Skip to content

fix: replace BB_ASSERT with graceful failures in verifier code paths#22311

Draft
AztecBot wants to merge 1 commit intomerge-train/barretenbergfrom
claudebox/6a1ba966035b66be-3
Draft

fix: replace BB_ASSERT with graceful failures in verifier code paths#22311
AztecBot wants to merge 1 commit intomerge-train/barretenbergfrom
claudebox/6a1ba966035b66be-3

Conversation

@AztecBot
Copy link
Copy Markdown
Collaborator

@AztecBot AztecBot commented Apr 3, 2026

Summary

Converts BB_ASSERT calls in verifier code paths to graceful failures instead of panicking. When processing attacker-controlled proof data, malformed proofs should cause verification to return false (or throw a catchable exception), not crash the process via SIGABRT.

This addresses the broader hardening from the ChonkBatchVerifier security analysis — while the try/catch in batch_check already prevents crashes, these changes make the intent explicit at each verification function: invalid proofs → return false.

Changes by area

Bool-returning verification functions → return false:

  • IPA (ipa.hpp): 5 assertions converted — reduce_verify_internal_native (G_zero mismatch), batch_reduce_verify (size/empty checks), reduce_verify_internal_recursive (SRS size, G_zero mismatch)
  • Translator verifier: 4 PCS size-check assertions now return ReductionResult{..., false}

Non-bool functions → explicit throw_or_abort or info():

  • KZG: MSM size assertion → info() warning (optional validation, non-fatal)
  • Shplonk: Constructor assertion → explicit throw_or_abort (can't return from ctor)
  • Shplemini: ZK consistency check → if constexpr + early return; commitment mismatch → info() warning

Deserialization/parsing → explicit throw_or_abort:

  • Proof compression (proof_compression.hpp): All 11 BB_ASSERT calls in decompress_chonk_proof and helpers converted to throw_or_abort with descriptive messages
  • ChonkProof (chonk_proof.cpp): from_field_elements size check converted
  • Transcript (transcript.hpp): 2 bounds-check assertions in receive_from_prover and deserialize_from_buffer converted

Test plan

  • chonk_tests — ProofCompressionRoundtrip + all rejection tests pass
  • ultra_honk_tests — 112 pass
  • commitment_schemes_tests — All IPA tests pass
  • translator_vm_tests — builds successfully

ClaudeBox log: https://claudebox.work/s/6a1ba966035b66be?run=3

@AztecBot AztecBot added ci-draft Run CI on draft PRs. claudebox Owned by claudebox. it can push to this PR. labels Apr 3, 2026
Convert BB_ASSERT/BB_ASSERT_EQ/BB_ASSERT_LTE calls in verifier code
paths to return false or throw_or_abort instead of panicking. Malformed
proofs should cause verification to fail gracefully, not crash the
process via SIGABRT.

Changes by area:
- IPA (ipa.hpp): 5 assertions in reduce_verify_internal_native,
  batch_reduce_verify, and reduce_verify_internal_recursive now return
  false on invalid input instead of asserting
- Translator verifier: 4 size-check assertions now return
  ReductionResult with reduction_succeeded=false
- KZG: MSM size assertion converted to info() warning
- Shplonk: constructor assertion converted to explicit throw_or_abort
- Shplemini: 2 assertions converted to graceful handling
- Proof compression: 11 assertions in decompress_chonk_proof converted
  to explicit throw_or_abort with descriptive messages
- ChonkProof: from_field_elements assertion converted to throw_or_abort
- Transcript: 2 bounds-check assertions in receive_from_prover and
  deserialize_from_buffer converted to explicit throw_or_abort
@AztecBot AztecBot force-pushed the claudebox/6a1ba966035b66be-3 branch from 816473c to d026957 Compare April 4, 2026 17:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ci-draft Run CI on draft PRs. claudebox Owned by claudebox. it can push to this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant