ChessProofVerifier.sol

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {ReentrancyGuard} from "@openzeppelin/contracts/security/ReentrancyGuard.sol";
import {Ownable} from "@openzeppelin/contracts/access/Ownable.sol";

/**
 * @title ChessProofVerifier
 * @notice On-chain wrapper for RISC Zero ZK proof verification of chess games.
 *
 *         Architecture
 *         ────────────
 *         Off-chain (Rust / RISC Zero guest program):
 *           1. Build the chess-guest program (see chess-guest/ directory)
 *           2. Feed it the uint16[] moves array as private input
 *           3. Guest validates the full game using shakmaty
 *           4. Guest commits (outcome: uint8, movesHash: bytes32) as public journal
 *           5. Submit proof receipt to Bonsai or self-hosted prover
 *
 *         On-chain (this contract):
 *           1. Receive the proof receipt + journal
 *           2. Forward to RISC Zero verifier contract (already deployed on major networks)
 *           3. Decode (outcome, movesHash) from the journal
 *           4. Call ChessWager.settleFromVerifier() to settle the game
 *
 *         Gas comparison:
 *           - submitGame() with 60-move game:  ~500,000 gas
 *           - verifyAndSettle() with ZK proof: ~3,000-5,000 gas
 *
 * @dev The IMAGE_ID is derived deterministically from the compiled chess-guest
 *      binary. It is set at deployment and cannot change.
 *
 *      RISC Zero verifier addresses (as of 2025):
 *        Mainnet:  0x8EaB2D97Dfce405A1692a21b3ff3A172d593D319
 *        Sepolia:  0x925d8331ddc0a1F0d96E68CF073DFE1d92b69187
 *        Base:     0x0b144e07A0826182176AB3e27021fA07F9EDE7Aa
 *        Arbitrum: 0x0b144e07A0826182176AB3e27021fA07F9EDE7Aa
 */
contract ChessProofVerifier is Ownable, ReentrancyGuard {

    // =========================================================================
    // Interfaces
    // =========================================================================

    /// @notice RISC Zero on-chain verifier interface.
    interface IRiscZeroVerifier {
        /**
         * @notice Verify a RISC Zero STARK proof.
         * @param seal        The proof seal (encoded STARK).
         * @param imageId     The guest image ID — identifies which program was run.
         * @param journalHash SHA-256 hash of the public journal outputs.
         */
        function verify(
            bytes calldata seal,
            bytes32        imageId,
            bytes32        journalHash
        ) external view;
    }

    /// @notice ChessWager settlement interface — settleFromVerifier is the ZK path.
    interface IChessWager {
        function settleFromVerifier(
            uint256 gameId,
            uint8   outcome,
            bytes32 movesHash
        ) external;
    }

    // =========================================================================
    // State
    // =========================================================================

    IRiscZeroVerifier public immutable verifier;
    IChessWager       public immutable wager;

    /// @notice Image ID of the compiled chess-guest binary (set at deploy).
    bytes32 public immutable IMAGE_ID;

    // =========================================================================
    // Events
    // =========================================================================

    event ProofVerified(
        uint256 indexed gameId,
        uint8   outcome,
        bytes32 movesHash
    );

    // =========================================================================
    // Constructor
    // =========================================================================

    /**
     * @param _verifier RISC Zero on-chain verifier contract address.
     * @param _wager    ChessWager contract address.
     * @param _imageId  IMAGE_ID of the chess-guest binary (from build output).
     */
    constructor(
        address _verifier,
        address _wager,
        bytes32 _imageId
    ) Ownable() {
        require(_verifier != address(0), "ChessProofVerifier: zero verifier");
        require(_wager    != address(0), "ChessProofVerifier: zero wager");
        require(_imageId  != bytes32(0), "ChessProofVerifier: zero imageId");

        verifier = IRiscZeroVerifier(_verifier);
        wager    = IChessWager(_wager);
        IMAGE_ID = _imageId;
    }

    // =========================================================================
    // Core function
    // =========================================================================

    /**
     * @notice Verify a ZK proof of game validity and settle the wager.
     *
     *         The journal must be ABI-encoded as: abi.encode(uint256 gameId, uint8 outcome, bytes32 movesHash)
     *         The proof must have been generated by the chess-guest program for the
     *         same IMAGE_ID that was set at deployment.
     *
     * @param seal    RISC Zero STARK proof seal.
     * @param journal ABI-encoded public outputs: (gameId, outcome, movesHash).
     */
    function verifyAndSettle(
        bytes calldata seal,
        bytes calldata journal
    ) external nonReentrant {
        // 1. Verify the ZK proof against the committed journal
        verifier.verify(seal, IMAGE_ID, sha256(journal));

        // 2. Decode public journal outputs
        (uint256 gameId, uint8 outcome, bytes32 movesHash) =
            abi.decode(journal, (uint256, uint8, bytes32));

        require(outcome >= 1 && outcome <= 3, "ChessProofVerifier: invalid outcome in journal");

        emit ProofVerified(gameId, outcome, movesHash);

        // 3. Settle the game in ChessWager
        wager.settleFromVerifier(gameId, outcome, movesHash);
    }
}