feat(stm): add missing off circuit checks by damrobi · Pull Request #3480 · IntersectMBO/mithril

damrobi · 2026-08-13T15:22:19Z

Content

This PR includes the addition of some missing off circuit checks. The goal of those checks is to prevent a prover from trying to create a proof that will fail to verify since the proof creation is a very expensive operations.

Changes

Validation of the protocol message hash: it was not done off circuit yet but is done at every step in circuit. Recompute the hash of the protocol message preimage and compares it to the MessageHash received.
Check of the validity of the genesis verification key: verifies the key is an actual point on the elliptic curve. The check is done at every step (even post genesis) in circuit.
Check that the protocol parameters do not evolve from one epoch to the next: check that protocol_parameters == next_protocol_parameters for the values coming from the rolling state. An update of the parameters would break the recursive proof.
Moved all the checks to before the generation of the non recursive proof to allow a failure before the heavy computation: This implied a big restructure of the code around the call to the IVC prover

Pre-submit checklist

Branch
- Tests are provided (if possible)
- Crates versions are updated (if relevant)
- CHANGELOG file is updated (if relevant)
- Commit sequence broadly makes sense
- Key commits have useful messages
PR
- All check jobs of the CI have succeeded
- Self-reviewed the diff
- Useful pull request description
- Reviewer requested

Comments

Issue(s)

Closes #3381

github-actions · 2026-08-13T16:16:42Z

Test Results

5 files ± 0 209 suites ±0 1h 45m 12s ⏱️ - 40m 24s
3 407 tests - 43 3 406 ✅ - 44 0 💤 ±0 1 ❌ +1
11 267 runs - 46 11 266 ✅ - 47 0 💤 ±0 1 ❌ +1

For more details on these failures, see this check.

Results for commit b082171. ± Comparison against base commit 58b575a.

This pull request removes 51 and adds 8 tests. Note that renamed tests count towards both.

mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::index_out_of_bounds
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::index_too_large_for_circuit_range
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::indices_not_increasing
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_merkle_path_mismatch
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_swap_keep_merkle_path
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_wrong_verification_key
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_corrupt_sibling
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_flip_position
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_length_long
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_length_short
…

mithril-stm ‑ circuits::halo2_ivc::state::tests::new_rejects_invalid_genesis_verification_key
mithril-stm ‑ proof_system::ivc_halo2_snark::prover_input_helpers::tests::assert_message_hash_matches_preimage::accepts_message_matching_preimage_hash
mithril-stm ‑ proof_system::ivc_halo2_snark::prover_input_helpers::tests::assert_message_hash_matches_preimage::rejects_message_not_matching_preimage_hash
mithril-stm ‑ proof_system::ivc_halo2_snark::rolling_state::tests::assert_correct_parameters::passes_at_first_step_even_when_protocol_parameters_differ
mithril-stm ‑ proof_system::ivc_halo2_snark::rolling_state::tests::assert_correct_parameters::passes_when_protocol_parameters_match_past_first_step
mithril-stm ‑ proof_system::ivc_halo2_snark::rolling_state::tests::assert_correct_parameters::rejects_diverged_protocol_parameters_past_first_step
mithril-stm ‑ protocol::aggregate_signature::clerk::tests::aggregate_signatures_with_type_ivc_snark_fails_when_genesis_verification_key_is_absent
mithril-stm ‑ protocol::aggregate_signature::clerk::tests::aggregate_signatures_with_type_ivc_snark_fails_when_prover_data_carries_no_ivc_rolling_state

♻️ This comment has been updated with latest results.

…e proofs

+    pub(crate) fn finish_prepare<D: MembershipDigest>(
+        checks: IvcProverInputChecks,
+        certificate_proof: &SnarkProof<D>,
+        message: &[u8],
+        aggregate_verification_key_for_snark: &AggregateVerificationKeyForSnark<D>,
+        global: &Global,
+        protocol_message_preimage: &ProtocolMessagePreimage,
+        rolling_state: &IvcRollingState,
+        prover_setup: &IvcSnarkProverSetup,
+    ) -> StmResult<Self> {


+    pub(crate) fn finish_prepare<D: MembershipDigest>(
+        checks: IvcProverInputChecks,
+        certificate_proof: &SnarkProof<D>,
+        message: &[u8],
+        aggregate_verification_key_for_snark: &AggregateVerificationKeyForSnark<D>,
+        global: &Global,
+        protocol_message_preimage: &ProtocolMessagePreimage,
+        rolling_state: &IvcRollingState,
+        prover_setup: &IvcSnarkProverSetup,
+    ) -> StmResult<Self> {


hjeljeli32

Good initial work 👍 . I left 2 comments.

hjeljeli32 · 2026-08-19T00:32:30Z

+                genesis_bootstrap.genesis_signature,
+                &combined_fixed_base_names,
+            );
+            prepare_genesis_checks(&genesis_rolling_state, &protocol_message_preimage, &global)?;


@damrobi I think the genesis check uses the wrong preimage. If I understood well, protocol_message_preimage is the preimage of the current certificate. I think we should pass &genesis_bootstrap.genesis_protocol_message_preimage

hjeljeli32 · 2026-08-19T00:34:13Z

+
+    match current_rolling_state {
+        Some(rolling_state) => {
+            rolling_state.assert_protocol_parameters_unchanged()?;


Would it make sense to move this check into IvcProverInput::prepare_checks? Keeping it here means direct IvcProver::prove / IvcProverInput::prepare callers bypass this invariant.

feat(stm): added off-circuit validation of the protocol message hash

a8ca5d2

damrobi self-assigned this Aug 13, 2026

feat(stm): added check for validity of genesis vk

571db0e

damrobi deployed to testing-preview August 14, 2026 11:29 — with GitHub Actions Active

damrobi deployed to testing-2-preview August 14, 2026 11:29 — with GitHub Actions Active

damrobi deployed to testing-preview August 14, 2026 14:50 — with GitHub Actions Active

damrobi deployed to testing-2-preview August 14, 2026 14:50 — with GitHub Actions Active

damrobi added 3 commits August 14, 2026 18:08

feat(stm): added a test for the new genesis vk check

29d44f3

feat(stm): added a check that protocol parameters stay constants for IVC

d33f17c

refactor(stm): reordered the code to have the checks happen before th…

b082171

…e proofs

damrobi force-pushed the damrobi/msnark/3381-add-off-circuit-checks branch from 8233f3e to b082171 Compare August 14, 2026 16:08

damrobi marked this pull request as ready for review August 14, 2026 16:09

damrobi requested review from curiecrypt, hjeljeli32 and jpraynaud as code owners August 14, 2026 16:09

github-advanced-security AI found potential problems Aug 14, 2026

View reviewed changes

hjeljeli32 reviewed Aug 19, 2026

View reviewed changes

Navigation Menu

Uh oh!

feat(stm): add missing off circuit checks - #3480

feat(stm): add missing off circuit checks#3480
damrobi wants to merge 5 commits into
mainfrom
damrobi/msnark/3381-add-off-circuit-checks

damrobi commented Aug 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 13, 2026 •

edited

Loading

Uh oh!

hjeljeli32 left a comment

Uh oh!

hjeljeli32 Aug 19, 2026

Uh oh!

hjeljeli32 Aug 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

damrobi commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Content

Changes

Pre-submit checklist

Comments

Issue(s)

Uh oh!

github-actions Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

hjeljeli32 left a comment

Choose a reason for hiding this comment

Uh oh!

hjeljeli32 Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

hjeljeli32 Aug 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

damrobi commented Aug 13, 2026 •

edited

Loading

github-actions Bot commented Aug 13, 2026 •

edited

Loading