ConfidentialMPTConvertBack.cpp

#include <xrpl/tx/transactors/token/ConfidentialMPTConvertBack.h>
 
#include <xrpl/basics/Log.h>
#include <xrpl/beast/utility/Journal.h>
#include <xrpl/beast/utility/instrumentation.h>
#include <xrpl/core/ServiceRegistry.h>
#include <xrpl/ledger/ReadView.h>
#include <xrpl/ledger/helpers/TokenHelpers.h>
#include <xrpl/protocol/ConfidentialTransfer.h>
#include <xrpl/protocol/Feature.h>
#include <xrpl/protocol/Indexes.h>
#include <xrpl/protocol/LedgerFormats.h>
#include <xrpl/protocol/Protocol.h>
#include <xrpl/protocol/SField.h>
#include <xrpl/protocol/STTx.h>
#include <xrpl/protocol/TER.h>
#include <xrpl/protocol/XRPAmount.h>
#include <xrpl/tx/Transactor.h>
 
#include <memory>
#include <optional>
#include <utility>
 
namespace xrpl {
 
NotTEC
ConfidentialMPTConvertBack::preflight(PreflightContext const& ctx)
{
    // issuer cannot convert back
    if (MPTIssue(ctx.tx[sfMPTokenIssuanceID]).getIssuer() == ctx.tx[sfAccount])
        return temMALFORMED;
 
    if (ctx.tx[sfMPTAmount] == 0 || ctx.tx[sfMPTAmount] > kMaxMpTokenAmount)
        return temBAD_AMOUNT;
 
    if (!isValidCompressedECPoint(ctx.tx[sfBalanceCommitment]))
        return temMALFORMED;
 
    // check encrypted amount format after the above basic checks
    // this check is more expensive so put it at the end
    if (auto const res = checkEncryptedAmountFormat(ctx.tx); !isTesSuccess(res))
        return res;
 
    // ConvertBack proof = compact sigma proof (128 bytes) + single bulletproof (688 bytes)
    if (ctx.tx[sfZKProof].size() != kEcConvertBackProofLength)
        return temMALFORMED;
 
    return tesSUCCESS;
}
 
XRPAmount
ConfidentialMPTConvertBack::calculateBaseFee(ReadView const& view, STTx const& tx)
{
    return Transactor::calculateBaseFee(view, tx, kConfidentialFeeMultiplier);
}

static TER
verifyProofs(
    STTx const& tx,
    std::shared_ptr<SLE const> const& issuance,
    std::shared_ptr<SLE const> const& mptoken)
{
    if (!mptoken->isFieldPresent(sfHolderEncryptionKey))
    {
        // LCOV_EXCL_START
        UNREACHABLE(
            "xrpl::verifyProofs : preclaim already validated the holder encryption key is "
            "present");
        return tecINTERNAL;
        // LCOV_EXCL_STOP
    }
 
    auto const mptIssuanceID = tx[sfMPTokenIssuanceID];
    auto const account = tx[sfAccount];
    auto const amount = tx[sfMPTAmount];
    auto const blindingFactor = tx[sfBlindingFactor];
    auto const holderPubKey = (*mptoken)[sfHolderEncryptionKey];
 
    auto const contextHash = getConvertBackContextHash(
        account,
        mptIssuanceID,
        tx.getSeqProxy().value(),
        (*mptoken)[~sfConfidentialBalanceVersion].value_or(0));
 
    // Prepare Auditor Info
    std::optional<ConfidentialRecipient> auditor;
    bool const hasAuditor = issuance->isFieldPresent(sfAuditorEncryptionKey);
    if (hasAuditor)
    {
        auditor.emplace(
            ConfidentialRecipient{
                .publicKey = (*issuance)[sfAuditorEncryptionKey],
                .encryptedAmount = tx[sfAuditorEncryptedAmount],
            });
    }
 
    // Run all verifications before returning any error to prevent timing attacks
    // that could reveal which proof failed.
    bool valid = true;
 
    if (auto const ter = verifyRevealedAmount(
            amount,
            Slice(blindingFactor.data(), blindingFactor.size()),
            {
                .publicKey = holderPubKey,
                .encryptedAmount = tx[sfHolderEncryptedAmount],
            },
            {
                .publicKey = (*issuance)[sfIssuerEncryptionKey],
                .encryptedAmount = tx[sfIssuerEncryptedAmount],
            },
            auditor);
        !isTesSuccess(ter))
    {
        valid = false;
    }
 
    if (auto const ter = verifyConvertBackProof(
            tx[sfZKProof],
            holderPubKey,
            (*mptoken)[sfConfidentialBalanceSpending],
            tx[sfBalanceCommitment],
            amount,
            contextHash);
        !isTesSuccess(ter))
    {
        valid = false;
    }
 
    if (!valid)
        return tecBAD_PROOF;
 
    return tesSUCCESS;
}
 
TER
ConfidentialMPTConvertBack::preclaim(PreclaimContext const& ctx)
{
    auto const mptIssuanceID = ctx.tx[sfMPTokenIssuanceID];
    auto const account = ctx.tx[sfAccount];
    auto const amount = ctx.tx[sfMPTAmount];
 
    // ensure that issuance exists
    auto const sleIssuance = ctx.view.read(keylet::mptokenIssuance(mptIssuanceID));
    if (!sleIssuance)
        return tecOBJECT_NOT_FOUND;
 
    if (!sleIssuance->isFlag(lsfMPTCanHoldConfidentialBalance) ||
        !sleIssuance->isFieldPresent(sfIssuerEncryptionKey))
        return tecNO_PERMISSION;
 
    bool const hasAuditor = ctx.tx.isFieldPresent(sfAuditorEncryptedAmount);
    bool const requiresAuditor = sleIssuance->isFieldPresent(sfAuditorEncryptionKey);
 
    // tx must include auditor ciphertext if the issuance has enabled
    // auditing
    if (requiresAuditor && !hasAuditor)
        return tecNO_PERMISSION;
 
    // if auditing is not supported then user should not upload auditor
    // ciphertext
    if (!requiresAuditor && hasAuditor)
        return tecNO_PERMISSION;
 
    // already checked in preflight, but should also check that issuer on
    // the issuance isn't the account either
    if (sleIssuance->getAccountID(sfIssuer) == account)
    {
        // LCOV_EXCL_START
        UNREACHABLE(
            "xrpl::ConfidentialMPTConvertBack::preclaim : issuer derived from the MPT ID must "
            "match the ledger's stored issuer");
        return tefINTERNAL;
        // LCOV_EXCL_STOP
    }
 
    auto const sleMptoken = ctx.view.read(keylet::mptoken(mptIssuanceID, account));
    if (!sleMptoken)
        return tecOBJECT_NOT_FOUND;
 
    if (!sleMptoken->isFieldPresent(sfHolderEncryptionKey) ||
        !sleMptoken->isFieldPresent(sfConfidentialBalanceSpending) ||
        !sleMptoken->isFieldPresent(sfIssuerEncryptedBalance))
    {
        return tecNO_PERMISSION;
    }
 
    // Converting back homomorphically subtracts from the holder's mirrors, so
    // those mirrors must be current.
    if (ctx.view.rules().enabled(featureConfidentialMPTKeyRotation) &&
        !areMirrorsCurrent(*sleIssuance, *sleMptoken))
    {
        return tecNO_PERMISSION;
    }
 
    // Sanity check: holder's MPToken must have auditor balance field if auditing
    // is enabled
    if (requiresAuditor && !sleMptoken->isFieldPresent(sfAuditorEncryptedBalance))
    {
        // LCOV_EXCL_START
        UNREACHABLE(
            "xrpl::ConfidentialMPTConvertBack::preclaim : issuance-level auditing implies the "
            "MPToken already carries an auditor balance");
        return tefINTERNAL;
        // LCOV_EXCL_STOP
    }
 
    // if the total circulating confidential balance is smaller than what the
    // holder is trying to convert back, we know for sure this txn should
    // fail
    if ((*sleIssuance)[~sfConfidentialOutstandingAmount].value_or(0) < amount)
        return tecINSUFFICIENT_FUNDS;
 
    // Check lock
    MPTIssue const mptIssue(mptIssuanceID);
    if (auto const ter = checkFrozen(ctx.view, account, mptIssue); !isTesSuccess(ter))
        return ter;
 
    // Check auth
    if (auto const ter = requireAuth(ctx.view, mptIssue, account); !isTesSuccess(ter))
        return ter;
 
    if (auto const res = verifyProofs(ctx.tx, sleIssuance, sleMptoken); !isTesSuccess(res))
        return res;
 
    return tesSUCCESS;
}
 
TER
ConfidentialMPTConvertBack::doApply()
{
    auto const mptIssuanceID = ctx_.tx[sfMPTokenIssuanceID];
 
    auto sleMptoken = view().peek(keylet::mptoken(mptIssuanceID, accountID_));
    if (!sleMptoken)
    {
        // LCOV_EXCL_START
        UNREACHABLE(
            "xrpl::ConfidentialMPTConvertBack::doApply : preclaim already validated the "
            "MPToken exists");
        return tecINTERNAL;
        // LCOV_EXCL_STOP
    }
 
    auto sleIssuance = view().peek(keylet::mptokenIssuance(mptIssuanceID));
    if (!sleIssuance)
    {
        // LCOV_EXCL_START
        UNREACHABLE(
            "xrpl::ConfidentialMPTConvertBack::doApply : preclaim already validated the "
            "issuance exists");
        return tecINTERNAL;
        // LCOV_EXCL_STOP
    }
 
    auto const amtToConvertBack = ctx_.tx[sfMPTAmount];
    auto const amt = (*sleMptoken)[~sfMPTAmount].valueOr(0);
 
    // Converting back increases regular balance and decreases confidential
    // outstanding. This is the inverse of Convert.
    if (amt > kMaxMpTokenAmount - amtToConvertBack)
        return tecINTERNAL;  // LCOV_EXCL_LINE
    (*sleMptoken)[sfMPTAmount] = amt + amtToConvertBack;
 
    auto const coa = (*sleIssuance)[~sfConfidentialOutstandingAmount].valueOr(0);
    if (coa < amtToConvertBack)
        return tecINTERNAL;  // LCOV_EXCL_LINE
    (*sleIssuance)[sfConfidentialOutstandingAmount] = coa - amtToConvertBack;
 
    std::optional<Slice> const auditorEc = ctx_.tx[~sfAuditorEncryptedAmount];
 
    // homomorphically subtract holder's encrypted balance
    {
        auto res = homomorphicSubtract(
            (*sleMptoken)[sfConfidentialBalanceSpending], ctx_.tx[sfHolderEncryptedAmount]);
        if (!res)
        {
            // LCOV_EXCL_START
            JLOG(ctx_.journal.error())
                << "ConfidentialMPTConvertBack failed homomorphic subtract for holder spending "
                   "balance.";
            return tecINTERNAL;
            // LCOV_EXCL_STOP
        }
 
        (*sleMptoken)[sfConfidentialBalanceSpending] = std::move(*res);
    }
 
    // homomorphically subtract issuer's encrypted balance
    {
        auto res = homomorphicSubtract(
            (*sleMptoken)[sfIssuerEncryptedBalance], ctx_.tx[sfIssuerEncryptedAmount]);
        if (!res)
        {
            // LCOV_EXCL_START
            JLOG(ctx_.journal.error())
                << "ConfidentialMPTConvertBack failed homomorphic subtract for issuer balance.";
            return tecINTERNAL;
            // LCOV_EXCL_STOP
        }
 
        (*sleMptoken)[sfIssuerEncryptedBalance] = std::move(*res);
    }
 
    if (auditorEc)
    {
        auto res = homomorphicSubtract(
            (*sleMptoken)[sfAuditorEncryptedBalance], ctx_.tx[sfAuditorEncryptedAmount]);
        if (!res)
        {
            // LCOV_EXCL_START
            JLOG(ctx_.journal.error())
                << "ConfidentialMPTConvertBack failed homomorphic subtract for auditor balance.";
            return tecINTERNAL;
            // LCOV_EXCL_STOP
        }
 
        (*sleMptoken)[sfAuditorEncryptedBalance] = std::move(*res);
    }
 
    incrementConfidentialVersion(*sleMptoken);
 
    view().update(sleIssuance);
    view().update(sleMptoken);
    return tesSUCCESS;
}
 
void
ConfidentialMPTConvertBack::visitInvariantEntry(
    bool,
    std::shared_ptr<SLE const> const&,
    std::shared_ptr<SLE const> const&)
{
}
 
bool
ConfidentialMPTConvertBack::finalizeInvariants(
    STTx const&,
    TER,
    XRPAmount,
    ReadView const&,
    beast::Journal const&)
{
    return true;
}
 
}  // namespace xrpl