Two bugs in the previous blind-decrement rollbackNonce():
1. Concurrent draw: another proof generated between attempt 1 and the retry
advances nextNonce, so decrementing steals a nonce already claimed by
another live message — nullifier collision, on-chain slashable.
2. Pre-attached proof: if the incoming message already carries a proof,
checkAndGenerateRLNProof short-circuits and draws no nonce, yet the retry
still called rollback, stomping on whatever nonce the preceding message
legitimately drew.
Fix: rollbackNonce now takes the specific nonce as a parameter and only
decrements when nextNonce == nonce + 1. checkAndGenerateRLNProof returns
(msg, messageId) so callers can thread the drawn id through to the retry
as reuseMessageId; generateRLNProof no longer performs an implicit rollback.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
e7afdce63e