feat: merge-train/fairies-v5 - #24206
Merged
Merged
Conversation
## Why we are doing this Utility functions had no notion of `msg_sender`, so a utility that wanted to know its caller had to accept it as a parameter. `HandshakeRegistry::get_app_siloed_secret` took an explicit `caller` argument and siloed the returned secret by it, so a hostile contract could pass another address and read an app's siloed secret it shouldn't see. ## Our fix - `UtilityContext` gains a `msg_sender`, exposed as `self.msg_sender()` and `self.context.maybe_msg_sender()`, mirroring the private and public contexts. - It is set only for cross-contract calls (utility-to-utility or private-to-utility), where it is the calling contract's address taken from the call graph and so cannot be forged. A top-level call (invoked directly by a wallet or dapp) has no caller: `maybe_msg_sender()` is `none` and `msg_sender()` panics. The `from` supplied when simulating still only controls note/key visibility; it is never exposed as a sender. - `HandshakeRegistry::get_app_siloed_secret` drops the forgeable `caller` parameter and silos by `self.msg_sender()`, so a contract can only retrieve secrets siloed to its own address. - `TestEnvironment` gains `ExecuteUtilityOptions::with_from` to simulate a cross-contract caller in tests without routing through an actual nested call. Fixes F-671 --------- Co-authored-by: Nicolás Venturo <nicolas.venturo@gmail.com>
Collaborator
Author
|
🤖 Auto-merge enabled after 4 hours of inactivity. This PR will be merged automatically once all checks pass. |
rangozd
pushed a commit
to rangozd/aztec-packages
that referenced
this pull request
Aug 5, 2026
RAW cherry-pick of public merge 4df7243 (-m 1) onto next@145d9266de. Conflicts committed as git produced them; does not build. Conflicted: migration_notes.md, standard_addresses.nr (x2), pinned-standard-contracts.tar.gz, private_execution_oracle.ts, standard_contract_data.ts. Auto-merged hybrid noted for later audit: handshake_registry test.nr (next's delivery-mode API evolution x AztecProtocol#24206's rewrite). Resolution in fix(port) commits; standard-contracts artifacts get a single end-of-stack regen.
rangozd
pushed a commit
to rangozd/aztec-packages
that referenced
this pull request
Aug 5, 2026
… files + handshake test.nr to source All five paths byte-identical to source 4df7243 afterward. Recipe: git checkout 4df7243 -- noir-projects/aztec-nr/aztec/src/standard_addresses.nr \ noir-projects/noir-contracts/contracts/protocol/aztec_sublib/src/standard_addresses.nr \ noir-projects/noir-contracts/pinned-standard-contracts.tar.gz \ yarn-project/standard-contracts/src/standard_contract_data.ts \ noir-projects/noir-contracts/contracts/standard/handshake_registry_contract/src/test.nr Interim state only: later fairies blocks rewrite handshake, and the standard-contracts artifacts get one end-of-stack regen on the final tree (owning block = last handshake-touching block).
rangozd
pushed a commit
to rangozd/aztec-packages
that referenced
this pull request
Aug 5, 2026
…hoist + migration_notes union private_execution_oracle.ts: AztecProtocol#24206 hoists callContext into the UtilityExecutionOracle base; next-only txRequestSalt field kept (declared + assigned in the subclass, used by getPrivateContextInputs). Direct callContext declaration/assignment removed — resolves via the base brought in by this pick. migration_notes.md: union of next's tx_request_salt entry and AztecProtocol#24206's utility msg_sender entry.
rangozd
pushed a commit
to rangozd/aztec-packages
that referenced
this pull request
Aug 5, 2026
…n the final tree
Regenerated pinned standard contracts with THIS tree's toolchain (next's bb; VK size 4832). The
v5-pinned artifacts carried v5-bb-format VKs (4576) and failed next's standard-contracts data
generation with 'BBApiException: verification key has wrong size: expected 4832, got 4576' — the
exact cold-build failure from the previous CI rounds. Recipe (converges in 3 iterations):
repeat: (cd noir-projects/noir-contracts && ./bootstrap.sh pin-standard-build)
(cd yarn-project/standard-contracts && yarn generate:data)
until generate:data reports no drift.
Owning blocks: the fairies handshake/standard chain (AztecProtocol#24206 -> AztecProtocol#24455). aztec_sublib no longer
carries an address stamp (deleted on the v5 line by AztecProtocol#24223).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
BEGIN_COMMIT_OVERRIDE
feat(aztec-nr)!: add msg_sender to the utility context (#24062)
fix(cli): transpile pre-existing artifacts on aztec compile (#24188)
END_COMMIT_OVERRIDE