[encrypted-mempool] Introduce new payload type

ibalajiarun · ibalajiarun · commit c01522f748af · 2025-11-11T11:33:14.000-08:00
diff --git a/api/src/transactions.rs b/api/src/transactions.rs
@@ -1294,6 +1294,13 @@ impl TransactionsApi {
                             }
                         },
                     },
+                    TransactionPayload::EncryptedPayload(_) => {
+                        return Err(SubmitTransactionError::bad_request_with_code(
+                            "Encrypted Transaction is not supported yet",
+                            AptosErrorCode::InvalidInput,
+                            ledger_info,
+                        ));
+                    },
                 }
                 // TODO: Verify script args?
 
@@ -1580,6 +1587,18 @@ impl TransactionsApi {
             ));
         }
 
+        if txn
+            .raw_transaction_ref()
+            .payload_ref()
+            .is_encrypted_variant()
+        {
+            return Err(SubmitTransactionError::bad_request_with_code(
+                "Encrypted transactions cannot be simulated",
+                AptosErrorCode::InvalidInput,
+                &ledger_info,
+            ));
+        }
+
         // Simulate transaction
         let state_view = self.context.latest_state_view_poem(&ledger_info)?;
         let (vm_status, output) =
@@ -1639,6 +1658,9 @@ impl TransactionsApi {
                 };
                 stats_key
             },
+            TransactionPayload::EncryptedPayload(_) => {
+                unreachable!("Encrypted transactions must not be simulated")
+            },
         };
         self.context
             .simulate_txn_stats()
diff --git a/api/types/src/convert.rs b/api/types/src/convert.rs
@@ -403,6 +403,9 @@ impl<'a, S: StateView> MoveConverter<'a, S> {
             },
             // Deprecated.
             ModuleBundle(_) => bail!("Module bundle payload has been removed"),
+            EncryptedPayload(_) => {
+                bail!("Encrypted payload isn't supported yet")
+            },
         };
         Ok(ret)
     }
diff --git a/aptos-move/aptos-transaction-simulation-session/src/session.rs b/aptos-move/aptos-transaction-simulation-session/src/session.rs
@@ -326,6 +326,7 @@ impl Session {
                 name_from_executable(executable)
             },
             TransactionPayload::ModuleBundle(_) => unreachable!(),
+            TransactionPayload::EncryptedPayload(_) => "encrypted".to_string(),
         };
 
         let output_path = self
diff --git a/aptos-move/aptos-vm/src/aptos_vm.rs b/aptos-move/aptos-vm/src/aptos_vm.rs
@@ -3198,6 +3198,10 @@ impl VMValidator for AptosVM {
             }
         }
 
+        if transaction.payload().is_encrypted_variant() {
+            return VMValidatorResult::error(StatusCode::FEATURE_UNDER_GATING);
+        }
+
         let txn = match transaction.check_signature() {
             Ok(t) => t,
             _ => {
diff --git a/consensus/src/quorum_store/types.rs b/consensus/src/quorum_store/types.rs
@@ -177,7 +177,11 @@ impl Batch {
             ensure!(
                 txn.gas_unit_price() >= self.gas_bucket_start(),
                 "Payload gas unit price doesn't match batch info"
-            )
+            );
+            ensure!(
+                !txn.payload().is_encrypted_variant(),
+                "Encrypted transaction is not supported yet"
+            );
         }
         Ok(())
     }
diff --git a/crates/aptos-transaction-filters/src/transaction_filter.rs b/crates/aptos-transaction-filters/src/transaction_filter.rs
@@ -4,6 +4,7 @@
 use aptos_crypto::{ed25519::Ed25519PublicKey, HashValue};
 use aptos_types::transaction::{
     authenticator::{AccountAuthenticator, AnyPublicKey, TransactionAuthenticator},
+    encrypted_payload::EncryptedPayload,
     EntryFunction, MultisigTransactionPayload, Script, SignedTransaction, TransactionExecutableRef,
     TransactionExtraConfig, TransactionPayload, TransactionPayloadInner,
 };
@@ -343,6 +344,18 @@ fn matches_entry_function(
                 },
             }
         },
+        TransactionPayload::EncryptedPayload(EncryptedPayload::V1(payload)) => {
+            if let Ok(executable) = payload.executable_ref() {
+                match executable {
+                    TransactionExecutableRef::Script(_) | TransactionExecutableRef::Empty => false,
+                    TransactionExecutableRef::EntryFunction(entry_function) => {
+                        compare_entry_function(entry_function, address, module_name, function)
+                    },
+                }
+            } else {
+                false
+            }
+        },
     }
 }
 
@@ -374,6 +387,18 @@ fn matches_entry_function_module_address(
                 },
             }
         },
+        TransactionPayload::EncryptedPayload(EncryptedPayload::V1(payload)) => {
+            if let Ok(executable) = payload.executable_ref() {
+                match executable {
+                    TransactionExecutableRef::Script(_) | TransactionExecutableRef::Empty => false,
+                    TransactionExecutableRef::EntryFunction(entry_function) => {
+                        compare_entry_function_module_address(entry_function, module_address)
+                    },
+                }
+            } else {
+                false
+            }
+        },
     }
 }
 
@@ -397,6 +422,15 @@ fn matches_multisig_address(
                     .unwrap_or(false),
             }
         },
+        TransactionPayload::EncryptedPayload(EncryptedPayload::V1(payload)) => {
+            match payload.extra_config() {
+                TransactionExtraConfig::V1 {
+                    multisig_address, ..
+                } => multisig_address
+                    .map(|multisig_address| multisig_address == *address)
+                    .unwrap_or(false),
+            }
+        },
     }
 }
 
@@ -421,6 +455,19 @@ fn matches_script_argument_address(
                 },
             }
         },
+        TransactionPayload::EncryptedPayload(EncryptedPayload::V1(payload)) => {
+            if let Ok(executable) = payload.executable_ref() {
+                match executable {
+                    TransactionExecutableRef::EntryFunction(_)
+                    | TransactionExecutableRef::Empty => false,
+                    TransactionExecutableRef::Script(script) => {
+                        compare_script_argument_address(script, address)
+                    },
+                }
+            } else {
+                false
+            }
+        },
     }
 }
 
diff --git a/types/src/transaction/encrypted_payload.rs b/types/src/transaction/encrypted_payload.rs
@@ -0,0 +1,79 @@
+// Copyright (c) Aptos Foundation
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::transaction::{TransactionExecutable, TransactionExecutableRef, TransactionExtraConfig};
+use anyhow::{bail, Result};
+use aptos_crypto::HashValue;
+use serde::{Deserialize, Serialize};
+use std::ops::Deref;
+
+pub type CipherText = Vec<u8>;
+pub type EvalProof = Vec<u8>;
+
+#[derive(Clone, Debug, Hash, Eq, PartialEq, Serialize, Deserialize)]
+pub enum EncryptedPayload {
+    V1(EncryptedPayloadV1),
+}
+
+impl Deref for EncryptedPayload {
+    type Target = EncryptedPayloadV1;
+
+    fn deref(&self) -> &Self::Target {
+        let Self::V1(payload) = self;
+        payload
+    }
+}
+
+#[derive(Clone, Debug, Hash, Eq, PartialEq, Serialize, Deserialize)]
+pub enum EncryptedPayloadV1 {
+    Encrypted {
+        ciphertext: CipherText,
+        extra_config: TransactionExtraConfig,
+        payload_hash: HashValue,
+    },
+    FailedDecryption {
+        ciphertext: CipherText,
+        extra_config: TransactionExtraConfig,
+        payload_hash: HashValue,
+
+        eval_proof: EvalProof,
+    },
+    Decrypted {
+        ciphertext: CipherText,
+        extra_config: TransactionExtraConfig,
+        payload_hash: HashValue,
+        eval_proof: EvalProof,
+
+        // decrypted things
+        executable: TransactionExecutable,
+        decryption_nonce: u64,
+    },
+}
+
+impl EncryptedPayloadV1 {
+    pub fn executable(&self) -> Result<TransactionExecutable> {
+        let Self::Decrypted { executable, .. } = self else {
+            bail!("Transaction is encrypted");
+        };
+        Ok(executable.clone())
+    }
+
+    pub fn executable_ref(&self) -> Result<TransactionExecutableRef<'_>> {
+        let Self::Decrypted { executable, .. } = self else {
+            bail!("Transaction is encrypted");
+        };
+        Ok(executable.as_ref())
+    }
+
+    pub fn extra_config(&self) -> &TransactionExtraConfig {
+        match self {
+            EncryptedPayloadV1::Encrypted { extra_config, .. } => extra_config,
+            EncryptedPayloadV1::FailedDecryption { extra_config, .. } => extra_config,
+            EncryptedPayloadV1::Decrypted { extra_config, .. } => extra_config,
+        }
+    }
+
+    pub fn is_encrypted(&self) -> bool {
+        matches!(self, Self::Encrypted { .. })
+    }
+}
diff --git a/types/src/transaction/mod.rs b/types/src/transaction/mod.rs
@@ -12,9 +12,12 @@ use crate::{
     keyless::{KeylessPublicKey, KeylessSignature},
     ledger_info::LedgerInfo,
     proof::{TransactionInfoListWithProof, TransactionInfoWithProof},
-    transaction::authenticator::{
-        AASigningData, AccountAuthenticator, AnyPublicKey, AnySignature, SingleKeyAuthenticator,
-        TransactionAuthenticator,
+    transaction::{
+        authenticator::{
+            AASigningData, AccountAuthenticator, AnyPublicKey, AnySignature,
+            SingleKeyAuthenticator, TransactionAuthenticator,
+        },
+        encrypted_payload::EncryptedPayload,
     },
     vm_status::{DiscardedVMStatus, KeptVMStatus, StatusCode, StatusType, VMStatus},
     write_set::{HotStateOp, WriteSet},
@@ -46,6 +49,7 @@ pub mod authenticator;
 pub mod block_epilogue;
 mod block_output;
 mod change_set;
+pub mod encrypted_payload;
 mod module;
 mod multisig;
 mod script;
@@ -546,6 +550,10 @@ impl RawTransaction {
         self.payload
     }
 
+    pub fn payload_ref(&self) -> &TransactionPayload {
+        &self.payload
+    }
+
     pub fn executable_ref(&self) -> Result<TransactionExecutableRef<'_>> {
         self.payload.executable_ref()
     }
@@ -679,6 +687,8 @@ pub enum TransactionPayload {
     /// Contains an executable (script/entry function) along with extra configuration.
     /// Once this new format is fully rolled out, above payload variants will be deprecated.
     Payload(TransactionPayloadInner),
+    /// Represents an encrypted transaction payload
+    EncryptedPayload(EncryptedPayload),
 }
 
 #[derive(Clone, Debug, Hash, Eq, PartialEq, Serialize, Deserialize)]
@@ -761,6 +771,9 @@ impl TransactionPayload {
             TransactionPayload::Payload(TransactionPayloadInner::V1 { extra_config, .. }) => {
                 extra_config.is_multisig()
             },
+            TransactionPayload::EncryptedPayload(encrypted_payload) => {
+                encrypted_payload.extra_config().is_multisig()
+            },
         }
     }
 
@@ -793,6 +806,9 @@ impl TransactionPayload {
             TransactionPayload::ModuleBundle(_) => {
                 Err(format_err!("ModuleBundle variant is deprecated"))
             },
+            TransactionPayload::EncryptedPayload(encrypted_payload) => {
+                encrypted_payload.executable()
+            },
         }
     }
 
@@ -809,6 +825,9 @@ impl TransactionPayload {
             TransactionPayload::ModuleBundle(_) => {
                 Err(format_err!("ModuleBundle variant is deprecated"))
             },
+            TransactionPayload::EncryptedPayload(encrypted_payload) => {
+                encrypted_payload.executable_ref()
+            },
         }
     }
 
@@ -827,6 +846,9 @@ impl TransactionPayload {
             TransactionPayload::Payload(TransactionPayloadInner::V1 { extra_config, .. }) => {
                 extra_config.clone()
             },
+            TransactionPayload::EncryptedPayload(encrypted_payload) => {
+                encrypted_payload.extra_config().clone()
+            },
         }
     }
 
@@ -919,6 +941,10 @@ impl TransactionPayload {
             extra_config,
         })
     }
+
+    pub fn is_encrypted_variant(&self) -> bool {
+        matches!(self, Self::EncryptedPayload(_))
+    }
 }
 
 impl TransactionExtraConfig {
diff --git a/types/src/transaction/use_case.rs b/types/src/transaction/use_case.rs
@@ -41,6 +41,15 @@ fn parse_use_case(payload: &TransactionPayload) -> UseCaseKey {
                 None
             }
         },
+        EncryptedPayload(encrypted_payload) => {
+            if let Ok(TransactionExecutableRef::EntryFunction(entry_fun)) =
+                encrypted_payload.executable_ref()
+            {
+                Some(entry_fun)
+            } else {
+                None
+            }
+        },
     };
 
     match maybe_entry_func {

Original file line number	Diff line number	Diff line change
`@@ -3198,6 +3198,10 @@ impl VMValidator for AptosVM {`
`3198`	`3198`	`}`
`3199`	`3199`	`}`
`3200`	`3200`
	`3201`	`+ if transaction.payload().is_encrypted_variant() {`
	`3202`	`+ return VMValidatorResult::error(StatusCode::FEATURE_UNDER_GATING);`
	`3203`	`+ }`
	`3204`	`+`
`3201`	`3205`	`let txn = match transaction.check_signature() {`
`3202`	`3206`	`Ok(t) => t,`
`3203`	`3207`	`_ => {`
Original file line number	Diff line number	Diff line change
`@@ -177,7 +177,11 @@ impl Batch {`
`177`	`177`	`ensure!(`
`178`	`178`	`txn.gas_unit_price() >= self.gas_bucket_start(),`
`179`	`179`	`"Payload gas unit price doesn't match batch info"`
`180`		`- )`
	`180`	`+ );`
	`181`	`+ ensure!(`
	`182`	`+ !txn.payload().is_encrypted_variant(),`
	`183`	`+ "Encrypted transaction is not supported yet"`
	`184`	`+ );`
`181`	`185`	`}`
`182`	`186`	`Ok(())`
`183`	`187`	`}`