molpha-verifier

Framework-independent Rust verifier for Molpha updates, compatible with Solana program and native Rust consumers.

The downstream Solana program (or any other consumer) owns registry account types and I/O. This crate only takes plain data — no Anchor, Pinocchio, or AccountInfo dependency — and verifies the same checks as the EVM Validator reference path.

What it verifies

Given an AttestationPayload (or combined Attestation), a SchnorrSignature, and the signing nodes' secp256k1 pubkeys, verification:

1. Rejects an invalid / zero aggregate scalar s
2. Enforces popcount(signers_bitmap) ≥ signatures_required
3. Re-derives the deterministic selection bitmap and requires signers ⊆ selection
4. Reconstructs the coalition key Σ X_i from ordered signer pubkeys
5. Hashes the EVM-compatible message (MOLPHA_MESSAGE_V1 domain) over source_id, registry version, threshold, signers bitmap, raw value bytes, and canonical timestamp
6. Recovers the commitment address via the Schnorr→ECDSA trick and matches commitment_addr

Optional helpers resolve ordered signers from a plain RegistryView + NodeEntry slice, including previous-version remove-transition remapping.

AttestationPayload

Content fields carried with the attestation:

Attestation

Combines [AttestationPayload] with [SchnorrSignature] for wire-format decode/encode when the borsh feature is enabled.

SchnorrSignature

Aggregate signature material, passed separately from the payload:

Install

[dependencies]
molpha-verifier = "0.3"

# With Borsh support for wire-format decode/encode:
# molpha-verifier = { version = "0.3", features = ["borsh"] }

Usage

Already-resolved signers

use molpha_verifier::{verify_attestation, Attestation, SignerXy};

// `ordered_signers`: one (x, y) per set bit of `attestation.signature.signers_bitmap`,
// in ascending bit-index order (same order as EVM Validator.verify).
verify_attestation(
    &attestation,
    node_count,
    redundancy_buffer,
    &ordered_signers,
)?;

Compressed (33-byte) pubkeys: verify_attestation_compressed.

Registry-resolved path

use molpha_verifier::{
    verify_attestation_resolved, NodeEntry, RegistryView,
};

verify_attestation_resolved(
    &attestation.payload,
    &attestation.signature,
    &registry,
    redundancy_buffer,
    now,
    &entries,
)?;

The caller must owner-check and deserialize accounts; this crate only validates indices / versions and runs crypto.

Dispute path

For instructions that verify an aggregate signature over an arbitrary message hash (slash / dispute semantics):

use molpha_verifier::verify_aggregate_over_hash;

// Ok(true) = valid, Ok(false) = invalid (slashable), Err = malformed input
let valid = verify_aggregate_over_hash(
    &ordered_signers,
    &signature.agg_sig_s,
    &signature.commitment_addr,
    &message_hash,
)?;

Registry-resolved variant: verify_aggregate_over_hash_resolved.

Modules

Features

Development

cargo test
cargo test --all-features
cargo clippy --all-targets --all-features -- -D warnings
cargo fmt --all -- --check

# End-to-end example (Borsh decode + compressed-pubkey verify)
cargo run --example verify_attestation --features borsh,fixtures

License

MIT — see LICENSE.