Groth16VerifierLib

Title: Groth16VerifierLib

Authors: David Dada <daveproxy80@gmail.com> (https://github.com/dadadave80), Modified from snarkjs (https://github.com/iden3/snarkjs)

Library implementing a generic Groth16 verifier over BN254 (alt_bn128): the verifying key is a parameter, so one deployment verifies proofs for any circuit. Logic mirrors the audited snarkjs verifier template (PR#36 hardening) but reads the key from calldata.

Three-layer pattern: this library holds the logic; the stateless Groth16Verifier facet forwards to it. The module is stateless — it only registers IGroth16Verifier for ERC-165.

Constants

R

BN254 scalar field modulus r — public inputs must be < R.

uint256 internal constant R = 21888242871839275222246405745257275088548364400416034343698204186575808495617;

Q

BN254 base field modulus q — point coordinates must be < Q.

uint256 internal constant Q = 21888242871839275222246405745257275088696311157297823662689037894645226208583;

Functions

__Groth16Verifier_init

Initializes the Groth16Verifier module.

Must be called inside a pre/postInitializer block. Registers IGroth16Verifier for ERC-165.

function __Groth16Verifier_init() internal;

registerInterface

Registers support for the IGroth16Verifier interface via ERC-165.

function registerInterface() internal;

verifyProof

Verifies a Groth16 proof. See IGroth16Verifier.verifyProof.

Returns false on any cryptographic invalidity / out-of-range value; reverts only on a key/input arity mismatch. vk is never authenticated, so the caller MUST pin it (see KEY PINNING on IGroth16Verifier).

function verifyProof(
        IGroth16Verifier.VerifyingKey calldata vk,
        IGroth16Verifier.Proof calldata proof,
        uint256[] calldata input
    ) internal view returns (bool);

Parameters

Name	Type	Description
vk	`IGroth16Verifier.VerifyingKey`
proof	`IGroth16Verifier.Proof`
input	`uint256[]`

Returns

Name	Type	Description
<none>	`bool`

_ecMul

G1 scalar multiplication via the ecMul precompile (0x07): (x, y) · s.

function _ecMul(uint256 x, uint256 y, uint256 s) private view returns (uint256 rx, uint256 ry, bool ok);

Parameters

Name	Type	Description
x	`uint256`
y	`uint256`
s	`uint256`

Returns

Name	Type	Description
rx	`uint256`
ry	`uint256`
ok	`bool`

_ecAdd

G1 point addition via the ecAdd precompile (0x06): (x1, y1) + (x2, y2).

function _ecAdd(uint256 x1, uint256 y1, uint256 x2, uint256 y2)
        private
        view
        returns (uint256 rx, uint256 ry, bool ok);

Parameters

Name	Type	Description
x1	`uint256`
y1	`uint256`
x2	`uint256`
y2	`uint256`

Returns

Name	Type	Description
rx	`uint256`
ry	`uint256`
ok	`bool`

_pairing

BN254 pairing check via the ecPairing precompile (0x08) over 4 pairs (768 bytes).

function _pairing(uint256[24] memory buf) private view returns (bool);

Parameters

Name	Type	Description
buf	`uint256[24]`

Returns

Name	Type	Description
<none>	`bool`	True iff the staticcall succeeds and the pairing product is 1.