Add support for ZK attestation service #294

Sneh1999 · 2025-12-08T18:59:33Z

This PR:

Adds support for ZK attestation verifier service which replaces attestation verification on-chain with ZK proof verification on-chain
Adds a mock Nitro verifier contract which mocks the on-chain verification
Adds attestation-verifier-zk to docker compose which supports creating mock proofs

Key places to review:

espresso.go

To see the specific tasks where the Asana app for GitHub is being used, see below:
- https://app.asana.com/0/0/1211868671079203

…tems/optimism-espresso-integration into enable-zk-verifier

Copilot

Pull request overview

This PR introduces support for ZK attestation verification by replacing on-chain attestation verification with on-chain ZK proof verification. The changes integrate a new attestation verifier service that generates ZK proofs from Nitro attestations, and updates the deployment and testing infrastructure to support this new workflow.

Key changes:

Integration of ZK proof generation service for attestation verification
Removal of deprecated direct attestation verification methods from contracts
Addition of mock verifier contract for development/testing environments

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
packages/contracts-bedrock/test/L1/BatchInbox.t.sol	Updated Solidity version to use caret range
packages/contracts-bedrock/test/L1/BatchAuthenticator.t.sol	Updated Solidity version and removed deprecated mock verifier methods
packages/contracts-bedrock/src/L1/BatchInbox.sol	Updated Solidity version to ^0.8.24
packages/contracts-bedrock/src/L1/BatchAuthenticator.sol	Removed deprecated attestation verification methods and nitroValidator interface
packages/contracts-bedrock/scripts/deploy/DeployAWSNitroVerifier.s.sol	Added mock verifier contract and support for optional nitro enclave verifier deployment
packages/contracts-bedrock/lib/espresso-tee-contracts	Updated submodule reference to newer commit
packages/contracts-bedrock/foundry.toml	Removed deprecated compilation restrictions and added new remapping
op-deployer/pkg/deployer/pipeline/espresso.go	Added environment variable support for nitro enclave verifier address and enclave hash
op-deployer/pkg/deployer/opcm/espresso.go	Extended input struct with NitroEnclaveVerifier field
op-batcher/enclave-entrypoint.bash	Added espresso-attestation-service to URL argument regex
op-batcher/bindings/batch_inbox.go	Regenerated bindings reflecting Solidity version change
op-batcher/bindings/batch_authenticator.go	Regenerated bindings removing deprecated methods
op-batcher/batcher/service.go	Added attestation service URL configuration and changed attestation storage from Result to bytes
op-batcher/batcher/espresso.go	Replaced direct attestation verification with ZK proof generation via HTTP service
op-batcher/batcher/driver.go	Added EspressoOnchainProof struct and changed Attestation type to bytes
espresso/environment/optitmism_espresso_test_helpers.go	Added attestation verifier ZK service to Docker launch configuration
espresso/environment/espresso_docker_helpers.go	Enhanced Docker container support with platform and name options
espresso/environment/enclave_helpers.go	Added attestation service argument to enclave batcher setup
espresso/environment/5_batch_authentication_test.go	Updated tests to use raw attestation bytes and fixed private key usage
espresso/docker/op-batcher-tee/run-enclave.sh	Added required ATTESTATION_SERVICE_URL environment variable
espresso/docker-compose.yml	Added attestation-service-zk container configuration
espresso/cli.go	Added AttestationServiceFlagName and EspressoAttestationService configuration
.github/workflows/espresso-integration.yaml	Updated runner to ubuntu-24.04-8core

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

espresso/environment/optitmism_espresso_test_helpers.go

op-batcher/batcher/espresso.go

op-deployer/pkg/deployer/pipeline/espresso.go

packages/contracts-bedrock/scripts/deploy/DeployAWSNitroVerifier.s.sol

op-batcher/batcher/driver.go

espresso/environment/optitmism_espresso_test_helpers.go

espresso/docker-compose.yml

dailinsubjam

Awesome that we have the zk verifier now! It's just that for those hard-coded values, I think we could handle them in a cleaner way, but we can leave this to the last-round changes. I don't have many comments on the changes in espresso.go or the mock Nitro verifier contract, they look good to me, although more comments would always be helpful. Would love to hear others’ thoughts as well.

dailinsubjam · 2025-12-10T22:54:19Z

espresso/docker-compose.yml

+      # This is a demo private key for tests, it doesnt contain any funds
+      NETWORK_PRIVATE_KEY: "0x71f8e55f7555c946eadd5a2b5897465a9813b3ee493d6ef4ba6f1505a6e97af3"
+      NETWORK_RPC_URL: "https://rpc.mainnet.succinct.xyz"
+      SP1_PROVER: "mock"
+      RPC_URL: "https://rpc.ankr.com/eth_sepolia/ece75e2d2d01c537031b3b31a619b7830674b9cd1b9fe6bc957a3d393c035dbb"
+      NITRO_VERIFIER_ADDRESS: "0x2D7fbBAD6792698Ba92e67b7e180f8010B9Ec788"
+      USE_DOCKER: "1"
+      SKIP_TIME_VALIDITY_CHECK: "true"
+      RUST_LOG: "info"
+      HOST: "0.0.0.0"
+      PORT: "8080"


we have a .env to put these variables, especially for URL and Private key, I'd recommend we put them there.

done thank you 096c4e0

dailinsubjam · 2025-12-10T22:55:31Z

espresso/environment/5_batch_authentication_test.go

 	launcher := new(env.EspressoDevNodeLauncherDocker)

-	privateKey, err := crypto.GenerateKey()
+	privateKey, err := crypto.HexToECDSA("841c29acb9520a7ea8a48e7686cd825b93e8a3ecd966b62cb396ff8a2cd7e80e")


Would appreciate a comment on where this hex come from.

Why do we need to hardcode the key here?

Basically this test is checking if a given key has been registered or not and based on that batcher should not be able to submit batches. Because we are now using Mock contract - it doesnt actually verify the ZK proof to determine if the key should be registered or not. It just always returns true so the way to make this test work we make a special condition for mock contract to return false - thats why I have a hardcoded private key. Then we can see if the batcher stops posting or not and test the whole flow end to end

I also added comments to this line 096c4e0

Ok, makes sense. Thanks!

dailinsubjam · 2025-12-10T23:02:32Z

espresso/environment/optitmism_espresso_test_helpers.go

 const ESPRESSO_SEQUENCER_API_PORT = "24000"
 const ESPRESSO_DEV_NODE_PORT = "24002"

+const ATTESTATION_VERIFIER_ZK_SERVER_DOCKER_IMAGE = "ghcr.io/espressosystems/attestation-verifier-zk:sha-0e987c3"


Would appreciate a ESPRESSO_ prefix for them or there must be a better way to deal with these hard-coded consts. Will wait to see others' ideas.

Makes sense, since other consts in this file all have this prefix.

096c4e0 🙏

shenkeyao · 2025-12-11T00:21:13Z

op-batcher/batcher/espresso.go

+	}
+	defer res.Body.Close()
+
+	responseData, err := io.ReadAll(res.Body)


Should we also check the StatusCode of this response?

096c4e0 🙏

shenkeyao · 2025-12-11T00:30:43Z

espresso/environment/optitmism_espresso_test_helpers.go

 const ESPRESSO_SEQUENCER_API_PORT = "24000"
 const ESPRESSO_DEV_NODE_PORT = "24002"

+const ATTESTATION_VERIFIER_ZK_SERVER_DOCKER_IMAGE = "ghcr.io/espressosystems/attestation-verifier-zk:sha-0e987c3"


Makes sense, since other consts in this file all have this prefix.

shenkeyao · 2025-12-11T00:36:04Z

op-batcher/enclave-entrypoint.bash

 # URL argument regex pattern
-URL_ARG_RE='^(--altda\.da-server|--espresso\.urls|--espresso\.l1-url|--espresso\.rollup-l1-url|--l1-eth-rpc|--l2-eth-rpc|--rollup-rpc|--signer\.endpoint)(=|$)'
-
+# Line 156


Nit: Should we remove this comment?

096c4e0 🙏

espresso/docker-compose.yml

espresso/environment/optitmism_espresso_test_helpers.go

…tems/optimism-espresso-integration into enable-zk-verifier

philippecamacho

Great work Sneh!

Sneh1999 added 30 commits December 8, 2025 10:58

Add support for ZK attestation service

8ab884c

check attestation service url is not nil

be5ebd8

upgrade espresso tee verifier contracts

b41dae9

fix contracts

63ebe12

Merge branch 'celo-integration-rebase-14.1' of github.com:EspressoSys…

a8528fa

…tems/optimism-espresso-integration into enable-zk-verifier

fix merge

a9ed48c

fix tests

af14e95

bring back deploy aws nitro

2b79115

add support for mock contract

19803fd

add support for attestation verifier service

854f4a7

fix tee tests

f80b5b1

use higher version of github runner

6472c74

fix tee args

582de40

Merge branch 'celo-integration-rebase-14.1' of github.com:EspressoSys…

db15c1b

…tems/optimism-espresso-integration into enable-zk-verifier

fix tee args

69efedf

add healthcheck to attestation verifier zk

e238351

increase timeout

171349a

Invalid attestation test passing

078f029

small fixes

c6ef14f

fix TestE2eDevnetWithUnattestedBatcherKey

33bddb1

fix health check

c631af9

fix devnet test

0c3135e

use 127.0.0.1

428fbf0

fix regex

c894164

debug

7cd80e6

fix proof generation

febccc7

debug

e158d32

fix url

410015d

fix url

63c47ef

remove debug logs

72174b0

Sneh1999 requested a review from Copilot December 10, 2025 20:03

Sneh1999 marked this pull request as ready for review December 10, 2025 20:09

Copilot AI reviewed Dec 10, 2025

View reviewed changes

resolve based on comments

4ea1a68

Sneh1999 force-pushed the enable-zk-verifier branch from 7b34765 to 4ea1a68 Compare December 10, 2025 20:19

Sneh1999 requested review from QuentinI, dailinsubjam, miguelCyclone, philippecamacho and shenkeyao December 10, 2025 20:24

philippecamacho reviewed Dec 10, 2025

View reviewed changes

espresso/docker-compose.yml Show resolved Hide resolved

dailinsubjam reviewed Dec 11, 2025

View reviewed changes

shenkeyao reviewed Dec 11, 2025

View reviewed changes