fix: correct commitment checks

Author: ctrlc03

crates/aggregator/src/threshold_plaintext_aggregator.rs

@@ -11,7 +11,12 @@ use actix::prelude::*;
 use anyhow::{anyhow, bail, ensure, Result};
 use e3_data::Persistable;
 use e3_events::{
-    AggregationProofPending, AggregationProofSigned, BusHandle, CircuitName, CommitteeMemberExpelled, ComputeRequest, ComputeResponse, ComputeResponseKind, CorrelationId, DecryptedSharesAggregationProofRequest, DecryptionshareCreated, Die, E3id, EType, EnclaveEvent, EnclaveEventData, EventContext, PartyProofsToVerify, PlaintextAggregated, Proof, ProofType, Seed, Sequenced, ShareVerificationComplete, ShareVerificationDispatched, SignedProofFailed, SignedProofPayload, TypedEvent, VerificationKind, ZkResponse, prelude::*, trap
+    prelude::*, trap, AggregationProofPending, AggregationProofSigned, BusHandle, CircuitName,
+    CommitteeMemberExpelled, ComputeRequest, ComputeResponse, ComputeResponseKind, CorrelationId,
+    DecryptedSharesAggregationProofRequest, DecryptionshareCreated, Die, E3id, EType, EnclaveEvent,
+    EnclaveEventData, EventContext, PartyProofsToVerify, PlaintextAggregated, Proof, ProofType,
+    Seed, Sequenced, ShareVerificationComplete, ShareVerificationDispatched, SignedProofFailed,
+    SignedProofPayload, TypedEvent, VerificationKind, ZkResponse,
 };
 use e3_fhe_params::BfvPreset;
 use e3_sortition::{E3CommitteeContainsRequest, E3CommitteeContainsResponse, Sortition};
@@ -408,53 +413,6 @@ impl ThresholdPlaintextAggregator {
                 share_mismatch_parties,
             );
 
-            // Emit SignedProofFailed for each mismatched party so the
-            // AccusationManager can initiate the slashing quorum protocol.
-            // NOTE: These proofs have already passed ECDSA validation in
-            // ShareVerificationActor, so recover_address() returns the
-            // authenticated signer. We still verify_address() as defense
-            // in depth before attributing a fault.
-            for party_id in &share_mismatch_parties {
-                if let Some(proofs) = state.c6_proofs.get(party_id) {
-                    if let Some(signed) = proofs.first() {
-                        let Ok(faulting_node) = signed.recover_address() else {
-                            warn!(
-                                "Could not recover address for party {} C6 proof — skipping accusation",
-                                party_id
-                            );
-                            continue;
-                        };
-                        // Defense in depth: only publish accusation if the
-                        // recovered address matches the wrapper signature.
-                        match signed.verify_address(&faulting_node) {
-                            Ok(true) => {}
-                            _ => {
-                                warn!(
-                                    "Wrapper signature verification failed for party {} — \
-                                     excluding share locally but not publishing accusation",
-                                    party_id
-                                );
-                                continue;
-                            }
-                        }
-                        if let Err(err) = self.bus.publish(
-                            SignedProofFailed {
-                                e3_id: self.e3_id.clone(),
-                                faulting_node,
-                                proof_type: ProofType::C6ThresholdShareDecryption,
-                                signed_payload: signed.clone(),
-                            },
-                            ec.clone(),
-                        ) {
-                            error!(
-                                "Failed to publish SignedProofFailed for party {}: {err}",
-                                party_id
-                            );
-                        }
-                    }
-                }
-            }
-
             dishonest_parties.extend(&share_mismatch_parties);
             honest_shares.retain(|(id, _)| !share_mismatch_parties.contains(id));
             ensure!(
@@ -527,6 +485,7 @@ impl ThresholdPlaintextAggregator {
         Ok(())
     }
 
+    /// Verify that each honest party's decryption share bytes deserialize to
     /// Verify that each honest party's raw decryption share bytes match the
     /// `d_commitment` output in their verified C6 proof. Returns party IDs
     /// that failed the check.
@@ -537,7 +496,6 @@ impl ThresholdPlaintextAggregator {
     ) -> BTreeSet<u64> {
         let mut mismatched = BTreeSet::new();
 
-        // Build BFV params and compute d_bit
         let Ok((threshold_params, _)) = e3_fhe_params::build_pair_for_preset(self.params_preset)
         else {
             warn!("Could not build BFV params for d_commitment check — skipping");
@@ -560,9 +518,9 @@ impl ThresholdPlaintextAggregator {
         let max_k =
             e3_zk_helpers::circuits::threshold::decrypted_shares_aggregation::MAX_MSG_NON_ZERO_COEFFS;
         let c6_output_layout = CircuitName::ThresholdShareDecryption.output_layout();
+        let moduli: Vec<u64> = threshold_params.moduli().to_vec();
 
         for (party_id, shares) in honest_shares {
-            // Extract d_commitment from C6 proof
             let Some(proofs) = c6_proofs.get(party_id) else {
                 continue;
             };
@@ -573,18 +531,16 @@ impl ThresholdPlaintextAggregator {
                 .extract_field(&first_proof.payload.proof.public_signals, "d_commitment")
             else {
                 warn!(
-                    "Could not extract d_commitment from C6 proof for party {} — skipping check",
+                    "Could not extract d_commitment from C6 proof for party {} — skipping",
                     party_id
                 );
                 continue;
             };
 
-            // Compute d_commitment from raw share bytes (first ciphertext index)
             let Some(share_bytes) = shares.first() else {
                 continue;
             };
-            let Ok(mut poly) =
-                e3_trbfv::helpers::try_poly_from_bytes(share_bytes, &threshold_params)
+            let Ok(poly) = e3_trbfv::helpers::try_poly_from_bytes(share_bytes, &threshold_params)
             else {
                 warn!(
                     "Could not deserialize share for party {} — marking as mismatched",
@@ -593,18 +549,14 @@ impl ThresholdPlaintextAggregator {
                 mismatched.insert(*party_id);
                 continue;
             };
-            poly.change_representation(fhe_math::rq::Representation::PowerBasis);
             let mut crt = e3_polynomial::CrtPolynomial::from_fhe_polynomial(&poly);
 
-            // Apply the same transformations C6's Inputs::compute applies before
-            // hashing: reverse coefficient order + center each limb mod qi.
-            // Without this, the commitment is over a different polynomial
-            // representation and always mismatches the C6 proof output.
-            let moduli: Vec<u64> = threshold_params.moduli().to_vec();
+            // Apply the same transformations C6's Inputs::compute applies:
+            // reverse coefficient order + center each limb mod qi.
             crt.reverse();
             if let Err(e) = crt.center(&moduli) {
                 warn!(
-                    "Could not center d_share for party {} — skipping check: {e}",
+                    "Could not center d_share for party {} — skipping: {e}",
                     party_id
                 );
                 continue;
@@ -615,11 +567,12 @@ impl ThresholdPlaintextAggregator {
                     &crt, d_bit, max_k,
                 );
 
-            // Convert BigInt to LE bytes for comparison
-            let computed_bytes = computed.to_bytes_le().1;
+            // Convert to big-endian 32-byte padded format matching
+            // Barretenberg's public_signals encoding.
+            let (_, be_bytes) = computed.to_bytes_be();
             let mut computed_padded = [0u8; 32];
-            let len = computed_bytes.len().min(32);
-            computed_padded[..len].copy_from_slice(&computed_bytes[..len]);
+            let start = 32usize.saturating_sub(be_bytes.len());
+            computed_padded[start..].copy_from_slice(&be_bytes[..be_bytes.len().min(32)]);
 
             if computed_padded != c6_d_bytes {
                 warn!(

crates/polynomial/src/crt_polynomial.rs

@@ -75,18 +75,19 @@ impl CrtPolynomial {
         Self::from_bigint_vectors(limbs)
     }
 
-    /// Builds a `CrtPolynomial` from an fhe-math `Poly` in PowerBasis representation.
+    /// Builds a `CrtPolynomial` from an fhe-math `Poly` in any representation.
     ///
     /// Used to prepare inputs for ZK circuits by converting FHE BFV ciphertext polynomials
-    /// into CRT limb format. If `p` is in NTT form, it is converted to PowerBasis first.
+    /// into CRT limb format. If `p` is not in PowerBasis form (e.g. NTT or NttShoup),
+    /// it is converted first.
     ///
     /// # Arguments
     ///
-    /// * `p` - An fhe-math polynomial (PowerBasis or Ntt).
+    /// * `p` - An fhe-math polynomial (any representation).
     pub fn from_fhe_polynomial(p: &Poly) -> Self {
         let mut p = p.clone();
 
-        if *p.representation() == Representation::Ntt {
+        if *p.representation() != Representation::PowerBasis {
             p.change_representation(Representation::PowerBasis);
         }
 

crates/zk-helpers/src/circuits/threshold/share_decryption/computation.rs

@@ -363,6 +363,86 @@ mod tests {
         assert_eq!(bits.d_bit, expected_bit);
     }
 
+    /// Verifies that `CrtPolynomial::reverse()` + `center()` matches
+    /// `Inputs::compute` for d_commitment, and that the Poly bytes round-trip
+    /// is lossless.
+    #[test]
+    fn test_d_commitment_matches_inputs_compute() {
+        use crate::circuits::commitments::compute_threshold_decryption_share_commitment;
+        use crate::circuits::threshold::decrypted_shares_aggregation::MAX_MSG_NON_ZERO_COEFFS;
+        use crate::threshold::share_decryption::ShareDecryptionCircuitData;
+        use crate::CiphernodesCommitteeSize;
+        use fhe_math::rq::{Poly, Representation};
+        use fhe_traits::{DeserializeWithContext, Serialize as FheSer};
+        use num_traits::ToPrimitive;
+
+        let preset = DEFAULT_BFV_PRESET;
+        let committee = CiphernodesCommitteeSize::Small.values();
+        let sample = ShareDecryptionCircuitData::generate_sample(preset, committee).unwrap();
+        let (threshold_params, _) = build_pair_for_preset(preset).unwrap();
+        let bounds = Bounds::compute(preset, &()).unwrap();
+        let bits = Bits::compute(preset, &bounds).unwrap();
+        let moduli: Vec<u64> = threshold_params.moduli().to_vec();
+
+        // Ground truth: Inputs::compute (what the Noir prover receives)
+        let inputs = Inputs::compute(preset, &sample).unwrap();
+        let truth = compute_threshold_decryption_share_commitment(
+            &inputs.d,
+            bits.d_bit,
+            MAX_MSG_NON_ZERO_COEFFS,
+        );
+
+        // Aggregator path: CrtPolynomial::reverse() + center()
+        let mut crt = sample.d_share.clone();
+        crt.reverse();
+        crt.center(&moduli).unwrap();
+        let from_api = compute_threshold_decryption_share_commitment(
+            &crt,
+            bits.d_bit,
+            MAX_MSG_NON_ZERO_COEFFS,
+        );
+        assert_eq!(
+            truth, from_api,
+            "CrtPolynomial API must match Inputs::compute"
+        );
+
+        // Bytes round-trip: Poly → to_bytes → from_bytes → from_fhe_polynomial
+        let raw: Vec<Vec<u64>> = sample
+            .d_share
+            .limbs
+            .iter()
+            .map(|l| {
+                l.coefficients()
+                    .iter()
+                    .map(|c| c.to_u64().unwrap())
+                    .collect()
+            })
+            .collect();
+        let n = raw[0].len();
+        let mut arr = ndarray::Array2::<u64>::zeros((raw.len(), n));
+        for (i, limb) in raw.iter().enumerate() {
+            for (j, &v) in limb.iter().enumerate() {
+                arr[[i, j]] = v;
+            }
+        }
+        let ctx = threshold_params.ctx_at_level(0).unwrap();
+        let mut poly = Poly::zero(&ctx, Representation::PowerBasis);
+        poly.set_coefficients(arr);
+        let poly_rt = Poly::from_bytes(&poly.to_bytes(), &ctx).unwrap();
+        let mut crt_rt = CrtPolynomial::from_fhe_polynomial(&poly_rt);
+        crt_rt.reverse();
+        crt_rt.center(&moduli).unwrap();
+        let from_bytes = compute_threshold_decryption_share_commitment(
+            &crt_rt,
+            bits.d_bit,
+            MAX_MSG_NON_ZERO_COEFFS,
+        );
+        assert_eq!(
+            truth, from_bytes,
+            "Bytes round-trip must match Inputs::compute"
+        );
+    }
+
     #[test]
     fn test_constants_json_roundtrip() {
         let constants = Configs::compute(DEFAULT_BFV_PRESET, &()).unwrap();

templates/default/tests/integration.spec.ts

@@ -189,7 +189,7 @@ describe('Integration', () => {
     const { waitForEvent } = await setupEventListeners(sdk, store)
 
     const committeeSize = CommitteeSize.Micro
-    const duration = 500
+    const duration = 300
     const inputWindow = await calculateInputWindow(publicClient, duration)
     const thresholdBfvParams = await sdk.getThresholdBfvParamsSet()
     const e3ProgramParams = encodeBfvParams(thresholdBfvParams)