Merge pull request #3011 from 0xMiden/mmagician-release-v0.15

Author: mmagician

CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## v0.16.0 (TBD)
+
+### Changes
+
+- [BREAKING] Renamed `AccountStorageDelta` to `AccountStoragePatch` ([#3002](https://github.com/0xMiden/protocol/pull/3002)).
+- Added `active_note::is_public` and `active_note::is_private` MASM procedures for checking whether the active note is public or private ([#2988](https://github.com/0xMiden/protocol/pull/2988)).
+
+### Fixes
+- Fixed `update_ger` to explicitly reject duplicate GER insertions with `ERR_GER_ALREADY_REGISTERED` instead of silently accepting them ([#2983](https://github.com/0xMiden/protocol/pull/2983)).
+- AggLayer `bridge_out` now rejects B2AGG notes whose `NoteType` is not `Public`, preventing a recipient-identical private note from desyncing the Local Exit Tree from AggLayer's off-chain mirror ([#2988](https://github.com/0xMiden/protocol/pull/2988)).
+
+## v0.15.1 (TBD)
+
+### Changes
+
+- Reject batches and blocks where an unauthenticated note is consumed before it is created to prevent circular note dependencies ([#2993](https://github.com/0xMiden/protocol/pull/2993)).
+
 ## v0.15.0 (2026-05-22)
 
 ### Features

Cargo.lock

@@ -20,7 +20,7 @@ homepage     = "https://miden.xyz"
 license      = "MIT"
 repository   = "https://github.com/0xMiden/protocol"
 rust-version = "1.90"
-version      = "0.15.0"
+version      = "0.15.1"
 
 [profile.release]
 codegen-units = 1

Cargo.toml

@@ -113,19 +113,24 @@ on Miden. The bridge consumes these notes:
 1. Asserts the note sender is the designated GER manager.
 2. Computes `KEY = poseidon2::merge(GER_LOWER, GER_UPPER)`.
 3. Stores `KEY -> [1, 0, 0, 0]` in the `ger_map`, marking the GER as known.
+4. Reverts if the GER was already present in the map (duplicate insertions are rejected).
 
 Subsequent CLAIM notes reference a GER that must be present in this map for the claim
 to be valid.
 
+> **Note on Solidity divergence:** The Solidity `GlobalExitRootManager` contract treats a
+> duplicate GER insertion as an idempotent no-op. Miden intentionally diverges: a duplicate
+> `UPDATE_GER` note causes the consuming transaction to revert. Because `UPDATE_GER` is a
+> network note (consumed by the note nullifier mechanism), a duplicate would become
+> permanently unconsumable rather than silently accepted. Rejecting duplicates makes the
+> failure explicit and prevents the GER manager from accidentally creating unconsumed notes.
+
 TODO: GERs cannot be removed once inserted
 ([#2702](https://github.com/0xMiden/protocol/issues/2702)).
 
 TODO: No hash chain tracks GER insertions for proof generation
 ([#2707](https://github.com/0xMiden/protocol/issues/2707)).
 
-TODO: Duplicate GER insertions are silently accepted
-([#2708](https://github.com/0xMiden/protocol/issues/2708)).
-
 ### 2.4 Faucet Registration
 
 ![Faucet registration flow](diagrams/faucet-registration.png)
@@ -237,12 +242,14 @@ Asserts the note sender matches the bridge admin stored in
 | **Inputs** | `[GER_LOWER(4), GER_UPPER(4), pad(8)]` |
 | **Outputs** | `[pad(16)]` |
 | **Context** | Consuming an `UPDATE_GER` note on the bridge account |
-| **Panics** | Note sender is not the GER manager |
+| **Panics** | Note sender is not the GER manager; GER has already been registered in storage |
 
 Asserts the note sender matches the GER manager stored in
 `agglayer::bridge::ger_manager_account_id`, then computes
 `KEY = poseidon2::merge(GER_LOWER, GER_UPPER)` and stores
 `KEY -> [1, 0, 0, 0]` in the `ger_map` map slot. This marks the GER as "known".
+Duplicate insertions (same GER value) are explicitly rejected: if the key already exists
+in the map the procedure panics with `ERR_GER_ALREADY_REGISTERED`.
 
 #### `bridge_in::claim`
 

crates/miden-agglayer/SPEC.md

@@ -1,4 +1,5 @@
 use miden::core::crypto::hashes::poseidon2
+use miden::core::word
 use miden::protocol::account_id
 use miden::protocol::active_account
 use miden::protocol::active_note
@@ -9,6 +10,7 @@ use agglayer::common::utils
 # =================================================================================================
 
 const ERR_GER_NOT_FOUND = "GER not found in storage"
+const ERR_GER_ALREADY_REGISTERED = "GER is already registered in storage"
 const ERR_FAUCET_NOT_REGISTERED = "faucet is not registered in the bridge's faucet registry"
 const ERR_TOKEN_NOT_REGISTERED = "(origin token address, origin network) pair is not registered in the bridge's token registry"
 const ERR_SENDER_NOT_BRIDGE_ADMIN = "note sender is not the bridge admin"
@@ -60,6 +62,7 @@ const FAUCET_METADATA_SUBKEY_HASH_HI = 3  # METADATA_HASH_HI[4]
 #!
 #! Panics if:
 #! - the note sender is not the global exit root manager.
+#! - the GER has already been registered in storage.
 #!
 #! Invocation: call
 pub proc update_ger
@@ -83,8 +86,9 @@ pub proc update_ger
 
     exec.native_account::set_map_item
     # => [OLD_VALUE, pad(12)]
-    
-    dropw
+
+    # assert OLD_VALUE is EMPTY_WORD, i.e. the GER was not previously registered
+    exec.word::eqz assert.err=ERR_GER_ALREADY_REGISTERED
     # => [pad(16)]
 end
 

crates/miden-agglayer/asm/agglayer/bridge/bridge_config.masm

@@ -22,6 +22,7 @@ use agglayer::common::eth_address::EthereumAddressFormat
 # =================================================================================================
 
 const ERR_B2AGG_DESTINATION_NETWORK_IS_MIDEN = "B2AGG note destination network ID must not be Miden's AggLayer network ID"
+const ERR_B2AGG_NOTE_MUST_BE_PUBLIC = "B2AGG note must be public"
 
 # CONSTANTS
 # =================================================================================================
@@ -106,11 +107,15 @@ const BURN_NOTE_NUM_STORAGE_ITEMS=0
 #! - dest_address(5) are 5 u32 values representing a 20-byte Ethereum address.
 #!
 #! Panics if:
+#! - the B2AGG note calling `bridge_out` is not public.
 #! - destination network ID is Miden's AggLayer network ID.
 #!
 #! Invocation: call
 @locals(15)
 pub proc bridge_out
+    exec.active_note::is_public assert.err=ERR_B2AGG_NOTE_MUST_BE_PUBLIC
+    # => [ASSET_KEY, ASSET_VALUE, dest_network_id, dest_address(5), pad(2)]
+
     # Save ASSET to local memory for later BURN note creation
     locaddr.BRIDGE_OUT_BURN_ASSET_LOC
     exec.asset::store
@@ -560,20 +565,29 @@ end
 
 #! Computes the SERIAL_NUM of the outputted BURN note.
 #!
-#! The serial number is computed as hash(B2AGG_SERIAL_NUM, ASSET_KEY).
+#! The serial number is computed as hash([num_leaves, 0, 0, 0], hash(B2AGG_SERIAL_NUM, ASSET_KEY))).
 #!
 #! Inputs:  [ASSET_KEY]
 #! Outputs: [SERIAL_NUM]
 #!
 #! Where:
 #! - ASSET_KEY is the vault key from which to compute the burn note serial number.
 #! - SERIAL_NUM is the computed serial number for the BURN note.
+#! - num_leaves is the number of leaves in the Local Exit Tree, post-append.
 #!
 #! Invocation: exec
 proc compute_burn_note_serial_num
     exec.active_note::get_serial_number
     # => [B2AGG_SERIAL_NUM, ASSET_KEY]
 
+    exec.poseidon2::merge
+    # => [SERIAL_AND_ASSET_HASH]
+
+    # load num_leaves from its value slot and merge it with the intermediate hash word
+    push.LET_NUM_LEAVES_SLOT[0..2]
+    exec.active_account::get_item
+    # => [num_leaves, 0, 0, 0, SERIAL_AND_ASSET_HASH]
+
     exec.poseidon2::merge
     # => [SERIAL_NUM]
 end

crates/miden-agglayer/asm/agglayer/bridge/bridge_out.masm

@@ -50,6 +50,7 @@ const ERR_B2AGG_TARGET_ACCOUNT_MISMATCH="B2AGG note attachment target account do
 #! - The note does not contain exactly 6 storage items.
 #! - The note does not contain exactly 1 asset.
 #! - The note attachment does not target the consuming account.
+#! - The note is not public (enforced by `bridge_out`).
 #! - The destination network ID equals Miden's AggLayer network ID.
 @note_script
 pub proc main

crates/miden-agglayer/asm/note_scripts/b2agg.masm

@@ -39,6 +39,7 @@ const ERR_UPDATE_GER_TARGET_ACCOUNT_MISMATCH = "UPDATE_GER note attachment targe
 #! - account does not expose update_ger procedure.
 #! - target account ID does not match the consuming account ID.
 #! - number of note storage items is not exactly 8.
+#! - the GER has already been registered in storage.
 @note_script
 pub proc main
     dropw

crates/miden-agglayer/asm/note_scripts/update_ger.masm

@@ -9,6 +9,8 @@ use miden::protocol::kernel_proc_offsets::INPUT_NOTE_GET_SERIAL_NUMBER_OFFSET
 use miden::protocol::kernel_proc_offsets::INPUT_NOTE_GET_SCRIPT_ROOT_OFFSET
 use miden::protocol::note
 use miden::protocol::input_note
+use miden::protocol::util::note::NOTE_TYPE_PUBLIC
+use miden::protocol::util::note::NOTE_TYPE_PRIVATE
 
 # ERRORS
 # =================================================================================================
@@ -174,6 +176,52 @@ pub proc get_metadata
     # => [METADATA]
 end
 
+#! Returns whether the active note is public.
+#!
+#! Inputs:  []
+#! Outputs: [is_public]
+#!
+#! Where:
+#! - is_public is 1 if the active note is public, 0 otherwise.
+#!
+#! Panics if:
+#! - no note is currently active.
+#!
+#! Invocation: exec
+pub proc is_public
+    exec.get_metadata
+    # => [METADATA]
+
+    exec.note::metadata_into_note_type
+    # => [note_type]
+
+    eq.NOTE_TYPE_PUBLIC
+    # => [is_public]
+end
+
+#! Returns whether the active note is private.
+#!
+#! Inputs:  []
+#! Outputs: [is_private]
+#!
+#! Where:
+#! - is_private is 1 if the active note is private, 0 otherwise.
+#!
+#! Panics if:
+#! - no note is currently active.
+#!
+#! Invocation: exec
+pub proc is_private
+    exec.get_metadata
+    # => [METADATA]
+
+    exec.note::metadata_into_note_type
+    # => [note_type]
+
+    eq.NOTE_TYPE_PRIVATE
+    # => [is_private]
+end
+
 #! Returns the sender of the active note.
 #!
 #! Inputs:  []