fix(linea): ensure header contains an inclusion proof

lib/linea-verifier/src/verify.rs

@@ -80,19 +80,16 @@ pub fn verify_header(
     .map_err(Error::InvalidL2StateRootProof)?;
 
     // 5.
-    // TODO: perhaps force the proof to be an actual inclusion proof off-chain
-    let account = linea_zktrie::verify::verify::<ZkAccount>(
+    linea_zktrie::verify::verify_inclusion_and_key::<ZkAccount>(
         &new_mimc_constants_bls12_377(),
-        &header.l2_ibc_contract_proof,
+        header.l2_ibc_contract_proof.leaf_index,
+        &header.l2_ibc_contract_proof.proof,
         header.l2_state_root,
         client_state.l2_ibc_contract_address,
     )
     .map_err(Error::InvalidL2IbcContractProof)?;
 
-    match account {
-        Some(_) => Ok(()),
-        None => Err(Error::L2IbcContractProofIsNotInclusion),
-    }
+    Ok(())
 }
 
 pub fn state_root_hashes_mapping_key(slot: U256, l2_block_number: U256) -> U256 {

lib/unionlabs/src/ibc/lightclients/linea/header.rs

@@ -10,7 +10,7 @@ use crate::{
             storage_proof::{StorageProof, TryFromStorageProofError},
         },
     },
-    linea::proof::{MerkleProof, TryFromMerkleProofError},
+    linea::proof::{InclusionProof, TryFromMerkleProofError},
 };
 
 #[model(proto(raw(protos::union::ibc::lightclients::linea::v1::Header), into, from))]
@@ -23,7 +23,7 @@ pub struct Header {
     pub l2_state_root_proof: StorageProof,
     pub l2_timestamp: u64,
     pub l2_timestamp_proof: StorageProof,
-    pub l2_ibc_contract_proof: MerkleProof,
+    pub l2_ibc_contract_proof: InclusionProof,
 }
 
 impl From<Header> for protos::union::ibc::lightclients::linea::v1::Header {

light-clients/linea-light-client/src/client.rs

@@ -154,21 +154,13 @@ impl IbcClient for LineaLightClient {
             );
         }
 
-        // TODO: perhaps force the proof to be an actual inclusion proof off-chain
-        let account = match header.l2_ibc_contract_proof {
-            unionlabs::linea::proof::MerkleProof::Inclusion(inclusion) => {
-                // Guaranteed to success as we previously verified the proof
-                // which involved decoding and hashing the account.
-                ZkAccount::decode(inclusion.proof.value).expect("impossible")
-            }
-            unionlabs::linea::proof::MerkleProof::NonInclusion(_) => {
-                return Err(Error::InvalidL2AccountProof.into())
-            }
-        };
+        // Guaranteed to succeed as we previously verified the header
+        let zk_account =
+            ZkAccount::decode(header.l2_ibc_contract_proof.proof.value).expect("impossible");
 
         let consensus_state = WasmConsensusState {
             data: ConsensusState {
-                ibc_storage_root: account.storage_root,
+                ibc_storage_root: zk_account.storage_root,
                 // must be nanos
                 timestamp: 1_000_000_000 * header.l2_timestamp,
             },

uniond/proto/union/ibc/lightclients/linea/v1/linea.proto

@@ -32,7 +32,7 @@ message Header {
   .union.ibc.lightclients.ethereum.v1.StorageProof l2_state_root_proof = 6;
   uint64 l2_timestamp = 7;
   .union.ibc.lightclients.ethereum.v1.StorageProof l2_timestamp_proof = 8;
-  MerkleProof l2_ibc_contract_proof = 9;
+  InclusionProof l2_ibc_contract_proof = 9;
 }
 
 message MerklePath {