fix: Enforce recipients of l2l1msgs having 20 bytes at most

barretenberg/cpp/pil/vm2/constants_gen.pil

@@ -1,5 +1,6 @@
 // GENERATED FILE - DO NOT EDIT, RUN yarn remake-constants in yarn-project/constants
 namespace constants;
+    pol MAX_ETH_ADDRESS_VALUE = 1461501637330902918203684832716283019655932542975;
     pol NOTE_HASH_TREE_HEIGHT = 42;
     pol PUBLIC_DATA_TREE_HEIGHT = 40;
     pol NULLIFIER_TREE_HEIGHT = 42;

barretenberg/cpp/pil/vm2/opcodes/send_l2_to_l1_msg.pil

@@ -39,9 +39,26 @@ namespace execution; // this is a virtual gadget that shares rows with the execu
     #[MAX_WRITES_REACHED]
     sel_execute_send_l2_to_l1_msg * (REMAINING_L2_TO_L1_MSG_WRITES * (sel_l2_to_l1_msg_limit_error * (1 - remaining_l2_to_l1_msgs_inv) + remaining_l2_to_l1_msgs_inv) - 1 + sel_l2_to_l1_msg_limit_error) = 0;
 
-    // The opcode errors if we have reached the limit or if we are in a static context
+    // Lookup constant support: We need this temporarily while we do not allow for aliases in the lookup tuple
+    pol commit max_eth_address_value;
+    sel_execute_send_l2_to_l1_msg * (constants.MAX_ETH_ADDRESS_VALUE - max_eth_address_value) = 0;
+
+    pol commit sel_too_large_recipient_error;
+
+    #[RECIPIENT_CHECK]
+    sel_execute_send_l2_to_l1_msg {
+        register[0], // recipient
+        max_eth_address_value,
+        sel_too_large_recipient_error
+    } in ff_gt.sel_gt {
+        ff_gt.a,
+        ff_gt.b,
+        ff_gt.result
+    };
+
+    // The opcode errors if we have reached the limit, if we are in a static context, or if the recipient is too large.
     #[OPCODE_ERROR]
-    sel_execute_send_l2_to_l1_msg * ((1 - sel_l2_to_l1_msg_limit_error) * (1 - is_static) - (1 - sel_opcode_error)) = 0;
+    sel_execute_send_l2_to_l1_msg * ((1 - sel_l2_to_l1_msg_limit_error) * (1 - is_static) * (1 - sel_too_large_recipient_error) - (1 - sel_opcode_error)) = 0;
 
     // =========== LOOKUP PI ===========
     pol commit sel_write_l2_to_l1_msg;

barretenberg/cpp/src/barretenberg/avm_fuzzer/fuzz_lib/instruction.hpp

@@ -517,11 +517,9 @@ struct CALLDATACOPY_Instruction {
 };
 
 struct SENDL2TOL1MSG_Instruction {
-    bb::avm2::FF recipient;
-    AddressRef recipient_address;
-    bb::avm2::FF content;
-    AddressRef content_address;
-    MSGPACK_FIELDS(recipient, recipient_address, content, content_address);
+    ParamRef recipient_address;
+    ParamRef content_address;
+    MSGPACK_FIELDS(recipient_address, content_address);
 };
 
 struct EMITUNENCRYPTEDLOG_Instruction {
@@ -869,8 +867,7 @@ inline std::ostream& operator<<(std::ostream& os, const FuzzInstruction& instruc
                    << arg.dst_address;
             },
             [&](SENDL2TOL1MSG_Instruction arg) {
-                os << "SENDL2TOL1MSG_Instruction " << arg.recipient << " " << arg.recipient_address << " "
-                   << arg.content << " " << arg.content_address;
+                os << "SENDL2TOL1MSG_Instruction " << arg.recipient_address << " " << arg.content_address;
             },
             [&](EMITUNENCRYPTEDLOG_Instruction arg) {
                 os << "EMITUNENCRYPTEDLOG_Instruction " << arg.log_size_address << " " << arg.log_values_address;

barretenberg/cpp/src/barretenberg/avm_fuzzer/fuzz_lib/program_block.cpp

@@ -1132,15 +1132,6 @@ void ProgramBlock::process_sendl2tol1msg_instruction(SENDL2TOL1MSG_Instruction i
 #ifdef DISABLE_SENDL2TOL1MSG_INSTRUCTION
     return;
 #endif
-    auto set_recipient_instruction = SET_FF_Instruction{ .value_tag = bb::avm2::MemoryTag::FF,
-                                                         .result_address = instruction.recipient_address,
-                                                         .value = instruction.recipient };
-    this->process_set_ff_instruction(set_recipient_instruction);
-    auto set_content_instruction = SET_FF_Instruction{ .value_tag = bb::avm2::MemoryTag::FF,
-                                                       .result_address = instruction.content_address,
-                                                       .value = instruction.content };
-    this->process_set_ff_instruction(set_content_instruction);
-
     auto recipient_address_operand = memory_manager.get_resolved_address_and_operand_16(instruction.recipient_address);
     auto content_address_operand = memory_manager.get_resolved_address_and_operand_16(instruction.content_address);
     if (!recipient_address_operand.has_value() || !content_address_operand.has_value()) {

barretenberg/cpp/src/barretenberg/avm_fuzzer/fuzz_lib/simulator.cpp

@@ -194,16 +194,6 @@ bool compare_simulator_results(SimulatorResult& result1, SimulatorResult& result
         result2.output.resize(MAX_RETURN_DATA_SIZE_IN_FIELDS);
     }
 
-    // TODO(avm):
-    // https://linear.app/aztec-labs/issue/AVM-209/l2l1msgs-possible-completeness-issue-with-recipient-20-bytes
-    for (auto& l2_to_l1_msg : result1.public_tx_effect.l2_to_l1_msgs) {
-        l2_to_l1_msg.message.recipient = FF(static_cast<uint256_t>(l2_to_l1_msg.message.recipient).slice(0, 20));
-    }
-
-    for (auto& l2_to_l1_msg : result2.public_tx_effect.l2_to_l1_msgs) {
-        l2_to_l1_msg.message.recipient = FF(static_cast<uint256_t>(l2_to_l1_msg.message.recipient).slice(0, 20));
-    }
-
     return result1.reverted == result2.reverted && result1.output == result2.output &&
            result1.end_tree_snapshots == result2.end_tree_snapshots &&
            result1.public_tx_effect == result2.public_tx_effect;

barretenberg/cpp/src/barretenberg/avm_fuzzer/mutations/basic_types/eth_address.cpp

@@ -0,0 +1,21 @@
+#include "barretenberg/avm_fuzzer/mutations/basic_types/eth_address.hpp"
+
+#include "barretenberg/avm_fuzzer/mutations/basic_types/field.hpp"
+#include "barretenberg/vm2/common/aztec_types.hpp"
+
+using bb::avm2::EthAddress;
+using bb::avm2::FF;
+
+namespace {
+
+EthAddress ff_to_eth_address(const FF& field)
+{
+    return EthAddress(static_cast<uint256_t>(field).slice(0, MAX_ETH_ADDRESS_BIT_SIZE));
+}
+
+} // namespace
+
+EthAddress generate_random_eth_address(std::mt19937_64& rng)
+{
+    return ff_to_eth_address(generate_random_field(rng));
+}

barretenberg/cpp/src/barretenberg/avm_fuzzer/mutations/basic_types/eth_address.hpp

@@ -0,0 +1,7 @@
+#pragma once
+
+#include <random>
+
+#include "barretenberg/vm2/common/aztec_types.hpp"
+
+bb::avm2::EthAddress generate_random_eth_address(std::mt19937_64& rng);

barretenberg/cpp/src/barretenberg/avm_fuzzer/mutations/basic_types/field.hpp

@@ -3,6 +3,7 @@
 #include <random>
 
 #include "barretenberg/avm_fuzzer/mutations/configuration.hpp"
+#include "barretenberg/vm2/common/aztec_types.hpp"
 #include "barretenberg/vm2/common/field.hpp"
 
 bb::avm2::FF generate_random_field(std::mt19937_64& rng);

barretenberg/cpp/src/barretenberg/avm_fuzzer/mutations/configuration.hpp

@@ -427,13 +427,11 @@ constexpr CalldataCopyMutationConfig BASIC_CALLDATACOPY_MUTATION_CONFIGURATION =
     { CalldataCopyMutationOptions::dst_address, 1 },
 });
 
-enum class SendL2ToL1MsgMutationOptions { recipient, recipient_address, content, content_address };
-using SendL2ToL1MsgMutationConfig = WeightedSelectionConfig<SendL2ToL1MsgMutationOptions, 4>;
+enum class SendL2ToL1MsgMutationOptions { recipient_address, content_address };
+using SendL2ToL1MsgMutationConfig = WeightedSelectionConfig<SendL2ToL1MsgMutationOptions, 2>;
 
 constexpr SendL2ToL1MsgMutationConfig BASIC_SENDL2TOL1MSG_MUTATION_CONFIGURATION = SendL2ToL1MsgMutationConfig({
-    { SendL2ToL1MsgMutationOptions::recipient, 1 },
     { SendL2ToL1MsgMutationOptions::recipient_address, 1 },
-    { SendL2ToL1MsgMutationOptions::content, 1 },
     { SendL2ToL1MsgMutationOptions::content_address, 1 },
 });
 

barretenberg/cpp/src/barretenberg/avm_fuzzer/mutations/instructions/instruction.cpp

@@ -6,6 +6,7 @@
 
 #include "barretenberg/avm_fuzzer/fuzz_lib/fuzzer_context.hpp"
 #include "barretenberg/avm_fuzzer/fuzz_lib/instruction.hpp"
+#include "barretenberg/avm_fuzzer/mutations/basic_types/eth_address.hpp"
 #include "barretenberg/avm_fuzzer/mutations/basic_types/field.hpp"
 #include "barretenberg/avm_fuzzer/mutations/basic_types/memory_tag.hpp"
 #include "barretenberg/avm_fuzzer/mutations/basic_types/uint16_t.hpp"
@@ -250,10 +251,7 @@ std::vector<FuzzInstruction> InstructionMutator::generate_instruction(std::mt199
     case InstructionGenerationOptions::CALLDATACOPY:
         return generate_calldatacopy_instruction(rng);
     case InstructionGenerationOptions::SENDL2TOL1MSG:
-        return { SENDL2TOL1MSG_Instruction{ .recipient = generate_random_field(rng),
-                                            .recipient_address = generate_address_ref(rng, MAX_16BIT_OPERAND),
-                                            .content = generate_random_field(rng),
-                                            .content_address = generate_address_ref(rng, MAX_16BIT_OPERAND) } };
+        return generate_sendl2tol1msg_instruction(rng);
     case InstructionGenerationOptions::EMITUNENCRYPTEDLOG:
         return generate_emitunencryptedlog_instruction(rng);
     case InstructionGenerationOptions::CALL:
@@ -980,6 +978,31 @@ std::vector<FuzzInstruction> InstructionMutator::generate_calldatacopy_instructi
     return instructions;
 }
 
+std::vector<FuzzInstruction> InstructionMutator::generate_sendl2tol1msg_instruction(std::mt19937_64& rng)
+{
+    bool use_backfill = std::uniform_int_distribution<int>(0, 4)(rng) != 0;
+    if (!use_backfill) {
+        return { SENDL2TOL1MSG_Instruction{ .recipient_address = generate_variable_ref(rng),
+                                            .content_address = generate_variable_ref(rng) } };
+    }
+    std::vector<FuzzInstruction> instructions;
+    instructions.reserve(3);
+
+    auto recipient_address = generate_address_ref(rng, MAX_16BIT_OPERAND);
+    instructions.push_back(SET_FF_Instruction{ .value_tag = bb::avm2::MemoryTag::FF,
+                                               .result_address = recipient_address,
+                                               .value = generate_random_eth_address(rng) });
+
+    auto content_address = generate_address_ref(rng, MAX_16BIT_OPERAND);
+    instructions.push_back(SET_FF_Instruction{
+        .value_tag = bb::avm2::MemoryTag::FF, .result_address = content_address, .value = generate_random_field(rng) });
+
+    instructions.push_back(
+        SENDL2TOL1MSG_Instruction{ .recipient_address = recipient_address, .content_address = content_address });
+
+    return instructions;
+}
+
 void InstructionMutator::mutate_param_ref(ParamRef& param,
                                           std::mt19937_64& rng,
                                           std::optional<MemoryTag> default_tag,
@@ -1351,17 +1374,11 @@ void InstructionMutator::mutate_sendl2tol1msg_instruction(SENDL2TOL1MSG_Instruct
 {
     SendL2ToL1MsgMutationOptions option = BASIC_SENDL2TOL1MSG_MUTATION_CONFIGURATION.select(rng);
     switch (option) {
-    case SendL2ToL1MsgMutationOptions::recipient:
-        mutate_field(instruction.recipient, rng, BASIC_FIELD_MUTATION_CONFIGURATION);
-        break;
     case SendL2ToL1MsgMutationOptions::recipient_address:
-        mutate_address_ref(instruction.recipient_address, rng, MAX_16BIT_OPERAND);
-        break;
-    case SendL2ToL1MsgMutationOptions::content:
-        mutate_field(instruction.content, rng, BASIC_FIELD_MUTATION_CONFIGURATION);
+        mutate_param_ref(instruction.recipient_address, rng, MemoryTag::FF, MAX_16BIT_OPERAND);
         break;
     case SendL2ToL1MsgMutationOptions::content_address:
-        mutate_address_ref(instruction.content_address, rng, MAX_16BIT_OPERAND);
+        mutate_param_ref(instruction.content_address, rng, MemoryTag::FF, MAX_16BIT_OPERAND);
         break;
     }
 }

barretenberg/cpp/src/barretenberg/avm_fuzzer/mutations/instructions/instruction.hpp

@@ -50,6 +50,7 @@ class InstructionMutator {
     std::vector<FuzzInstruction> generate_returndatasize_instruction(std::mt19937_64& rng);
     std::vector<FuzzInstruction> generate_returndatacopy_instruction(std::mt19937_64& rng);
     std::vector<FuzzInstruction> generate_calldatacopy_instruction(std::mt19937_64& rng);
+    std::vector<FuzzInstruction> generate_sendl2tol1msg_instruction(std::mt19937_64& rng);
 
     void mutate_variable_ref(VariableRef& variable, std::mt19937_64& rng, std::optional<MemoryTag> default_tag);
     void mutate_address_ref(AddressRef& address, std::mt19937_64& rng, uint32_t max_operand_value);

barretenberg/cpp/src/barretenberg/avm_fuzzer/mutations/tx_types/accumulated_data.cpp

@@ -1,6 +1,7 @@
 #include "barretenberg/avm_fuzzer/mutations/tx_types/accumulated_data.hpp"
 
 #include "barretenberg/avm_fuzzer/fuzz_lib/constants.hpp"
+#include "barretenberg/avm_fuzzer/mutations/basic_types/eth_address.hpp"
 #include "barretenberg/avm_fuzzer/mutations/basic_types/field.hpp"
 #include "barretenberg/avm_fuzzer/mutations/basic_types/vector.hpp"
 #include "barretenberg/avm_fuzzer/mutations/configuration.hpp"
@@ -45,7 +46,8 @@ void mutate_nullifier(FF& nullifier, std::mt19937_64& rng)
 ScopedL2ToL1Message generate_l2_to_l1_message(std::mt19937_64& rng)
 {
     return ScopedL2ToL1Message{
-        .message = L2ToL1Message{ .recipient = generate_random_field(rng), .content = generate_random_field(rng) },
+        .message =
+            L2ToL1Message{ .recipient = generate_random_eth_address(rng), .content = generate_random_field(rng) },
         .contract_address = generate_random_field(rng),
     };
 }
@@ -57,7 +59,7 @@ void mutate_l2_to_l1_msg(ScopedL2ToL1Message& msg, std::mt19937_64& rng)
     switch (choice) {
     case 0:
         // Mutate recipient
-        msg.message.recipient = generate_random_field(rng);
+        msg.message.recipient = generate_random_eth_address(rng);
         break;
     case 1:
         // Mutate content

barretenberg/cpp/src/barretenberg/vm2/common/aztec_constants.hpp

@@ -1,6 +1,8 @@
 // GENERATED FILE - DO NOT EDIT, RUN yarn remake-constants in yarn-project/constants
 #pragma once
 
+#define MAX_ETH_ADDRESS_BIT_SIZE 160
+#define MAX_ETH_ADDRESS_VALUE "0x000000000000000000000000ffffffffffffffffffffffffffffffffffffffff"
 #define ARCHIVE_HEIGHT 30
 #define NOTE_HASH_TREE_HEIGHT 42
 #define PUBLIC_DATA_TREE_HEIGHT 40
@@ -219,7 +221,7 @@
 #define AVM_L1TOL2MSGEXISTS_BASE_L2_GAS 540
 #define AVM_GETCONTRACTINSTANCE_BASE_L2_GAS 6108
 #define AVM_EMITUNENCRYPTEDLOG_BASE_L2_GAS 15
-#define AVM_SENDL2TOL1MSG_BASE_L2_GAS 418
+#define AVM_SENDL2TOL1MSG_BASE_L2_GAS 478
 #define AVM_CALL_BASE_L2_GAS 9936
 #define AVM_STATICCALL_BASE_L2_GAS 9936
 #define AVM_RETURN_BASE_L2_GAS 9

barretenberg/cpp/src/barretenberg/vm2/constraining/avm_fixed_vk.hpp

@@ -17,7 +17,7 @@ class AvmHardCodedVKAndHash {
     using FF = bb::curve::BN254::ScalarField;
 
     // Precomputed VK hash (hash of all commitments below).
-    static FF vk_hash() { return FF(uint256_t("0x2b1fc730f23ab1a3db0c967d92e6d5d7fb9be9aa8feee3fd3ecae2dee8637deb")); }
+    static FF vk_hash() { return FF(uint256_t("0x17049c998b2045d77a08e3f2514bef84f0270d873e24e19d89b9ef957a52b7cb")); }
 
     static constexpr std::array<Commitment, NUM_PRECOMPUTED_ENTITIES> get_all()
     {
@@ -70,9 +70,9 @@ class AvmHardCodedVKAndHash {
                 uint256_t(
                     "0x090dda25e7d64ab5cabe09fd80fbb731af2a98de7a608157dc10394b4fc022a4")), // precomputed_exec_opcode_dynamic_l2_gas
             Commitment(
-                uint256_t("0x1139e8df5eabbe4201a0d73a0cfa7e12833955b6e190ec05fcdc0002d2756736"),
+                uint256_t("0x21e67fcf50679e466fb930e885e9f43bec952b0f61671f2cfa2f9ee115887002"),
                 uint256_t(
-                    "0x1ed8930b01998a1ba6c2df226f9e9a2aa93606228ed6d74b568c93cbdd6fb77f")), // precomputed_exec_opcode_opcode_gas
+                    "0x033657b3b7eab8d049f258e2cf4616826c65a5e0e3e4cc7c1b8869857c05ae9e")), // precomputed_exec_opcode_opcode_gas
             Commitment(
                 uint256_t("0x296def9415d1c96b4d8ab91df5f59ad8522a726f98461b1ab5c4d4c5b22471a4"),
                 uint256_t(