feat: add aggchain params verification
#1060
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
There was a problem hiding this comment.
Pull Request Overview
This PR adds verification of the aggchain params field on FEP certificates by introducing a new verification step in the certificate validation process. The changes enable the validator to verify that the aggchain parameters in certificates match expected values computed from L1 and L2 network data.
- Adds new
VerifyAggchainDatamethod to theAggsenderFlowinterface and implements it for both PP and Aggchain prover flows - Introduces new
GetAggregationProofPublicValuesDatamethod to query aggregation proof data needed for verification - Updates configuration to include
OpNodeURLparameter for connecting to OP L2 nodes
Reviewed Changes
Copilot reviewed 24 out of 25 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| config/default.go | Adds OpNodeURL configuration parameter to FEP config template |
| cmd/run.go | Updates validator instantiation to pass new aggchain FEP querier parameter |
| aggsender/validator/config.go | Adds OpNodeURL field to FEPConfig struct |
| aggsender/validator/validate_certificate.go | Implements aggchain data verification in certificate validation flow |
| aggsender/types/interfaces.go | Adds VerifyAggchainData method to AggsenderFlow interface and GetAggregationProofPublicValuesData to AggchainFEPRollupQuerier |
| aggsender/flows/flow_*.go | Implements VerifyAggchainData methods for both PP and Aggchain prover flows |
| aggsender/query/aggchain_fep_rollup_query.go | Implements GetAggregationProofPublicValuesData method for aggchain FEP querying |
| aggsender/optimistic/*.go | Refactors aggregation proof types from optimistichash package to types package |
goran-ethernal
force-pushed
the
feat/add-aggchain-params-verification
branch
4 times, most recently
from
3b5afe8 to
a5592a5
Compare
aggsender/optimistic/optimistic_aggregation_proof_public_values_query.go
Outdated
Show resolved
Hide resolved
Stefan-Ethernal
approved these changes
Sep 30, 2025
aggsender/optimistic/optimistic_aggregation_proof_public_values_query.go
Outdated
Show resolved
Hide resolved
goran-ethernal
force-pushed
the
feat/add-aggchain-params-verification
branch
from
f9b748c to
41b70f8
Compare
joanestebanr
reviewed
Oct 2, 2025
|
joanestebanr
reviewed
Oct 3, 2025
joanestebanr
approved these changes
Oct 3, 2025
This was referenced Oct 6, 2025
Stefan-Ethernal
added a commit
that referenced
this pull request
Oct 10, 2025
## 🔄 Changes Summary Enable the AggSender to work with multiple validator nodes in a committee-based validation system. The implementation includes validator services, multisig committee management, certificate validation improvements, and enhanced gRPC communication protocols. **Multisig Committee Support:** - Added `MultisigCommittee` type to manage signer sets and enforce signature thresholds. - Signers are represented as `SignerInfo` structs with both address and URL for improved context and error reporting. - Committee construction validates non-empty membership and non-zero threshold, preventing misconfiguration. - Dynamic signer management: methods for adding signers, duplicate checks by address and URL. **Aggsender Validator Refactor:** - The Aggsender certificate validation flow was refactored to integrate multisig logic. - The multisig validation logic is applicable to both `PP` and `FEP` certificates. - Certificate validation now checks for contiguous certificates, last L2 block, and settlement status using new queries. - Import bridge exit proof verification is handled via new logic using `verifyClaimProofs`, ensuring only valid proofs pass. **Certificate Metadata removal:** - It is gone from the agglayer and therefore it is not sent anymore from the aggsender either. - Only thing worth noting is that, when calculating `CertificateID`, instead of metadata field, which was used previously, we now use `ZeroHash`. **Smart contracts integration:** - **AggchainFEP contract:** Removed querying of `TrustedSequencer` address and rely on the signers committee instead - **AggchainBase contract:** Retrieve the multisig committee from the `AggchainBase` contract **Agglayer integration:** - Invoke the `GetNetworkState` API from agglayer to get the latest settled imported bridge exit info. - Multisig is populated into the certificate and sent to the Agglayer's `SendCertificate` gRPC endpoint ##⚠️ Breaking Changes - 🛠️ **Config**: Make sure that `Mode` on the `Validator` and `AggSender` are the same. - 🔌 **API/CLI**: `aggkit` version (`v0.7.0`) that supports `multisig` will now require updated contracts to run. At least version `v12.1.0-rc.3` of `agglayer-contracts`, and a new version of `agglayer` which supports `multisig`, which is the `v0.4.0` of `agglayer`. - 🗑️ **Deprecated Features**: Aggsender Phase II validator signing logic ## 📋 Config Updates - Added `AggSender.RequireCommitteeMembershipCheck = false` parameter, which defines if a check on `aggsender proposer` startup will be performed to see if the proposer is in the `multisig` committee. - Added `Validator.RequireCommitteeMembershipCheck = {{AggSender.RequireCommitteeMembershipCheck}}` parameter, which defines if a check on `aggsender validator` startup will be performed to see if the validator is in the `multisig` committee. - Added `Validator.Mode = "PessimisticProof"` parameter, which acts the same as the `AggSender.Mode`. It tells the validator that the network is a `PP` network or an `FEP` network. It has to be the same as on `aggsender proposer`. - Added `Validator.FEPConfig.SovereignRollupAddr = "{{AggSender.SovereignRollupAddr}}" parameter which is the address of the `AggchainFEP` rollup on L1 for given network for which validator is running. - Added `Validator.FEPConfig.RequireNoBlockGap = {{AggSender.RequireNoFEPBlockGap}}, which acts the same as the given paremeter on `AggSender` (proposer) config, and tells the validator if gaps in blocks in certificates are allowed in `FEP` network. ```toml [AggSender] RequireCommitteeMembershipCheck = false [Validator] # PessimisticProof or AggchainProof Mode = "PessimisticProof" RequireCommitteeMembershipCheck = {{AggSender.RequireCommitteeMembershipCheck}} [Validator.FEPConfig] SovereignRollupAddr = "{{AggSender.SovereignRollupAddr}}" RequireNoBlockGap = "{{AggSender.RequireNoFEPBlockGap}}" ``` ## ✅ Testing - 🤖 **Automatic**: `aggkit` CI - 🖱️ **Manual**: [Optional: Steps to verify] ## 🐞 Issues - Closes #792 ## 🔗 Related PRs - #814 - #832 - #838 - #839 - #843 - #842 - #846 - #858 - #847 - #865 - #861 - #863 - #875 - #876 - #881 - #877 - #898 - #920 - #913 - #926 - #945 - #951 - #954 - #957 - #955 - #974 - #978 - #985 - #989 - #984 - #998 - #1017 - #1028 - #1034 - #1024 - #1052 - #1067 - #1068 - #1050 - #1071 - #1072 - #1060 - #1087 - #1077 - #1073 --------- Co-authored-by: Goran Rojovic <[email protected]> Co-authored-by: Goran Rojovic <[email protected]> Co-authored-by: Joan Esteban <[email protected]> Co-authored-by: Rachit Sonthalia <[email protected]> Co-authored-by: Arpit Temani <[email protected]> Co-authored-by: Copilot <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🔄 Changes Summary
This PR adds verification of the
aggchain paramsfield on theFEPcertificates.It also separates the
builderandverifierflows (PPandFEP).Builderflows are used inaggsender-proposerto build certificates.Verifierflows are used inaggsender-validatorto verify certificates. Note here, that validator also needs to build certificates, soverifierflowsinheritthe builder flows as well. This makes them inherit theirbuild certificatefunctions, and common fields which are needed in theverifieras well.NA
📋 Config Updates
Added new parameter to
Validator.FEPConfigcalledOpNodeURLwhich is the URL to the op l2 node used for retreiving op data for FEP certificates:✅ Testing
aggkitCI🐞 Issues
aggchain paramsverification #1060