Wormhole Aggregation Level 2

[illuzen]

Summary

Teaches pallet-wormhole to verify second-layer ("public batch") aggregation proofs.
A public batch bundles M private-batch proofs into one transaction and names an
aggregator_address; as an incentive to aggregate, part of the fee that would
normally be burned is redirected to that address. Verification is segment-aware:
individual private-batch segments can be denied (replayed nullifiers) or skipped
(dummy padding) without rejecting the whole proof.

Changes

New extrinsic

• verify_public_batch(proof) (unsigned, call index 3), alongside the renamed
  verify_private_batch (formerly verify_aggregated_proof).

Segment-based exit bundles

• Validation and execution are refactored around ExitBundle / ExitSegment:
  both extrinsics parse their proof's public inputs into a normalized bundle where
  each segment corresponds to one private batch and is accepted or denied atomically.
• Segment-level denial: a segment whose nullifiers are already used (or collide
  with another segment in the same bundle) is denied; the rest of the bundle still
  executes. This also closes the double-mint that would otherwise arise from
  including the same private-batch proof in a public batch twice, since the circuit
  forwards nullifiers without deduplication.
• Inert (dummy) segments: dummy-padded segments (all-zero nullifiers) are
  skipped entirely — no mints, no fee accounting, no nullifier storage. Zero
  nullifiers are never written to UsedNullifiers.

Aggregator incentive

• New config item VolumeFeesAggregatorRate (runtime: 50%). For public batches,
  that share of the burn portion of the 0.1% volume fee is paid to the proof's
  aggregator_address instead of being burned. The miner share is unchanged, so
  aggregation is strictly fee-positive for the aggregator and strictly
  burn-reducing for users.

Transaction pool

• validate_unsigned handles both call variants; priority is computed from the
  total value of valid, non-inert segments only, so a mostly-replayed bundle
  can't jump the queue.

Build / infra

• build.rs generates and embeds the public-batch verifier binaries and exposes
  circuit sizing constants (NUM_LEAF_PROOFS, NUM_PRIVATE_BATCH_PROOFS,
  overridable via QP_NUM_PRIVATE_BATCH_PROOFS) for public-input parsing.
• [patch.crates-io] temporarily points the qp-wormhole-* /
  qp-zk-circuits-common crates at the local ../qp-zk-circuits checkout.
  Must be switched to published crate versions before merge.
• Placeholder weight for verify_public_batch (25s ref-time upper bound);
  real benchmarking to follow.

Test plan

• cargo test -p pallet-wormhole --release: new public_batch_proof_tests cover
  PI parsing, wrong origin, malformed bytes, replay prevention, and a success path
  asserting the aggregator rebate is paid and dummy segments are skipped.
• Fixtures regenerated (test-data/private_batch.hex, test-data/public_batch.hex)
  via the regenerate_*_fixture ignored tests.
• End-to-end against --dev node via quantus-cli wormhole multiround --public.

---

Note

High Risk
Changes ZK proof verification, minting, fee burn/miner/aggregator splits, and nullifier handling on a security-critical pallet; segment denial and temporary local circuit patches add integration and supply-accounting risk until published crates and real benchmarks land.

Overview
Adds second-layer wormhole aggregation on-chain: verify_public_batch (call index 3) alongside verify_private_batch, which replaces verify_aggregated_proof. Naming and ZK crates move from layer-0/layer-1 to private batch / public batch, with [patch.crates-io] temporarily pointing qp-wormhole-* at a local circuits checkout until 3.1.0 ships.

build.rs now generates and embeds public-batch verifier binaries, passes QP_NUM_PRIVATE_BATCH_PROOFS (default 4), and emits NUM_LEAF_PROOFS / NUM_PRIVATE_BATCH_PROOFS for PI parsing at runtime.

Validation and execution are refactored around ExitBundle / ExitSegment: both extrinsics normalize proofs into per–private-batch segments. Segment-level denial skips whole segments when nullifiers are already used or collide within the bundle (partial success for public batches); inert dummy segments are ignored. SegmentsDenied is emitted when some segments are dropped. Pool validate_unsigned priority counts only valid, non-inert segment value.

VolumeFeesAggregatorRate redirects part of the volume-fee burn bucket to the proof’s aggregator_address on public batches (miner share unchanged). Errors and weights are generalized (VerifierNotAvailable, verify_public_batch placeholder ~25s ref-time). Tests and fixtures move to private_batch.hex / public_batch.hex with new public-batch coverage.

^{Reviewed by Cursor Bugbot for commit b7b043f. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b7b043f. Configure here.}

[cursor]

Public batch weight undercounts storage

Medium Severity

verify_public_batch reuses the private-batch hand-augmented storage tail (200 reads / 170 writes) sized for one inner batch, but default build.rs sizing allows up to four private-batch segments with seven leaves each. A full public-batch success can mint and record_transfer for many more exit slots than that model accounts for, so declared weight can be materially lower than actual work.

 

^{Triggered by learned rule: Wormhole verify_aggregated_proof weight requires manual DB augmentation}

^{Reviewed by Cursor Bugbot for commit b7b043f. Configure here.}