding the signedQuorumNumbers returned from GetNonSignerStakesAndSignature. IMO this points
+	//  to returning signedQuorumNumbers being the wrong API choice
+	nonSignerStakesAndSignature, _, err := pd.certVerifier.GetNonSignerStakesAndSignature(
 		timeoutCtx, blobStatusReply.GetSignedBatch())
 	if err != nil {
 		return nil, fmt.Errorf("get non signer stake and signature: %w", err)

api/clients/v2/verification/cert_verifier.go

@@ -26,7 +26,7 @@ type ICertVerifier interface {
 	GetNonSignerStakesAndSignature(
 		ctx context.Context,
 		signedBatch *disperser.SignedBatch,
-	) (*verifierBindings.NonSignerStakesAndSignature, error)
+	) (*verifierBindings.NonSignerStakesAndSignature, []uint8, error)
 }
 
 // CertVerifier is responsible for making eth calls against the CertVerifier contract to ensure cryptographic and
@@ -151,7 +151,8 @@ func (cv *CertVerifier) VerifyCertV2(
 		&bind.CallOpts{Context: ctx},
 		eigenDACert.BatchHeader,
 		eigenDACert.BlobInclusionInfo,
-		eigenDACert.NonSignerStakesAndSignature)
+		eigenDACert.NonSignerStakesAndSignature,
+		eigenDACert.SignedQuorumNumbers)
 
 	if err != nil {
 		return fmt.Errorf("verify cert v2: %w", err)
@@ -161,7 +162,11 @@ func (cv *CertVerifier) VerifyCertV2(
 }
 
 // GetNonSignerStakesAndSignature calls the getNonSignerStakesAndSignature view function on the EigenDACertVerifier
-// contract, and returns the resulting NonSignerStakesAndSignature object.
+// contract, and returns the resulting NonSignerStakesAndSignature object and signed quorum numbers. The signed quorum
+// numbers are the quorum numbers that directly match the quorum numbers in the SignedBatch.Attestation.
+//
+// TODO (litt3): I don't like that we are simply returning a portion of the input parameter here. I think it's a
+//  potential source of confusion. @reviewers, please consider this structure and opine
 //
 // Before getting the NonSignerStakesAndSignature, this method will wait for the internal client to advance to a
 // sufficient block height. This wait will time out if the duration exceeds the timeout configured for the input ctx
@@ -171,27 +176,27 @@ func (cv *CertVerifier) VerifyCertV2(
 func (cv *CertVerifier) GetNonSignerStakesAndSignature(
 	ctx context.Context,
 	signedBatch *disperser.SignedBatch,
-) (*verifierBindings.NonSignerStakesAndSignature, error) {
+) (*verifierBindings.NonSignerStakesAndSignature, []uint8, error) {
 
 	signedBatchBinding, err := SignedBatchProtoToBinding(signedBatch)
 	if err != nil {
-		return nil, fmt.Errorf("convert signed batch: %w", err)
+		return nil, nil, fmt.Errorf("convert signed batch: %w", err)
 	}
 
 	err = cv.MaybeWaitForBlockNumber(ctx, signedBatch.GetHeader().GetReferenceBlockNumber())
 	if err != nil {
-		return nil, fmt.Errorf("wait for block number: %w", err)
+		return nil, nil, fmt.Errorf("wait for block number: %w", err)
 	}
 
-	nonSignerStakesAndSignature, err := cv.certVerifierCaller.GetNonSignerStakesAndSignature(
+	nonSignerStakesAndSignature, signedQuorumNumbers, err := cv.certVerifierCaller.GetNonSignerStakesAndSignature(
 		&bind.CallOpts{Context: ctx},
 		*signedBatchBinding)
 
 	if err != nil {
-		return nil, fmt.Errorf("get non signer stakes and signature: %w", err)
+		return nil, nil, fmt.Errorf("get non signer stakes and signature: %w", err)
 	}
 
-	return &nonSignerStakesAndSignature, nil
+	return &nonSignerStakesAndSignature, signedQuorumNumbers, nil
 }
 
 // MaybeWaitForBlockNumber waits until the internal eth client has advanced to a certain targetBlockNumber, unless

api/clients/v2/verification/conversion_utils.go

@@ -147,16 +147,9 @@ func blobHeaderProtoToBinding(inputHeader *commonv2.BlobHeader) (*contractEigenD
 			math.MaxUint16)
 	}
 
-	var quorumNumbers []byte
-	for _, quorumNumber := range inputHeader.GetQuorumNumbers() {
-		if quorumNumber > math.MaxUint8 {
-			return nil, fmt.Errorf(
-				"quorum number overflow: value was %d, but max allowable value is %d",
-				quorumNumber,
-				uint8(math.MaxUint8))
-		}
-
-		quorumNumbers = append(quorumNumbers, byte(quorumNumber))
+	quorumNumbers, err := QuorumNumbersUint32ToUint8(inputHeader.GetQuorumNumbers())
+	if err != nil {
+		return nil, fmt.Errorf("convert quorum numbers to uint8: %s", err)
 	}
 
 	convertedBlobCommitment, err := blobCommitmentProtoToBinding(inputHeader.GetCommitment())
@@ -308,3 +301,23 @@ func BlobCommitmentsBindingToInternal(
 
 	return blobCommitment, nil
 }
+
+// QuorumNumbersUint32ToUint8 accepts an array of uint32 quorum numbers, and converts it into an array of uint8 quorum
+// numbers.
+//
+// Returns an error if any quorum number is too large to fit into a uint8
+func QuorumNumbersUint32ToUint8(inputQuorums []uint32) ([]uint8, error) {
+	var outputQuorums []byte
+	for _, quorumNumber := range inputQuorums {
+		if quorumNumber > math.MaxUint8 {
+			return nil, fmt.Errorf(
+				"quorum number overflow: value was %d, but max allowable value is %d",
+				quorumNumber,
+				uint8(math.MaxUint8))
+		}
+
+		outputQuorums = append(outputQuorums, byte(quorumNumber))
+	}
+
+	return outputQuorums, nil
+}

api/clients/v2/verification/eigenda_cert.go

@@ -15,6 +15,7 @@ type EigenDACert struct {
 	BlobInclusionInfo           contractEigenDACertVerifier.BlobInclusionInfo
 	BatchHeader                 contractEigenDACertVerifier.BatchHeaderV2
 	NonSignerStakesAndSignature contractEigenDACertVerifier.NonSignerStakesAndSignature
+	SignedQuorumNumbers         []byte
 }
 
 // BuildEigenDACert creates a new EigenDACert from a BlobStatusReply, and NonSignerStakesAndSignature
@@ -28,15 +29,23 @@ func BuildEigenDACert(
 		return nil, fmt.Errorf("convert inclusion info to binding: %w", err)
 	}
 
-	bindingBatchHeader, err := BatchHeaderProtoToBinding(blobStatusReply.GetSignedBatch().GetHeader())
+	signedBatch := blobStatusReply.GetSignedBatch()
+
+	bindingBatchHeader, err := BatchHeaderProtoToBinding(signedBatch.GetHeader())
 	if err != nil {
 		return nil, fmt.Errorf("convert batch header to binding: %w", err)
 	}
 
+	quorumNumbers, err := QuorumNumbersUint32ToUint8(signedBatch.GetAttestation().GetQuorumNumbers())
+	if err != nil {
+		return nil, fmt.Errorf("convert quorum numbers to uint8: %w", err)
+	}
+
 	return &EigenDACert{
 		BlobInclusionInfo:           *bindingInclusionInfo,
 		BatchHeader:                 *bindingBatchHeader,
 		NonSignerStakesAndSignature: *nonSignerStakesAndSignature,
+		SignedQuorumNumbers:         quorumNumbers,
 	}, nil
 }
 

contracts/src/core/EigenDACertVerifier.sol

@@ -98,11 +98,13 @@ contract EigenDACertVerifier is IEigenDACertVerifier {
      * @param batchHeader The batch header of the blob 
      * @param blobInclusionInfo The inclusion proof for the blob cert
      * @param nonSignerStakesAndSignature The nonSignerStakesAndSignature to verify the blob cert against
+     * @param signedQuorumNumbers The signed quorum numbers corresponding to the nonSignerStakesAndSignature
      */
     function verifyDACertV2(
         BatchHeaderV2 calldata batchHeader,
         BlobInclusionInfo calldata blobInclusionInfo,
-        NonSignerStakesAndSignature calldata nonSignerStakesAndSignature
+        NonSignerStakesAndSignature calldata nonSignerStakesAndSignature,
+        bytes memory signedQuorumNumbers
     ) external view {
         EigenDACertVerificationUtils._verifyDACertV2ForQuorums(
             eigenDAThresholdRegistry,
@@ -112,7 +114,8 @@ contract EigenDACertVerifier is IEigenDACertVerifier {
             blobInclusionInfo,
             nonSignerStakesAndSignature,
             securityThresholdsV2,
-            quorumNumbersRequiredV2
+            quorumNumbersRequiredV2,
+            signedQuorumNumbers
         );
     }
 
@@ -145,11 +148,13 @@ contract EigenDACertVerifier is IEigenDACertVerifier {
      * @param batchHeader The batch header of the blob 
      * @param blobInclusionInfo The inclusion proof for the blob cert
      * @param nonSignerStakesAndSignature The nonSignerStakesAndSignature to verify the blob cert against
+     * @param signedQuorumNumbers The signed quorum numbers corresponding to the nonSignerStakesAndSignature
      */
     function verifyDACertV2ForZKProof(
         BatchHeaderV2 calldata batchHeader,
         BlobInclusionInfo calldata blobInclusionInfo,
-        NonSignerStakesAndSignature calldata nonSignerStakesAndSignature
+        NonSignerStakesAndSignature calldata nonSignerStakesAndSignature,
+        bytes memory signedQuorumNumbers
     ) external view returns (bool) {
         try EigenDACertVerificationUtils.verifyDACertV2ForQuorumsExternal(
             eigenDAThresholdRegistry,
@@ -159,7 +164,8 @@ contract EigenDACertVerifier is IEigenDACertVerifier {
             blobInclusionInfo,
             nonSignerStakesAndSignature,
             securityThresholdsV2,
-            quorumNumbersRequiredV2
+            quorumNumbersRequiredV2,
+            signedQuorumNumbers
         ) {
             return true;
         } catch {
@@ -172,10 +178,12 @@ contract EigenDACertVerifier is IEigenDACertVerifier {
     /**
      * @notice Returns the nonSignerStakesAndSignature for a given blob cert and signed batch
      * @param signedBatch The signed batch to get the nonSignerStakesAndSignature for
+     * @return nonSignerStakesAndSignature The nonSignerStakesAndSignature for the given signed batch attestation
+     * @return signedQuorumNumbers The signed quorum numbers for the given signed batch attestation
      */
     function getNonSignerStakesAndSignature(
         SignedBatch calldata signedBatch
-    ) external view returns (NonSignerStakesAndSignature memory) {
+    ) external view returns (NonSignerStakesAndSignature memory, bytes memory) {
         return EigenDACertVerificationUtils._getNonSignerStakesAndSignature(
             operatorStateRetriever, 
             registryCoordinator, 

contracts/src/interfaces/IEigenDACertVerifier.sol

@@ -32,11 +32,13 @@ interface IEigenDACertVerifier is IEigenDAThresholdRegistry {
      * @param batchHeader The batch header of the blob 
      * @param blobInclusionInfo The inclusion proof for the blob cert
      * @param nonSignerStakesAndSignature The nonSignerStakesAndSignature to verify the blob cert against
+     * @param signedQuorumNumbers The signed quorum numbers corresponding to the nonSignerStakesAndSignature
      */
     function verifyDACertV2(
         BatchHeaderV2 calldata batchHeader,
         BlobInclusionInfo calldata blobInclusionInfo,
-        NonSignerStakesAndSignature calldata nonSignerStakesAndSignature
+        NonSignerStakesAndSignature calldata nonSignerStakesAndSignature,
+        bytes memory signedQuorumNumbers
     ) external view;
 
     /**
@@ -49,13 +51,29 @@ interface IEigenDACertVerifier is IEigenDAThresholdRegistry {
         BlobInclusionInfo calldata blobInclusionInfo
     ) external view;
 
+    /**
+     * @notice Thin try/catch wrapper around verifyDACertV2 that returns false instead of panicing
+     * @dev The Steel library (https://github.com/risc0/risc0-ethereum/tree/main/crates/steel) 
+     *      currently has a limitation that it can only create zk proofs for functions that return a value
+     * @param batchHeader The batch header of the blob 
+     * @param blobInclusionInfo The inclusion proof for the blob cert
+     * @param nonSignerStakesAndSignature The nonSignerStakesAndSignature to verify the blob cert against
+     * @param signedQuorumNumbers The signed quorum numbers corresponding to the nonSignerStakesAndSignature
+     */
+    function verifyDACertV2ForZKProof(
+        BatchHeaderV2 calldata batchHeader,
+        BlobInclusionInfo calldata blobInclusionInfo,
+        NonSignerStakesAndSignature calldata nonSignerStakesAndSignature,
+        bytes memory signedQuorumNumbers
+    ) external view returns (bool);
+
     /**
      * @notice Returns the nonSignerStakesAndSignature for a given blob cert and signed batch
      * @param signedBatch The signed batch to get the nonSignerStakesAndSignature for
      */
     function getNonSignerStakesAndSignature(
         SignedBatch calldata signedBatch
-    ) external view returns (NonSignerStakesAndSignature memory);
+    ) external view returns (NonSignerStakesAndSignature memory, bytes memory);
 
     /**
      * @notice Verifies the security parameters for a blob cert