world_id_proof/proof/
errors.rs

1//! This module contains error types and validation functions for World ID proof inputs.
2//!
3//! These are intended to assist in producing more helpful error messages for a given proof.
4//! If the circuits change in any way, these checks may also need to be updated to match the new logic.
5use ark_bn254::Fr;
6use ark_ec::{AffineRepr, CurveGroup};
7use ark_ff::{PrimeField, Zero};
8use eddsa_babyjubjub::EdDSAPublicKey;
9use taceo_oprf::core::{dlog_equality::DLogEqualityProof, oprf::BlindingFactor};
10use world_id_primitives::{
11    FieldElement,
12    authenticator::{AuthenticatorPublicKeySet, MAX_AUTHENTICATOR_KEYS},
13    circuit_inputs::{NullifierProofCircuitInput, QueryProofCircuitInput},
14    merkle::MerkleInclusionProof,
15};
16
17type BaseField = ark_babyjubjub::Fq;
18type Affine = ark_babyjubjub::EdwardsAffine;
19
20#[derive(Debug, thiserror::Error)]
21/// Errors that can occur when validating the inputs for a single World ID proof.
22pub enum ProofInputError {
23    /// The specified Merkle tree depth is invalid.
24    #[error("The specified Merkle tree depth is invalid (expected: {expected}, got: {is}).")]
25    InvalidMerkleTreeDepth {
26        /// Expected depth.
27        expected: usize,
28        /// Actual depth.
29        is: BaseField,
30    },
31    /// The set of authenticator public keys is invalid.
32    #[error("The set of authenticator public keys is invalid.")]
33    InvalidAuthenticatorPublicKeySet,
34    /// The provided Merkle tree **inclusion proof** is invalid (the root may or may not be valid for the `WorldIDRegistry` tree)
35    #[error("The provided Merkle tree inclusion proof is invalid.")]
36    InvalidMerkleTreeInclusionProof,
37    /// The signature from the authenticator for the request is invalid.
38    #[error("The signature over the nonce and RP ID is invalid.")]
39    InvalidQuerySignature,
40    /// The provided blinding factor is invalid, or the sub is incorrect.
41    #[error("The provided blinding factor is invalid.")]
42    InvalidBlindingFactor,
43    /// The provided credential has expired.
44    #[error(
45        "The provided credential has expired (expires_at: {expires_at}, check_timestamp: {current_timestamp})."
46    )]
47    CredentialExpired {
48        /// Current timestamp.
49        current_timestamp: u64,
50        /// Expiration timestamp.
51        expires_at: u64,
52    },
53    /// The provided credential genesis issue timestamp is expired.
54    #[error(
55        "The provided credential has a genesis issued at date that is too old (genesis_issued_at: {genesis_issued_at}, check_timestamp: {genesis_issued_at_min})."
56    )]
57    CredentialGenesisExpired {
58        /// Minimum Issue date.
59        genesis_issued_at_min: u64,
60        /// Genesis issue timestamp.
61        genesis_issued_at: u64,
62    },
63    /// A value is out of bounds.
64    #[error("The value '{name}' is out of bounds (got: {is}, limit: {limit}).")]
65    ValueOutOfBounds {
66        /// Name of the value for error message.
67        name: &'static str,
68        /// Actual value.
69        is: BaseField,
70        /// Upper limit, not inclusive.
71        limit: BaseField,
72    },
73    /// The credential signature is invalid. This signals the issued credential is invalid.
74    #[error("The credential signature is invalid for the given issuer public key.")]
75    InvalidCredentialSignature,
76    /// The provided point is not a valid point in the prime-order subgroup of the `BabyJubJub` curve.
77    #[error(
78        "The provided point '{name}' is not a valid point in the prime-order subgroup of the BabyJubJub curve."
79    )]
80    InvalidBabyJubJubPoint {
81        /// Name of the point for error message.
82        name: &'static str,
83    },
84    /// The provided OPRF proof is invalid.
85    #[error("The provided OPRF DlogEquality proof is invalid.")]
86    InvalidOprfProof,
87    /// The provided unblinded OPRF response point is invalid.
88    #[error("The provided unblinded OPRF response point is invalid.")]
89    InvalidOprfResponse,
90    /// The provided session ID commitment is invalid.
91    #[error(
92        "The provided session ID commitment is invalid for the given id and session id randomness."
93    )]
94    InvalidSessionId,
95}
96
97/// This method checks the validity of the input parameters by emulating the operations that are proved in ZK and raising Errors that would result in an invalid proof.
98///
99/// Returns the blinded OPRF query point if everything is ok.
100///
101/// # Errors
102/// This function will return a [`ProofInputError`] if any of the checks fail.
103/// The `Display` implementation of this error can be used to get a human-readable error message on which parts of the input were invalid.
104pub fn check_query_input_validity<const TREE_DEPTH: usize>(
105    inputs: &QueryProofCircuitInput<TREE_DEPTH>,
106) -> Result<Affine, ProofInputError> {
107    // 1. Check that the depth is within bounds.
108    if inputs.depth != BaseField::new((TREE_DEPTH as u64).into()) {
109        return Err(ProofInputError::InvalidMerkleTreeDepth {
110            expected: TREE_DEPTH,
111            is: inputs.depth,
112        });
113    }
114    // 2. Check the merkle proof is valid
115    // Check the Merkle tree idx is valid.
116    let idx_u64 = u64::try_from(FieldElement::from(inputs.mt_index)).map_err(|_| {
117        ProofInputError::ValueOutOfBounds {
118            name: "Merkle tree index",
119            is: inputs.mt_index,
120            limit: BaseField::new((1u64 << TREE_DEPTH).into()),
121        }
122    })?;
123    if idx_u64 >= (1u64 << TREE_DEPTH) {
124        return Err(ProofInputError::ValueOutOfBounds {
125            name: "Merkle tree index",
126            is: inputs.mt_index,
127            limit: BaseField::new((1u64 << TREE_DEPTH).into()),
128        });
129    }
130
131    // Build the leaf from the PKs.
132    let pk_set = AuthenticatorPublicKeySet::new(
133        inputs
134            .pk
135            .iter()
136            .map(|&x| EdDSAPublicKey { pk: x })
137            .collect(),
138    )
139    .map_err(|_| ProofInputError::InvalidAuthenticatorPublicKeySet)?;
140    let pk_set_hash = pk_set.leaf_hash();
141    let merkle_tree_inclusion_proof = MerkleInclusionProof::new(
142        FieldElement::from(inputs.merkle_root),
143        idx_u64,
144        inputs.siblings.map(FieldElement::from),
145    );
146    if !merkle_tree_inclusion_proof.is_valid(FieldElement::from(pk_set_hash)) {
147        return Err(ProofInputError::InvalidMerkleTreeInclusionProof);
148    }
149
150    // 3. Check that the signature is valid.
151    let pk_index_usize = usize::try_from(FieldElement::from(inputs.pk_index)).map_err(|_| {
152        ProofInputError::ValueOutOfBounds {
153            name: "Authenticator PubKey index",
154            is: inputs.pk_index,
155            limit: BaseField::new((MAX_AUTHENTICATOR_KEYS as u64).into()),
156        }
157    })?;
158    let pk = pk_set
159        .get(pk_index_usize)
160        .ok_or_else(|| ProofInputError::ValueOutOfBounds {
161            name: "Authenticator PubKey index",
162            is: inputs.pk_index,
163            limit: BaseField::new((MAX_AUTHENTICATOR_KEYS as u64).into()),
164        })?;
165
166    if !inputs.r.is_on_curve() || !inputs.r.is_in_correct_subgroup_assuming_on_curve() {
167        return Err(ProofInputError::InvalidBabyJubJubPoint {
168            name: "Query Signature R",
169        });
170    }
171    if !pk.pk.is_on_curve() || !pk.pk.is_in_correct_subgroup_assuming_on_curve() {
172        return Err(ProofInputError::InvalidBabyJubJubPoint {
173            name: "Authenticator Public Key",
174        });
175    }
176
177    let _rp_id_u64 = u64::try_from(FieldElement::from(inputs.rp_id)).map_err(|_| {
178        ProofInputError::ValueOutOfBounds {
179            name: "RP Id",
180            is: inputs.pk_index,
181            limit: BaseField::new((MAX_AUTHENTICATOR_KEYS as u64).into()),
182        }
183    })?;
184    let query = world_id_primitives::authenticator::oprf_query_digest(
185        idx_u64,
186        FieldElement::from(inputs.action),
187        FieldElement::from(inputs.rp_id),
188    );
189    let signature = eddsa_babyjubjub::EdDSASignature {
190        r: inputs.r,
191        s: inputs.s,
192    };
193
194    if !pk.verify(*query, &signature) {
195        return Err(ProofInputError::InvalidQuerySignature);
196    }
197
198    let blinding_factor = BlindingFactor::from_scalar(inputs.beta)
199        .map_err(|_| ProofInputError::InvalidBlindingFactor)?;
200    let query_point = taceo_oprf::core::oprf::client::blind_query(*query, blinding_factor);
201
202    Ok(query_point.blinded_query())
203}
204
205/// This method checks the validity of the input parameters by emulating the operations that are proved in ZK and raising Errors that would result in an invalid proof.
206///
207/// Returns the computed nullifier if everything is ok.
208///
209/// # Errors
210/// This function will return a [`ProofInputError`] if any of the checks fail.
211/// The `Display` implementation of this error can be used to get a human-readable error message on which parts of the input were invalid.
212#[expect(
213    clippy::too_many_lines,
214    reason = "necessary checks for input validity should be in one function"
215)]
216pub fn check_nullifier_input_validity<const TREE_DEPTH: usize>(
217    inputs: &NullifierProofCircuitInput<TREE_DEPTH>,
218) -> Result<FieldElement, ProofInputError> {
219    // 1. Check the validity of the query input.
220    let blinded_query = check_query_input_validity(&inputs.query_input)?;
221
222    // 2. Credential validity checks
223    // Check timestamps are within bounds.
224    let current_timestamp_u64 = u64::try_from(FieldElement::from(inputs.current_timestamp))
225        .map_err(|_| ProofInputError::ValueOutOfBounds {
226            name: "current timestamp",
227            is: inputs.current_timestamp,
228            limit: BaseField::new(u64::MAX.into()),
229        })?;
230    let credential_expires_at_u64 = u64::try_from(FieldElement::from(inputs.cred_expires_at))
231        .map_err(|_| ProofInputError::ValueOutOfBounds {
232            name: "credential expiry timestamp",
233            is: inputs.current_timestamp,
234            limit: BaseField::new(u64::MAX.into()),
235        })?;
236    // Check that the credential has not expired.
237    if credential_expires_at_u64 <= current_timestamp_u64 {
238        return Err(ProofInputError::CredentialExpired {
239            current_timestamp: current_timestamp_u64,
240            expires_at: credential_expires_at_u64,
241        });
242    }
243    // Genesis checks
244    let genesis_issued_at_u64 = u64::try_from(FieldElement::from(inputs.cred_genesis_issued_at))
245        .map_err(|_| ProofInputError::ValueOutOfBounds {
246            name: "credential genesis issued at",
247            is: inputs.cred_genesis_issued_at,
248            limit: BaseField::new(u64::MAX.into()),
249        })?;
250    let genesis_issued_at_min_u64 =
251        u64::try_from(FieldElement::from(inputs.cred_genesis_issued_at_min)).map_err(|_| {
252            ProofInputError::ValueOutOfBounds {
253                name: "credential genesis issued at minimum bound",
254                is: inputs.cred_genesis_issued_at_min,
255                limit: BaseField::new(u64::MAX.into()),
256            }
257        })?;
258    if genesis_issued_at_min_u64 > genesis_issued_at_u64 {
259        return Err(ProofInputError::CredentialGenesisExpired {
260            genesis_issued_at_min: genesis_issued_at_min_u64,
261            genesis_issued_at: genesis_issued_at_u64,
262        });
263    }
264
265    let blinded_subject = sub(
266        FieldElement::from(inputs.query_input.mt_index),
267        FieldElement::from(inputs.cred_sub_blinding_factor),
268    );
269
270    let cred_hash = hash_credential(
271        FieldElement::from(inputs.issuer_schema_id),
272        blinded_subject,
273        FieldElement::from(inputs.cred_genesis_issued_at),
274        FieldElement::from(inputs.cred_expires_at),
275        FieldElement::from(inputs.cred_hashes[0]),
276        FieldElement::from(inputs.cred_hashes[1]),
277        FieldElement::from(inputs.cred_id),
278    );
279    let pk = EdDSAPublicKey { pk: inputs.cred_pk };
280
281    let signature = eddsa_babyjubjub::EdDSASignature {
282        r: inputs.cred_r,
283        s: inputs.cred_s,
284    };
285
286    if !inputs.cred_r.is_on_curve() || !inputs.cred_r.is_in_correct_subgroup_assuming_on_curve() {
287        return Err(ProofInputError::InvalidBabyJubJubPoint {
288            name: "Credential Signature R",
289        });
290    }
291    if !pk.pk.is_on_curve() || !pk.pk.is_in_correct_subgroup_assuming_on_curve() {
292        return Err(ProofInputError::InvalidBabyJubJubPoint {
293            name: "Credential Public Key",
294        });
295    }
296
297    if !pk.verify(*cred_hash, &signature) {
298        return Err(ProofInputError::InvalidCredentialSignature);
299    }
300
301    // 3. Dlog Equality proof checks
302    if !inputs.oprf_pk.is_on_curve() || !inputs.oprf_pk.is_in_correct_subgroup_assuming_on_curve() {
303        return Err(ProofInputError::InvalidBabyJubJubPoint {
304            name: "OPRF Public Key",
305        });
306    }
307    if !inputs.oprf_response_blinded.is_on_curve()
308        || !inputs
309            .oprf_response_blinded
310            .is_in_correct_subgroup_assuming_on_curve()
311    {
312        return Err(ProofInputError::InvalidBabyJubJubPoint {
313            name: "OPRF Blinded Response",
314        });
315    }
316
317    // check dlog eq proof is valid
318    let dlog_proof = DLogEqualityProof::new(inputs.dlog_e, inputs.dlog_s);
319    dlog_proof
320        .verify(
321            inputs.oprf_pk,
322            blinded_query,
323            inputs.oprf_response_blinded,
324            Affine::generator(),
325        )
326        .map_err(|_| ProofInputError::InvalidOprfProof)?;
327
328    // check that the unblinded response is correct
329    if !inputs.oprf_response.is_on_curve()
330        || !inputs
331            .oprf_response
332            .is_in_correct_subgroup_assuming_on_curve()
333    {
334        return Err(ProofInputError::InvalidBabyJubJubPoint {
335            name: "OPRF Unblinded Response",
336        });
337    }
338    let expected_blinded_response = (inputs.oprf_response * inputs.query_input.beta).into_affine();
339    if expected_blinded_response != inputs.oprf_response_blinded {
340        return Err(ProofInputError::InvalidOprfResponse);
341    }
342
343    // check that session_id commitment is correct
344    if !inputs.id_commitment.is_zero() {
345        let expected_commitment = session_id_commitment(
346            FieldElement::from(inputs.query_input.mt_index),
347            FieldElement::from(inputs.id_commitment_r),
348        );
349        if expected_commitment != FieldElement::from(inputs.id_commitment) {
350            return Err(ProofInputError::InvalidSessionId);
351        }
352    }
353
354    // 4. Compute the nullifier
355    let nullifier = oprf_finalize_hash(
356        *world_id_primitives::authenticator::oprf_query_digest(
357            #[expect(
358                clippy::missing_panics_doc,
359                reason = "checked in check_query_input_validity"
360            )]
361            u64::try_from(FieldElement::from(inputs.query_input.mt_index)).unwrap(),
362            FieldElement::from(inputs.query_input.action),
363            FieldElement::from(inputs.query_input.rp_id),
364        ),
365        inputs.oprf_response,
366    );
367
368    Ok(nullifier)
369}
370
371// Helper functions to recompute various hashes used in the circuit
372
373// Recompute the blinded subject, copied from credential
374fn sub(leaf_index: FieldElement, blinding_factor: FieldElement) -> FieldElement {
375    let sub_ds = Fr::from_be_bytes_mod_order(b"H_CS(id, r)");
376    let mut input = [sub_ds, *leaf_index, *blinding_factor];
377    poseidon2::bn254::t3::permutation_in_place(&mut input);
378    input[1].into()
379}
380// Recompute the OPRF finalization hash
381fn oprf_finalize_hash(query: BaseField, oprf_response: Affine) -> FieldElement {
382    let finalize_ds = Fr::from_be_bytes_mod_order(super::OPRF_PROOF_DS);
383    let mut input = [finalize_ds, query, oprf_response.x, oprf_response.y];
384    poseidon2::bn254::t4::permutation_in_place(&mut input);
385    input[1].into()
386}
387
388// Recompute the session_id_commitment
389fn session_id_commitment(user_id: FieldElement, commitment_rand: FieldElement) -> FieldElement {
390    let sub_ds = Fr::from_be_bytes_mod_order(b"H(id, r)");
391    let mut input = [sub_ds, *user_id, *commitment_rand];
392    poseidon2::bn254::t3::permutation_in_place(&mut input);
393    input[1].into()
394}
395
396// Recompute the credential hash, copied from credential
397fn hash_credential(
398    issuer_schema_id: FieldElement,
399    sub: FieldElement,
400    genesis_issued_at: FieldElement,
401    expires_at: FieldElement,
402    claims_hash: FieldElement,
403    associated_data_hash: FieldElement,
404    id: FieldElement,
405) -> FieldElement {
406    let cred_ds = Fr::from_be_bytes_mod_order(b"POSEIDON2+EDDSA-BJJ");
407    let mut input = [
408        cred_ds,
409        *issuer_schema_id,
410        *sub,
411        *genesis_issued_at,
412        *expires_at,
413        *claims_hash,
414        *associated_data_hash,
415        *id,
416    ];
417    poseidon2::bn254::t8::permutation_in_place(&mut input);
418    input[1].into()
419}
420
421#[cfg(test)]
422mod tests {
423    use ark_ec::twisted_edwards::Affine;
424    use std::str::FromStr;
425    use world_id_primitives::circuit_inputs::{NullifierProofCircuitInput, QueryProofCircuitInput};
426
427    use crate::proof::errors::{check_nullifier_input_validity, check_query_input_validity};
428
429    // gotten these values by `dbg`-ing the struct in the e2e_authenticator_generate test
430    fn get_valid_query_proof_input() -> QueryProofCircuitInput<30> {
431        QueryProofCircuitInput {
432            pk: [Affine {
433                x: ark_babyjubjub::Fq::from_str(
434                    "19037598474602150174935475944965340829216795940473064039209388058233204431288",
435                ).unwrap(),
436                y: ark_babyjubjub::Fq::from_str(
437                    "3549932221586364715003722955756497910920276078443163728621283280434115857197",
438                ).unwrap(),
439            },
440                Affine::zero(),
441                Affine::zero(),
442                Affine::zero(),
443                Affine::zero(),
444                Affine::zero(),
445                Affine::zero(),
446            ],
447            pk_index: ark_bn254::Fr::from(0u64),
448            s: ark_babyjubjub::Fr::from_str(
449                "2692248185200295468055279425612708965310378163906753799023551825366269352327",
450            ).unwrap(),
451            r: Affine {
452               x: ark_babyjubjub::Fq::from_str(
453                    "14689596469778385278298478829656243946283084496217945909620117398922933730711",
454                ).unwrap(),
455                y: ark_babyjubjub::Fq::from_str(
456                    "4424830738973486800075394160997493242162871494907432163152597205147606706197",
457                ).unwrap(),
458            },
459            merkle_root: ark_bn254::Fr::from_str("4959814736111706042728533661656003495359474679272202023690954858781105690707").unwrap(),
460            depth: ark_babyjubjub::Fq::from(30u64),
461            mt_index: ark_bn254::Fr::from(1u64),
462            siblings: [
463                    ark_bn254::Fr::from_str("0").unwrap(),
464                    ark_bn254::Fr::from_str("15621590199821056450610068202457788725601603091791048810523422053872049975191").unwrap(),
465                    ark_bn254::Fr::from_str("15180302612178352054084191513289999058431498575847349863917170755410077436260").unwrap(),
466                    ark_bn254::Fr::from_str("20846426933296943402289409165716903143674406371782261099735847433924593192150").unwrap(),
467                    ark_bn254::Fr::from_str("19570709311100149041770094415303300085749902031216638721752284824736726831172").unwrap(),
468                    ark_bn254::Fr::from_str("11737142173000203701607979434185548337265641794352013537668027209469132654026").unwrap(),
469                    ark_bn254::Fr::from_str("11865865012735342650993929214218361747705569437250152833912362711743119784159").unwrap(),
470                    ark_bn254::Fr::from_str("1493463551715988755902230605042557878234810673525086316376178495918903796315").unwrap(),
471                    ark_bn254::Fr::from_str("18746103596419850001763894956142528089435746267438407061601783590659355049966").unwrap(),
472                    ark_bn254::Fr::from_str("21234194473503024590374857258930930634542887619436018385581872843343250130100").unwrap(),
473                    ark_bn254::Fr::from_str("14681119568252857310414189897145410009875739166689283501408363922419813627484").unwrap(),
474                    ark_bn254::Fr::from_str("13243470632183094581890559006623686685113540193867211988709619438324105679244").unwrap(),
475                    ark_bn254::Fr::from_str("19463898140191333844443019106944343282402694318119383727674782613189581590092").unwrap(),
476                    ark_bn254::Fr::from_str("10565902370220049529800497209344287504121041033501189980624875736992201671117").unwrap(),
477                    ark_bn254::Fr::from_str("5560307625408070902174028041423028597194394554482880015024167821933869023078").unwrap(),
478                    ark_bn254::Fr::from_str("20576730574720116265513866548855226316241518026808984067485384181494744706390").unwrap(),
479                    ark_bn254::Fr::from_str("11166760821615661136366651998133963805984915741187325490784169611245269155689").unwrap(),
480                    ark_bn254::Fr::from_str("13692603500396323648417392244466291089928913430742736835590182936663435788822").unwrap(),
481                    ark_bn254::Fr::from_str("11129674755567463025028188404867541558752927519269975708924528737249823830641").unwrap(),
482                    ark_bn254::Fr::from_str("6673535049007525806710184801639542254440636510496168661971704157154828514023").unwrap(),
483                    ark_bn254::Fr::from_str("7958154589163466663626421142270206662020519181323839780192984613274682930816").unwrap(),
484                    ark_bn254::Fr::from_str("3739156991379607404516753076057250171966250101655747790592556040569841550790").unwrap(),
485                    ark_bn254::Fr::from_str("1334107297020502384420211493664486465203492095766400031330900935069700302301").unwrap(),
486                    ark_bn254::Fr::from_str("20357028769054354174264046872903423695314313082869184437966002491602414517674").unwrap(),
487                    ark_bn254::Fr::from_str("19392290367394672558538719012722289280213395590510602524366987685302929990731").unwrap(),
488                    ark_bn254::Fr::from_str("7360502715619830055199267117332475946442427205382059394111067387016428818088").unwrap(),
489                    ark_bn254::Fr::from_str("9629177338475347225553791169746168712988898028547587350296027054067573957412").unwrap(),
490                    ark_bn254::Fr::from_str("21877160135037839571797468541807904053886800340144060811298025652177410263004").unwrap(),
491                    ark_bn254::Fr::from_str("7105691694342706282901391345307729036900705570482804586768449537652208350743").unwrap(),
492                    ark_bn254::Fr::from_str("15888057581779748293164452094398990053773731478520540058125130669204703869637").unwrap(),
493            ],
494            beta: ark_babyjubjub::Fr::from_str("1277277022932719396321614946989807194659268059729440522321681213750340643042").unwrap(),
495            rp_id: ark_bn254::Fr::from_str("14631649082411674499").unwrap(),
496            action: ark_bn254::Fr::from_str("8982441576518976929447725179565370305223105654688049122733783421407497941726").unwrap(),
497            nonce: ark_bn254::Fr::from_str("8530676162050357218814694371816107906694725175836943927290214963954696613748").unwrap(),
498        }
499    }
500
501    #[test]
502    fn test_valid_query_proof_input() {
503        let inputs = get_valid_query_proof_input();
504        let _ = check_query_input_validity(&inputs).unwrap();
505    }
506
507    #[test]
508    fn test_invalid_query_proof_input() {
509        let inputs = get_valid_query_proof_input();
510        {
511            let mut inputs = inputs.clone();
512            inputs.depth = ark_babyjubjub::Fq::from(29u64); // invalid depth
513            assert!(matches!(
514                check_query_input_validity(&inputs).unwrap_err(),
515                super::ProofInputError::InvalidMerkleTreeDepth { .. }
516            ));
517        }
518        {
519            let mut inputs = inputs.clone();
520            // 1 << 30
521            inputs.mt_index = ark_bn254::Fr::from(1073741824u64);
522            assert!(matches!(
523                check_query_input_validity(&inputs).unwrap_err(),
524                super::ProofInputError::ValueOutOfBounds {
525                    name: "Merkle tree index",
526                    ..
527                }
528            ));
529        }
530        {
531            let mut inputs = inputs.clone();
532            inputs.merkle_root = ark_bn254::Fr::from(12345u64);
533            assert!(matches!(
534                check_query_input_validity(&inputs).unwrap_err(),
535                super::ProofInputError::InvalidMerkleTreeInclusionProof
536            ));
537        }
538        {
539            let mut inputs = inputs.clone();
540            inputs.pk_index = ark_bn254::Fr::from(7u64); // MAX_AUTHENTICATOR_KEYS is 7, so index 7 is out of bounds (0-6)
541            assert!(matches!(
542                check_query_input_validity(&inputs).unwrap_err(),
543                super::ProofInputError::ValueOutOfBounds {
544                    name: "Authenticator PubKey index",
545                    ..
546                }
547            ));
548        }
549        {
550            let mut inputs = inputs.clone();
551            inputs.r = Affine {
552                x: ark_babyjubjub::Fq::from(1u64),
553                y: ark_babyjubjub::Fq::from(2u64),
554            };
555            assert!(matches!(
556                check_query_input_validity(&inputs).unwrap_err(),
557                super::ProofInputError::InvalidBabyJubJubPoint {
558                    name: "Query Signature R"
559                }
560            ));
561        }
562        {
563            let mut inputs = inputs.clone();
564            inputs.pk[0] = Affine {
565                x: ark_babyjubjub::Fq::from(1u64),
566                y: ark_babyjubjub::Fq::from(2u64),
567            };
568
569            // Recompute the merkle root so the proof is valid
570            let pk_set = world_id_primitives::authenticator::AuthenticatorPublicKeySet::new(
571                inputs
572                    .pk
573                    .iter()
574                    .map(|&x| eddsa_babyjubjub::EdDSAPublicKey { pk: x })
575                    .collect(),
576            )
577            .unwrap();
578            let mut current = pk_set.leaf_hash();
579            let idx =
580                u64::try_from(world_id_primitives::FieldElement::from(inputs.mt_index)).unwrap();
581            for (i, sibling) in inputs.siblings.iter().enumerate() {
582                let sibling_fr = *world_id_primitives::FieldElement::from(*sibling);
583                if (idx >> i) & 1 == 0 {
584                    let mut state = poseidon2::bn254::t2::permutation(&[current, sibling_fr]);
585                    state[0] += current;
586                    current = state[0];
587                } else {
588                    let mut state = poseidon2::bn254::t2::permutation(&[sibling_fr, current]);
589                    state[0] += sibling_fr;
590                    current = state[0];
591                }
592            }
593            inputs.merkle_root = current;
594
595            assert!(matches!(
596                check_query_input_validity(&inputs).unwrap_err(),
597                super::ProofInputError::InvalidBabyJubJubPoint {
598                    name: "Authenticator Public Key"
599                }
600            ));
601        }
602        {
603            let mut inputs = inputs.clone();
604            inputs.action = ark_bn254::Fr::from(12345u64);
605            assert!(matches!(
606                check_query_input_validity(&inputs).unwrap_err(),
607                super::ProofInputError::InvalidQuerySignature
608            ));
609        }
610    }
611
612    fn get_valid_nullifier_proof_input() -> NullifierProofCircuitInput<30> {
613        NullifierProofCircuitInput {
614            query_input: get_valid_query_proof_input(),
615            issuer_schema_id: ark_bn254::Fr::from(1u64),
616            cred_pk: Affine {
617                x: ark_babyjubjub::Fq::from_str(
618                    "15406775215557320288232407896017344573719706795510112309920214099347968981892",
619                )
620                .unwrap(),
621                y: ark_babyjubjub::Fq::from_str(
622                    "486388649729314270871358770861421181497883381447163109744630700259216042819",
623                )
624                .unwrap(),
625            },
626            cred_hashes: [
627                ark_bn254::Fr::from_str(
628                    "14272087287699568472569351444185311392108883722570788958733484799744115401870",
629                )
630                .unwrap(),
631                ark_bn254::Fr::from_str("0").unwrap(),
632            ],
633            cred_genesis_issued_at: ark_bn254::Fr::from(1770125923u64),
634            cred_expires_at: ark_bn254::Fr::from(1770125983u64),
635            cred_s: ark_babyjubjub::Fr::from_str(
636                "1213918488111680600555111454085490191981091366153388773926786471247948539005",
637            )
638            .unwrap(),
639            cred_r: Affine {
640                x: ark_babyjubjub::Fq::from_str(
641                    "15844586803954862856390946258558419582000810449135704981677693963391564067969",
642                )
643                .unwrap(),
644                y: ark_babyjubjub::Fq::from_str(
645                    "592710378120172403096018676235519447487818389124797234601458948988041235710",
646                )
647                .unwrap(),
648            },
649            current_timestamp: ark_bn254::Fr::from(1770125908u64),
650            cred_genesis_issued_at_min: ark_bn254::Fr::from(0u64),
651            cred_sub_blinding_factor: ark_bn254::Fr::from_str(
652                "12170146734368267085913078854954627576787934009906407554611507307540342380837",
653            )
654            .unwrap(),
655            cred_id: ark_bn254::Fr::from(3198767490419873482u64),
656            id_commitment_r: ark_bn254::Fr::from_str(
657                "11722352184830287916674945948108962396487445899741105828127518108056503126019",
658            )
659            .unwrap(),
660            id_commitment: ark_bn254::Fr::from(0u64),
661            dlog_e: ark_bn254::Fr::from_str(
662                "20738873297635092620048980552264360096607713029337408079647701591795211132447",
663            )
664            .unwrap(),
665            dlog_s: ark_babyjubjub::Fr::from_str(
666                "409914485496464180245985942628922659137136006706846380135829705769429965654",
667            )
668            .unwrap(),
669            oprf_pk: Affine {
670                x: ark_babyjubjub::Fq::from_str(
671                    "2124016492737602714904869498047199181102594928943726277329982080254326092458",
672                )
673                .unwrap(),
674                y: ark_babyjubjub::Fq::from_str(
675                    "13296886400185574560491768605341786437896334271868835545571935419923854148448",
676                )
677                .unwrap(),
678            },
679            oprf_response_blinded: Affine {
680                x: ark_babyjubjub::Fq::from_str(
681                    "186021305824089989598292966483056363224488147240980559441958002546059602483",
682                )
683                .unwrap(),
684                y: ark_babyjubjub::Fq::from_str(
685                    "16813058203546508924422863380215026034284821141284206571184467783067057954778",
686                )
687                .unwrap(),
688            },
689            oprf_response: Affine {
690                x: ark_babyjubjub::Fq::from_str(
691                    "10209445202057032226639052993170591937356545068582397532992536070677055126187",
692                )
693                .unwrap(),
694                y: ark_babyjubjub::Fq::from_str(
695                    "21877375411477040679486668720099554257785799784699842830375906922948306109699",
696                )
697                .unwrap(),
698            },
699            signal_hash: ark_bn254::Fr::from_str(
700                "37938388892362834151584770384290207919364301626797345218722464515205243407",
701            )
702            .unwrap(),
703        }
704    }
705
706    #[test]
707    fn test_valid_nullifier_proof_input() {
708        let inputs = get_valid_nullifier_proof_input();
709        let _ = check_nullifier_input_validity(&inputs).unwrap();
710    }
711
712    #[test]
713    fn test_invalid_nullifier_proof_input() {
714        let inputs = get_valid_nullifier_proof_input();
715        {
716            let mut inputs = inputs.clone();
717            inputs.current_timestamp =
718                ark_babyjubjub::Fq::from_str("123465723894591324701234982134000070").unwrap(); // invalid timestamp
719            assert!(matches!(
720                check_nullifier_input_validity(&inputs).unwrap_err(),
721                super::ProofInputError::ValueOutOfBounds {
722                    name: "current timestamp",
723                    ..
724                }
725            ));
726        }
727        {
728            let mut inputs = inputs.clone();
729            inputs.current_timestamp = inputs.cred_expires_at;
730            assert!(matches!(
731                check_nullifier_input_validity(&inputs).unwrap_err(),
732                super::ProofInputError::CredentialExpired { .. }
733            ));
734        }
735        {
736            let mut inputs = inputs.clone();
737            // genesis issued at 1770125923
738            inputs.cred_genesis_issued_at_min = ark_bn254::Fr::from(1770125924u64);
739            assert!(matches!(
740                check_nullifier_input_validity(&inputs).unwrap_err(),
741                super::ProofInputError::CredentialGenesisExpired { .. }
742            ));
743        }
744        {
745            let mut inputs = inputs.clone();
746            inputs.cred_r = Affine {
747                x: ark_babyjubjub::Fq::from(1u64),
748                y: ark_babyjubjub::Fq::from(2u64),
749            };
750            assert!(matches!(
751                check_nullifier_input_validity(&inputs).unwrap_err(),
752                super::ProofInputError::InvalidBabyJubJubPoint {
753                    name: "Credential Signature R"
754                }
755            ));
756        }
757        {
758            let mut inputs = inputs.clone();
759            inputs.cred_pk = Affine {
760                x: ark_babyjubjub::Fq::from(1u64),
761                y: ark_babyjubjub::Fq::from(2u64),
762            };
763            assert!(matches!(
764                check_nullifier_input_validity(&inputs).unwrap_err(),
765                super::ProofInputError::InvalidBabyJubJubPoint {
766                    name: "Credential Public Key"
767                }
768            ));
769        }
770        {
771            let mut inputs = inputs.clone();
772            inputs.cred_s = ark_babyjubjub::Fr::from(12345u64);
773            assert!(matches!(
774                check_nullifier_input_validity(&inputs).unwrap_err(),
775                super::ProofInputError::InvalidCredentialSignature
776            ));
777        }
778        {
779            let mut inputs = inputs.clone();
780            inputs.oprf_pk = Affine {
781                x: ark_babyjubjub::Fq::from(1u64),
782                y: ark_babyjubjub::Fq::from(2u64),
783            };
784            assert!(matches!(
785                check_nullifier_input_validity(&inputs).unwrap_err(),
786                super::ProofInputError::InvalidBabyJubJubPoint {
787                    name: "OPRF Public Key"
788                }
789            ));
790        }
791        {
792            let mut inputs = inputs.clone();
793            inputs.oprf_response_blinded = Affine {
794                x: ark_babyjubjub::Fq::from(1u64),
795                y: ark_babyjubjub::Fq::from(2u64),
796            };
797            assert!(matches!(
798                check_nullifier_input_validity(&inputs).unwrap_err(),
799                super::ProofInputError::InvalidBabyJubJubPoint {
800                    name: "OPRF Blinded Response"
801                }
802            ));
803        }
804        {
805            let mut inputs = inputs.clone();
806            inputs.dlog_s = ark_babyjubjub::Fr::from(12345u64);
807            assert!(matches!(
808                check_nullifier_input_validity(&inputs).unwrap_err(),
809                super::ProofInputError::InvalidOprfProof
810            ));
811        }
812        {
813            let mut inputs = inputs.clone();
814            inputs.oprf_response = Affine {
815                x: ark_babyjubjub::Fq::from(1u64),
816                y: ark_babyjubjub::Fq::from(2u64),
817            };
818            assert!(matches!(
819                check_nullifier_input_validity(&inputs).unwrap_err(),
820                super::ProofInputError::InvalidBabyJubJubPoint {
821                    name: "OPRF Unblinded Response"
822                }
823            ));
824        }
825        {
826            let mut inputs = inputs.clone();
827            // Valid point but incorrect for the blinded response
828            use ark_ec::AffineRepr;
829            inputs.oprf_response = ark_babyjubjub::EdwardsAffine::generator();
830            assert!(matches!(
831                check_nullifier_input_validity(&inputs).unwrap_err(),
832                super::ProofInputError::InvalidOprfResponse
833            ));
834        }
835        {
836            let mut inputs = inputs.clone();
837            inputs.id_commitment = ark_bn254::Fr::from(12345u64);
838            assert!(matches!(
839                check_nullifier_input_validity(&inputs).unwrap_err(),
840                super::ProofInputError::InvalidSessionId
841            ));
842        }
843    }
844}
world_id_proof/proof/errors.rs

world_id_proof/proof/
errors.rs
