fix!(statetransition): fix many bugs

* fix!(statetransition): bind ProcessProofs Keys to params.StateKeys, and verify IsValidCensusOrigin

* fix!(statetransition): ResultsAdd and ResultsSub transitions must be UPDATE

* fix!(statetransition): verify circuit.VotesProofs.VoteIDs invariants

* fix!(statetransition): encode VotersCount in blobs
    this fixes a vulnerability that allowed arbitrary dummy-slot
    VoteID, Address, and ReencryptedBallot witness values to be committed
    into the blob while not being tied to any verified leaf update

* fix!(statetransition): VerifyMerkleTransitionKeys

* refactor(statetransition): unify range loop style

Author: altergui

census/gnark.go

@@ -28,3 +28,12 @@ func IsMerkleTreeCensusOrigin(api frontend.API, origin frontend.Variable) fronte
 func IsCSPCensusOrigin(api frontend.API, origin frontend.Variable) frontend.Variable {
 	return api.IsZero(api.Sub(origin, uint8(types.CensusOriginCSPEdDSABabyJubJubV1)))
 }
+
+// IsValidCensusOrigin returns a frontend.Variable that is 1 if the provided
+// origin corresponds to any supported census origin, 0 otherwise.
+func IsValidCensusOrigin(api frontend.API, origin frontend.Variable) frontend.Variable {
+	return api.Or(
+		IsMerkleTreeCensusOrigin(api, origin),
+		IsCSPCensusOrigin(api, origin),
+	)
+}

circuits/statetransition/inputs.go

@@ -5,6 +5,7 @@ import (
 	"math/big"
 
 	"github.com/vocdoni/davinci-node/circuits/merkleproof"
+	"github.com/vocdoni/davinci-node/spec/params"
 	"github.com/vocdoni/davinci-node/state"
 	"github.com/vocdoni/davinci-node/types"
 )
@@ -83,7 +84,7 @@ func GenerateAssignment(
 		return nil, nil, fmt.Errorf("could not get EncryptionKey proof: %w", err)
 	}
 	// add Ballots and VoteIDs proofs
-	for i := range assignment.VotesProofs.Ballot {
+	for i := range params.VotesPerBatch {
 		// ballots
 		assignment.VotesProofs.Ballot[i], err = merkleproof.MerkleTransitionFromArboTransition(o.VotesProofs().Ballot[i])
 		if err != nil {

circuits/statetransition/statetransition.go

@@ -67,7 +67,7 @@ type Results struct {
 }
 
 // ProcessProofs struct contains the Merkle proofs for the process for the ID
-// CensusRoot, BallotMode and EncryptionKey.
+// CensusOrigin, BallotMode and EncryptionKey.
 type ProcessProofs struct {
 	ID            merkleproof.MerkleProof
 	CensusOrigin  merkleproof.MerkleProof
@@ -84,9 +84,8 @@ type CensusProofs struct {
 }
 
 // VotesProofs struct contains the Merkle transition proofs for the ballots and
-// commitments.
+// voteIDs.
 type VotesProofs struct {
-	// Key is Address, LeafHash is smt.Hash1(encoded(Ballot.Serialize()))
 	Ballot  [params.VotesPerBatch]merkleproof.MerkleTransition
 	VoteIDs [params.VotesPerBatch]merkleproof.MerkleTransition
 }
@@ -114,13 +113,16 @@ func (circuit StateTransitionCircuit) Define(api frontend.API) error {
 	// recursive proof
 	circuit.VerifyAggregatorProof(api, isRealVote)
 	// current state
-	circuit.VerifyMerkleProofs(api, HashFn)
+	circuit.VerifyProcessProofKeys(api)
+	circuit.VerifyProcessProofs(api, HashFn)
 	// state transition
+	circuit.VerifyMerkleTransitionKeys(api)
 	circuit.VerifyMerkleTransitions(api, isRealVote)
 	circuit.VerifyRootTransition(api, HashFn)
 	// leaf hashes
 	circuit.VerifyLeafHashes(api, HashFn)
 	// censuses
+	circuit.VerifyIsValidCensusOrigin(api)
 	circuit.VerifyMerkleCensusProofs(api, isRealVote)
 	circuit.VerifyCSPCensusProofs(api, isRealVote)
 	// votes reencryption and ballots
@@ -249,33 +251,49 @@ func (circuit StateTransitionCircuit) VerifyAggregatorProof(api frontend.API, is
 // To reencrypt the votes, it adds the encrypted zero ballot to the original
 // ballot. The encrypted zero uses the reencryptionK as the randomness.
 func (circuit StateTransitionCircuit) VerifyReencryptedVotes(api frontend.API, isRealVote []frontend.Variable) {
-	lastK := frontend.Variable(circuit.ReencryptionK)
-	for i, v := range circuit.Votes {
-		var err error
-		var reencryptedBallot *circuits.Ballot
-		reencryptedBallot, lastK, err = v.Ballot.Reencrypt(api, circuit.Process.EncryptionKey, lastK)
+	lastK := circuit.ReencryptionK
+	for i := range params.VotesPerBatch {
+		v := circuit.Votes[i]
+		reencryptedBallot, k, err := v.Ballot.Reencrypt(api, circuit.Process.EncryptionKey, lastK)
 		if err != nil {
 			circuits.FrontendError(api, "failed to reencrypt ballot: ", err)
 			return
 		}
 		circuits.AssertTrueIf(api, isRealVote[i], v.ReencryptedBallot.IsEqual(api, reencryptedBallot))
+		lastK = k
 	}
 }
 
-// VerifyMerkleProofs verifies that the ProcessID, CensusRoot, BallotMode
+// VerifyProcessProofKeys asserts that the process proofs are bound to the
+// canonical state keys for each process parameter.
+func (circuit StateTransitionCircuit) VerifyProcessProofKeys(api frontend.API) {
+	api.AssertIsEqual(circuit.ProcessProofs.ID.Key, params.StateKeyProcessID)
+	api.AssertIsEqual(circuit.ProcessProofs.CensusOrigin.Key, params.StateKeyCensusOrigin)
+	api.AssertIsEqual(circuit.ProcessProofs.BallotMode.Key, params.StateKeyBallotMode)
+	api.AssertIsEqual(circuit.ProcessProofs.EncryptionKey.Key, params.StateKeyEncryptionKey)
+}
+
+// VerifyProcessProofs verifies that the ProcessID, CensusOrigin, BallotMode
 // and EncryptionKey belong to the RootHashBefore. It uses the MerkleProof
 // structure to verify the proofs. The proofs are verified using the Verify
 // function of the MerkleProof structure.
-func (circuit StateTransitionCircuit) VerifyMerkleProofs(api frontend.API, hFn utils.Hasher) {
+func (circuit StateTransitionCircuit) VerifyProcessProofs(api frontend.API, hFn utils.Hasher) {
 	circuit.ProcessProofs.ID.Verify(api, hFn, circuit.RootHashBefore)
 	circuit.ProcessProofs.CensusOrigin.Verify(api, hFn, circuit.RootHashBefore)
 	circuit.ProcessProofs.BallotMode.Verify(api, hFn, circuit.RootHashBefore)
 	circuit.ProcessProofs.EncryptionKey.Verify(api, hFn, circuit.RootHashBefore)
 }
 
+// VerifyIsValidCensusOrigin asserts that the census origin is one of the
+// variants currently supported by the circuit.
+func (circuit StateTransitionCircuit) VerifyIsValidCensusOrigin(api frontend.API) {
+	api.AssertIsEqual(census.IsValidCensusOrigin(api, circuit.Process.CensusOrigin), 1)
+}
+
 // VerifyMerkleTransitions enforces that each MerkleTransition is of the expected type:
 //   - Ballot transitions must be INSERT or UPDATE
 //   - VoteID transitions must be INSERT
+//   - ResultsAdd and ResultsSub transitions must be UPDATE
 //   - all dummy slots must be NOOP
 func (circuit StateTransitionCircuit) VerifyMerkleTransitions(api frontend.API, isRealVote []frontend.Variable) {
 	for i := range params.VotesPerBatch {
@@ -287,6 +305,20 @@ func (circuit StateTransitionCircuit) VerifyMerkleTransitions(api frontend.API,
 		circuits.AssertTrueIf(api, isDummy, circuit.VotesProofs.Ballot[i].IsNoop(api))
 		circuits.AssertTrueIf(api, isDummy, circuit.VotesProofs.VoteIDs[i].IsNoop(api))
 	}
+	api.AssertIsEqual(circuit.ResultsProofs.ResultsAdd.IsUpdate(api), 1)
+	api.AssertIsEqual(circuit.ResultsProofs.ResultsSub.IsUpdate(api), 1)
+}
+
+// VerifyMerkleTransitionKeys asserts that the merkle transition keys are bound to the
+// canonical state keys or namespaces.
+func (circuit StateTransitionCircuit) VerifyMerkleTransitionKeys(api frontend.API) {
+	circuit.ResultsProofs.ResultsAdd.VerifyNewKey(api, params.StateKeyResultsAdd)
+	circuit.ResultsProofs.ResultsSub.VerifyNewKey(api, params.StateKeyResultsSub)
+	// Votes
+	for i := range params.VotesPerBatch {
+		circuit.VotesProofs.VoteIDs[i].VerifyNewKey(api, circuit.Votes[i].VoteID)
+		circuit.VotesProofs.Ballot[i].VerifyNewKey(api, circuit.Votes[i].BallotIndex)
+	}
 }
 
 // VerifyRootTransition verifies that the chain of tree transitions is valid.
@@ -326,33 +358,36 @@ func (circuit StateTransitionCircuit) VerifyLeafHashes(api frontend.API, hFn uti
 		return
 	}
 	// Votes
-	for i, v := range circuit.Votes {
-		// Address
-		circuit.VotesProofs.Ballot[i].VerifyNewKey(api, v.BallotIndex)
+	for i := range params.VotesPerBatch {
 		// Ballot
-		if err := circuit.VotesProofs.Ballot[i].VerifyNewLeafHash(api, hFn, v.ReencryptedBallot.SerializeVars()...); err != nil {
+		if err := circuit.VotesProofs.Ballot[i].VerifyNewLeafHash(api, hFn, circuit.Votes[i].ReencryptedBallot.SerializeVars()...); err != nil {
 			circuits.FrontendError(api, "failed to verify ballot vote proof leaf hash: ", err)
 			return
 		}
 		// OverwrittenBallot
-		if err := circuit.VotesProofs.Ballot[i].VerifyOverwrittenBallot(api, hFn, v.OverwrittenBallot.SerializeVars()...); err != nil {
+		if err := circuit.VotesProofs.Ballot[i].VerifyOverwrittenBallot(api, hFn, circuit.Votes[i].OverwrittenBallot.SerializeVars()...); err != nil {
 			circuits.FrontendError(api, "failed to verify ballot vote proof leaf hash: ", err)
 			return
 		}
+		// VoteID
+		if err := circuit.VotesProofs.VoteIDs[i].VerifyNewLeafHash(api, hFn, params.VoteIDLeafValue); err != nil {
+			circuits.FrontendError(api, "failed to verify voteID vote proof leaf hash: ", err)
+			return
+		}
 	}
 	// Results
 	if err := circuit.ResultsProofs.ResultsAdd.VerifyOldLeafHash(api, hFn, circuit.Results.OldResultsAdd.SerializeVars()...); err != nil {
 		circuits.FrontendError(api, "failed to verify add results proof old leaf hash: ", err)
 		return
 	}
-	if err := circuit.ResultsProofs.ResultsSub.VerifyOldLeafHash(api, hFn, circuit.Results.OldResultsSub.SerializeVars()...); err != nil {
-		circuits.FrontendError(api, "failed to verify sub results proof old leaf hash: ", err)
-		return
-	}
 	if err := circuit.ResultsProofs.ResultsAdd.VerifyNewLeafHash(api, hFn, circuit.Results.NewResultsAdd.SerializeVars()...); err != nil {
 		circuits.FrontendError(api, "failed to verify add results proof new leaf hash: ", err)
 		return
 	}
+	if err := circuit.ResultsProofs.ResultsSub.VerifyOldLeafHash(api, hFn, circuit.Results.OldResultsSub.SerializeVars()...); err != nil {
+		circuits.FrontendError(api, "failed to verify sub results proof old leaf hash: ", err)
+		return
+	}
 	if err := circuit.ResultsProofs.ResultsSub.VerifyNewLeafHash(api, hFn, circuit.Results.NewResultsSub.SerializeVars()...); err != nil {
 		circuits.FrontendError(api, "failed to verify sub results proof new leaf hash: ", err)
 		return
@@ -365,9 +400,8 @@ func (circuit StateTransitionCircuit) VerifyBlobs(api frontend.API) {
 	// Build blob and verify evaluation
 	//
 	// The blob is built as follows:
-	// - First, we add the new results (addition and subtraction) - always present
-	// - Then, we add the votes sequentially (no padding)
-	// - Finally, we add a sentinel (voteID = 0x0) to mark end of votes
+	// - First, we add the new results (addition and subtraction) and VotersCount
+	// - Finally, we add exactly VotersCount votes sequentially
 	// Each ballot coordinate is represented as a field element (32 bytes).
 	// Each field element is represented as a big-endian byte array.
 	// The blob is a fixed-size array (FieldElementsPerBlob * BytesPerFieldElement).
@@ -380,30 +414,23 @@ func (circuit StateTransitionCircuit) VerifyBlobs(api frontend.API) {
 			blobIndex++
 		}
 	}
-	// Always include results (no sentinel applies to them)
+	// Always include results.
 	appendBallotMasked(circuit.Results.NewResultsAdd, 1)
 	appendBallotMasked(circuit.Results.NewResultsSub, 1)
-	// Votes section with sentinel handling.
-	// keep==1 means "we haven't seen sentinel yet". Once we see voteID==0,
-	// keep becomes 0 and stays 0, zeroing out everything afterwards.
-	keep := frontend.Variable(1)
+	blob[blobIndex] = circuit.VotersCount
+	blobIndex++
+	isRealVote := circuit.VoteMask(api)
 	for i := range params.VotesPerBatch {
-		voteID := circuit.Votes[i].VoteID
-		isZero := api.IsZero(voteID)  // 1 if voteID==0 else 0
-		notZero := api.Sub(1, isZero) // 1 if voteID!=0 else 0
-		// Only write this vote if keep==1 AND voteID!=0
-		writeMask := api.Mul(keep, notZero)
+		writeMask := isRealVote[i]
 		// VoteID, Address and BallotIndex
-		blob[blobIndex] = api.Mul(writeMask, voteID)
+		blob[blobIndex] = api.Mul(writeMask, circuit.Votes[i].VoteID)
 		blobIndex++
 		blob[blobIndex] = api.Mul(writeMask, circuit.Votes[i].Address)
 		blobIndex++
 		blob[blobIndex] = api.Mul(writeMask, circuit.Votes[i].BallotIndex)
 		blobIndex++
 		// Reencrypted ballot (masked)
 		appendBallotMasked(circuit.Votes[i].ReencryptedBallot, writeMask)
-		// Update keep for next iterations: once we saw 0, keep→0 forever
-		keep = api.Mul(keep, notZero)
 	}
 	// Fill the rest of the blob with zeros
 	for i := blobIndex; i < len(blob); i++ {
@@ -431,9 +458,9 @@ func (circuit StateTransitionCircuit) VerifyBallots(api frontend.API) {
 	sumOfAllBallots, sumOfOverwrittenBallots, zero := circuits.NewBallot(), circuits.NewBallot(), circuits.NewBallot()
 	var votersCount, overwrittenVotesCount frontend.Variable = 0, 0
 
-	for i, b := range circuit.VotesProofs.Ballot {
-		isInsertOrUpdate := b.IsInsertOrUpdate(api)
-		isUpdate := b.IsUpdate(api)
+	for i := range params.VotesPerBatch {
+		isInsertOrUpdate := circuit.VotesProofs.Ballot[i].IsInsertOrUpdate(api)
+		isUpdate := circuit.VotesProofs.Ballot[i].IsUpdate(api)
 
 		ballot := circuits.NewBallot().Select(api, isInsertOrUpdate, &circuit.Votes[i].ReencryptedBallot, zero)
 		sumOfAllBallots.Add(api, sumOfAllBallots, ballot)