Documentation

Verify a increment transaction.

Verify a decrement transaction.

Check that the G1 commitment stored in the output datum is consistent with the hash that parties signed. Prevents a malicious closer from storing a wrong commitment while providing a valid signature over a correct hash.

Verify a close transaction.

Verify a contest transaction.

Verify a fanout transaction using a KZG membership proof. All distributed outputs are verified as members of the accumulator in a single proof.

Verify a partial fanout transaction. Transitions either Closed → FanoutProgress or FanoutProgress → FanoutProgress: distributes a subset of UTxOs and continues with a smaller FanoutProgressDatum.

The continuing head output must be the first transaction output. Distributed UTxOs follow at indices [1 .. numberOfPartialOutputs].

Verify the final partial fanout transaction. Transitions FanoutProgress → Final: distributes all remaining UTxOs and burns all head tokens.

Unlike intermediate steps, there is no continuing head output. All distributed UTxOs start at index 0. Tokens must be burned.

Note: headId, parties, and contestationDeadline are not re-verified explicitly. headId and parties are validated implicitly by mustBurnAllHeadTokens (wrong values would target the wrong token set). contestationDeadline was locked in by earlier checkPartialFanout steps and is trustworthy from the on-chain datum.

This is safe only because usually Head transaction only consume one input.

Verify the multi-signature of a snapshot using given constituents FanoutProgressDatum, ClosedDatum, number, and ContestRedeemer. See 'SignableRepresentation Snapshot' for more details.

Verify individual party signature of a snapshot. See 'SignableRepresentation Snapshot' for more details.

BLAKE2b-256 of the canonical CRS datum: the published EIP-4844 trusted setup (first defaultItems G2 points) hashed by hashCRSDatum. Baked into the validator so every fanout rejects a reference input carrying any other powers-of-tau setup. Computed directly from the embedded setup — no hardcoded value.

Check that the lower validity bound of the transaction is strictly after the contestation deadline. Used by all three fanout paths.

Find a CRS reference input by TxOutRef and decode its non-empty datum. Errors on missing input, undecoded datum, or empty CRS list.

Hash a CRS datum by its content: BLAKE2b-256 over the concatenation of the compressed G2 points. Binding the datum content is what keeps the membership proof sound — the trusted-setup τ is fixed and public, so any other setup would let a crafted fanout forge proofs.

Look up the CRS datum from a reference input and pass it to a continuation, rejecting any reference input whose datum is not the canonical trusted setup.

Compute the accumulator scalar for each output in the list. Used by all three fanout validators (headIsFinalizedWith, checkPartialFanout, checkFinalPartialFanout) to produce subset scalars for checkMembershipPairing. Each scalar is blake2b_224(hashTxOuts [txOut]), which equals blake2b_224(sha2_256(serialised)) because hashTxOuts uses sha2_256 internally (matching what addElement computes off-chain).