feat(stm): add missing off circuit checks

[damrobi]

Content

This PR includes the addition of some missing off circuit checks. The goal of those checks is to prevent a prover from trying to create a proof that will fail to verify since the proof creation is a very expensive operations.

Changes

• Validation of the protocol message hash: it was not done off circuit yet but is done at every step in circuit. Recompute the hash of the protocol message preimage and compares it to the MessageHash received.
• Check of the validity of the genesis verification key: verifies the key is an actual point on the elliptic curve. The check is done at every step (even post genesis) in circuit.
• Check that the protocol parameters do not evolve from one epoch to the next: check that protocol_parameters == next_protocol_parameters for the values coming from the rolling state. An update of the parameters would break the recursive proof.
• Moved all the checks to before the generation of the non recursive proof to allow a failure before the heavy computation: This implied a big restructure of the code around the call to the IVC prover

Pre-submit checklist

• Branch
  • Tests are provided (if possible)
  • Crates versions are updated (if relevant)
  • CHANGELOG file is updated (if relevant)
  • Commit sequence broadly makes sense
  • Key commits have useful messages
• PR
  • All check jobs of the CI have succeeded
  • Self-reviewed the diff
  • Useful pull request description
  • Reviewer requested

Comments

Issue(s)

Closes #3381

[github-actions]

Test Results

     5 files  ± 0     209 suites  ±0   1h 38m 3s ⏱️ - 40m 2s
 3 431 tests  - 31   3 431 ✅  - 31  0 💤 ±0  0 ❌ ±0 
11 291 runs   - 34  11 291 ✅  - 34  0 💤 ±0  0 ❌ ±0 

Results for commit 7a4a79a. ± Comparison against base commit c8ff793.

This pull request removes 41 and adds 10 tests. Note that renamed tests count towards both.

mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::index_out_of_bounds
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::index_too_large_for_circuit_range
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::indices_not_increasing
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_merkle_path_mismatch
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_swap_keep_merkle_path
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::leaf_wrong_verification_key
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_corrupt_sibling
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_flip_position
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_length_long
mithril-stm ‑ circuits::halo2::tests::golden::cases::negative::slow::merkle_path_length_short
…

mithril-stm ‑ circuits::halo2_ivc::state::tests::new_rejects_invalid_genesis_verification_key
mithril-stm ‑ proof_system::ivc_halo2_snark::proof::tests::off_circuit_genesis_checks_accepts_matching_certificate_preimage
mithril-stm ‑ proof_system::ivc_halo2_snark::proof::tests::off_circuit_genesis_checks_rejects_mismatched_certificate_preimage
mithril-stm ‑ proof_system::ivc_halo2_snark::prover_input_helpers::tests::assert_message_hash_matches_preimage::accepts_message_matching_preimage_hash
mithril-stm ‑ proof_system::ivc_halo2_snark::prover_input_helpers::tests::assert_message_hash_matches_preimage::rejects_message_not_matching_preimage_hash
mithril-stm ‑ proof_system::ivc_halo2_snark::rolling_state::tests::assert_correct_parameters::passes_at_first_step_even_when_protocol_parameters_differ
mithril-stm ‑ proof_system::ivc_halo2_snark::rolling_state::tests::assert_correct_parameters::passes_when_protocol_parameters_match_past_first_step
mithril-stm ‑ proof_system::ivc_halo2_snark::rolling_state::tests::assert_correct_parameters::rejects_diverged_protocol_parameters_past_first_step
mithril-stm ‑ protocol::aggregate_signature::clerk::tests::aggregate_signatures_with_type_ivc_snark_fails_when_genesis_verification_key_is_absent
mithril-stm ‑ protocol::aggregate_signature::clerk::tests::aggregate_signatures_with_type_ivc_snark_fails_when_prover_data_carries_no_ivc_rolling_state

♻️ This comment has been updated with latest results.

[hjeljeli32]

Good initial work 👍 . I left 2 comments.

[hjeljeli32]

LGTM. I just left 2 non-blocking suggestions.

[Copilot]

Pull request overview

Adds early off-circuit validation to avoid generating expensive proofs for invalid IVC transitions.

Changes:

• Validates message hashes, genesis keys, and protocol-parameter continuity.
• Splits IVC request validation from proof generation.
• Adds focused validation tests and propagates new errors.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
signature.rs	Propagates global validation failures.
clerk.rs	Runs preflight checks before proving.
rolling_state.rs	Checks protocol-parameter continuity.
prover_input.rs	Splits validation and preparation.
prover_input_helpers.rs	Adds message-preimage hash validation.
proof.rs	Exposes genesis and transition preflight checks.
setup.rs	Handles fallible global construction.
state.rs	Validates genesis verification keys.
errors.rs	Adds validation error variants.
bench/helpers.rs	Propagates global construction errors.

Suppressed comments (1)

mithril-stm/src/proof_system/ivc_halo2_snark/prover_input.rs:63

• The new preflight still does not validate that the rolling state's step counter can advance. A state at u64::MAX passes this function, so aggregate_signatures_with_type generates the expensive certificate proof and only then fails in build_next_state with StepCounterOverflow. Invoke new_step_counter() here so this existing failure path is rejected before proving, as intended by this split.

        let transition_type = IvcTransitionType::try_compute_transition_type(
            rolling_state,
            protocol_message_preimage,
        )?;

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.