The Authentication Witness (AuthWit) is a mechanism for authenticating actions on Aztec, enabling users to allow third parties (such as protocols or other users) to execute actions on their behalf. An AuthWit is data (e.g., a signature, a secret, or a token) that proves a specific message_hash is authorized.
The message_hash is structured as: hash(consumer, chain_id, version, inner_hash)
- consumer: The address of the contract consuming the message.
- chain_id: The ID of the chain where the message is consumed (prevents cross-chain replay attacks).
- version: The version of the chain.
- inner_hash: The hash of the actual action being approved (e.g., a hash of the caller, the action name, and the arguments).
Authentication Flows:
- Private Context: Executed on the user's device. Contracts use oracles to ask the user for a signature/proof. A nullifier is emitted by the consumer contract to prevent replay attacks.
- Public Context: Executed by the sequencer. Uses an authentication registry to store authorized
message_hash mappings. The account contract calls set_authorized to grant permission, and the consumer contract calls consume to verify and revoke the permission.