62 lines
6.1 KiB
Markdown
62 lines
6.1 KiB
Markdown
# Spec 6: AerePQAggregate build summary
|
|
|
|
> **Note added 2026-09-24 (consensus).** Where this document says that consensus is classical secp256k1 ECDSA and not post-quantum, read it as the per-block finality statement it was until block 24,300,000 (AIP-22 stage 4, 2026-10-25). Since that block every validator attributes a consensus vote only through its verified post-quantum seal, and a block is post-quantum final once the next anchor, at most 32 blocks later, carries the certificate that covers it; headers still carry classical ECDSA commit seals until AIP-22 stage 5 (this sentence corrected on 2026-10-25). It no longer describes all of consensus on chain 2800: since 2026-08-14 every anchor block must carry a certificate of validator post-quantum seals under its hash (Falcon-512, with SLH-DSA as well since 2026-09-04), and since 2026-09-05 the nine AERE-client validators (nine of the ten) refuse any QBFT consensus message without a valid Falcon-512 seal of its author, while the tenth, the second client, enforced that seal only on commit messages until block 24,300,000 and attributes every consensus message only through it since (this clause corrected on 2026-10-12 and 2026-10-25). (Note applied to this document on 2026-10-28.)
|
|
|
|
> **Note added 2026-08-19.** Statements in this document that consensus on chain 2800 is (or remains) classical secp256k1 ECDSA QBFT were written before the post-quantum header anchor went live, and remain true for block-by-block finality. Since block 13,014,000 anchor blocks (every 32nd block, on every one since block 13,889,296) also carry, under the block hash, a certificate of validator Falcon-512 seals, and since 2026-08-14 a node rejects an anchor block with fewer than three valid seals (f+1 of nine; eight or nine are carried in practice). That is a post-quantum checkpoint about every 16 seconds, not a per-block quorum: the claim published on 2026-08-15 that from block 14,050,000 no block finalizes without a post-quantum quorum was wrong (the per-block rule armed at that height is retired in the shipped code in favour of the anchor rules) and was withdrawn on 2026-08-19. Details: https://aere.network/quantum.html and the aere-node repository, anchor/README.md.
|
|
|
|
## What was built
|
|
Constant-cost on-chain verification of a t-of-n POST-QUANTUM committee authorization via ONE
|
|
succinct SP1 proof, exposed as an ERC-4337 path and a portable ERC-7579 validator module.
|
|
|
|
### Files (new, no deployed contracts modified)
|
|
- `aere-contracts/contracts/mpc/AerePQAggregateVerifier.sol`
|
|
- `registerCommittee(root, t, n, scheme)`, stores committee (root = commitment to n PQC keys;
|
|
keys NOT stored on-chain, so cost stays O(1) in n). Permissionless, no admin, no funds.
|
|
- `verifyAggregate(committeeId, messageDigest, publicValues, proofBytes)` view, strict fail-closed:
|
|
binds committeeRoot / t / n / scheme / messageDigest / validCount>=t, then ONE
|
|
`SP1_GATEWAY.verifyProof(pinnedVKey, publicValues, proofBytes)`. Reverts on any mismatch or bad proof.
|
|
- `tryVerifyAggregate(...)` view, non-reverting bool (try/catch wrap) for 4337/7579 SHOULD-not-revert.
|
|
- `recordAggregate(...)`, strict verify + provenance attestation event.
|
|
- Immutable `SP1_GATEWAY` (chain 2800 canonical Succinct gateway 0x9ca479C8…70628) and
|
|
`AGGREGATE_PROGRAM_VKEY` (pinned circuit; registrant cannot swap circuits).
|
|
- Public-values layout (fixed 192 bytes / 6 words):
|
|
`abi.encode(bytes32 committeeRoot, uint256 t, uint256 n, uint256 scheme, bytes32 msgDigest, uint256 validCount)`.
|
|
- `aere-contracts/contracts/modular/AerePQAggregateModule.sol`
|
|
- ERC-7579 type-1 validator (matches OZ draft-IERC7579 `IERC7579Validator`): `onInstall`/`onUninstall`/
|
|
`isModuleType`, `validateUserOp(PackedUserOperation, bytes32)->uint256` (0/1), and
|
|
`isValidSignatureWithSender(address,bytes32,bytes)->bytes4` (0x1626ba7e / 0xffffffff).
|
|
- Singleton, per-account committee binding keyed by msg.sender (AereSessionKeyValidator pattern).
|
|
- Signature layout: `abi.encode(bytes publicValues, bytes proofBytes)`; malformed => FAILED, no revert.
|
|
- Local PackedUserOperation struct (self-contained, portable to any EVM chain).
|
|
- `aere-contracts/test/AerePQAggregate.test.js`, 17 tests.
|
|
- `aerenew/docs/AERE-PQ-AGGREGATE.md`, scheme, gas argument, 4337/7579 portability, Bank28 use case,
|
|
honest [MEASURE] status.
|
|
|
|
## REAL test result
|
|
`npx hardhat test test/AerePQAggregate.test.js` => **17 passing (2s)**. Ran from aerenew/contracts.
|
|
Test double = MockSp1Verifier (verifyProof REVERTS on invalid proof, exact production gateway semantics),
|
|
same double as AereComputeMarketV3 / zk light clients.
|
|
|
|
Coverage: valid proof authorizes (view+recorded); invalid proof rejects fail-closed; wrong message
|
|
digest rejects; wrong committee root rejects; below-threshold rejects; t/n/scheme mismatch + malformed
|
|
public values reject; unknown committee rejects; module returns 4337 code + ERC-1271 magic correctly and
|
|
fails closed without reverting on invalid/malformed.
|
|
|
|
### Gas independence (the headline)
|
|
`recordAggregate`: n=5 => 61,799 gas; n=1,000,000 => 61,823 gas; diff 24 gas (calldata encoding of the
|
|
larger integer, O(log n) not O(n)). Concretely proves constant on-chain cost regardless of committee size.
|
|
|
|
## Flags
|
|
- [MEASURE] OFF-CHAIN SP1 aggregation guest circuit NOT implemented (research zkVM work). Verifying
|
|
Falcon FFT/float sampling in a zkVM is hard => ML-DSA-65 (FIPS 204, integer arithmetic) is the tractable
|
|
first target (SCHEME_MLDSA65 = 5). On-chain side is built + tested vs a MOCK gateway only. Do NOT claim
|
|
end-to-end aggregation works.
|
|
- [MEASURE] real-gateway on-chain verify gas + real proving cost/latency (mock numbers above).
|
|
- [VERIFY] ERC-7579 module assumes account stripped the validator-routing prefix before calling
|
|
(matches OZ AccountERC7579); PackedUserOperation field layout to reconcile vs Safe7579 / Kernel / Nexus.
|
|
- [VERIFY] isValidSignatureWithSender intentionally does NOT scope by `sender` (committee is sole authority).
|
|
|
|
## Scope boundary kept
|
|
Account/authorization aggregation only. Consensus stays classical ECDSA QBFT. No new token. No funds,
|
|
no admin. solc 0.8.23, viaIR, matches repo style. No em-dashes in prose.
|