PlonkVerifierLib

Title: PlonkVerifierLib

Authors: David Dada <daveproxy80@gmail.com> (https://github.com/dadadave80), Modified from snarkjs (https://github.com/iden3/snarkjs)

Library implementing a generic PLONK verifier over BN254 (alt_bn128): the verifying key is a parameter, so one deployment verifies proofs for any circuit. Faithful port of the snarkjs (iden3) PLONK verifier (eprint 2019/953) — keccak256 Fiat-Shamir transcript, Lagrange evaluation at xi, and the batched KZG pairing check.

Three-layer pattern: this library holds the logic; the stateless PlonkVerifier facet forwards to it. Stateless — it only registers IPlonkVerifier for ERC-165.

Constants

Q

BN254 scalar field modulus r.

uint256 internal constant Q = 21888242871839275222246405745257275088548364400416034343698204186575808495617;

QF

BN254 base field modulus q — point coordinates must be < QF.

uint256 internal constant QF = 21888242871839275222246405745257275088696311157297823662689037894645226208583;

G2_X1

uint256 internal constant G2_X1 = 11559732032986387107991004021392285783925812861821192530917403151452391805634;

G2_X0

uint256 internal constant G2_X0 = 10857046999023057135944570762232829481370756359578518086990519993285655852781;

G2_Y1

uint256 internal constant G2_Y1 = 4082367875863433681332203403145435568316851327593401208105741076214120093531;

G2_Y0

uint256 internal constant G2_Y0 = 8495653923123431417604973247489272438418190587263600148770280649306958101930;

Functions

__PlonkVerifier_init

Initializes the PlonkVerifier module.

Must be called inside a pre/postInitializer block. Registers IPlonkVerifier for ERC-165.

function __PlonkVerifier_init() internal;

registerInterface

Registers support for the IPlonkVerifier interface via ERC-165.

function registerInterface() internal;

verifyProof

Verifies a PLONK proof. See IPlonkVerifier.verifyProof.

The vk checks below are structural (domain size, on-curve points), not authentication: a malicious key passes them, so the caller MUST pin it (see KEY PINNING on IPlonkVerifier).

function verifyProof(
        IPlonkVerifier.VerifyingKey calldata vk,
        IPlonkVerifier.Proof calldata proof,
        uint256[] calldata input
    ) internal view returns (bool);

Parameters

Name	Type	Description
vk	`IPlonkVerifier.VerifyingKey`
proof	`IPlonkVerifier.Proof`
input	`uint256[]`

Returns

Name	Type	Description
<none>	`bool`

_beta

beta = H(Qm,Ql,Qr,Qo,Qc,S1,S2,S3, input..., A,B,C). Chunked to stay within the stack limit.

function _beta(
        IPlonkVerifier.VerifyingKey calldata vk,
        IPlonkVerifier.Proof calldata proof,
        uint256[] calldata input
    ) private pure returns (uint256);

Parameters

Name	Type	Description
vk	`IPlonkVerifier.VerifyingKey`
proof	`IPlonkVerifier.Proof`
input	`uint256[]`

Returns

Name	Type	Description
<none>	`uint256`

_challenges

function _challenges(
        St memory st,
        IPlonkVerifier.VerifyingKey calldata vk,
        IPlonkVerifier.Proof calldata proof,
        uint256[] calldata input
    ) private pure;

Parameters

Name	Type	Description
st	`St`
vk	`IPlonkVerifier.VerifyingKey`
proof	`IPlonkVerifier.Proof`
input	`uint256[]`

_evaluations

function _evaluations(
        St memory st,
        IPlonkVerifier.VerifyingKey calldata vk,
        IPlonkVerifier.Proof calldata proof,
        uint256[] calldata input
    ) private view;

Parameters

Name	Type	Description
st	`St`
vk	`IPlonkVerifier.VerifyingKey`
proof	`IPlonkVerifier.Proof`
input	`uint256[]`

_lagrange

L[i] = (wᵢ·zh) / (n·(ξ - wᵢ)), w₁=1, wᵢ₊₁=wᵢ·ω; accumulates PI = -Σ inputᵢ·L[i+1] into st.

function _lagrange(St memory st, IPlonkVerifier.VerifyingKey calldata vk, uint256[] calldata input) private view;

Parameters

Name	Type	Description
st	`St`
vk	`IPlonkVerifier.VerifyingKey`
input	`uint256[]`

_calcR0

r0 = pi - l1·α² - α·eval_zw·(a+β·s1+γ)(b+β·s2+γ)(c+γ).

function _calcR0(St memory st, IPlonkVerifier.Proof calldata proof) private pure returns (uint256);

Parameters

Name	Type	Description
st	`St`
proof	`IPlonkVerifier.Proof`

Returns

Name	Type	Description
<none>	`uint256`

_calcD

function _calcD(St memory st, IPlonkVerifier.VerifyingKey calldata vk, IPlonkVerifier.Proof calldata proof)
        private
        view
        returns (uint256[2] memory d);

Parameters

Name	Type	Description
st	`St`
vk	`IPlonkVerifier.VerifyingKey`
proof	`IPlonkVerifier.Proof`

Returns

Name	Type	Description
d	`uint256[2]`

_d2Coeff

function _d2Coeff(St memory st, IPlonkVerifier.VerifyingKey calldata vk, IPlonkVerifier.Proof calldata proof)
        private
        pure
        returns (uint256);

Parameters

Name	Type	Description
st	`St`
vk	`IPlonkVerifier.VerifyingKey`
proof	`IPlonkVerifier.Proof`

Returns

Name	Type	Description
<none>	`uint256`

_d3Coeff

function _d3Coeff(St memory st, IPlonkVerifier.Proof calldata proof) private pure returns (uint256);

Parameters

Name	Type	Description
st	`St`
proof	`IPlonkVerifier.Proof`

Returns

Name	Type	Description
<none>	`uint256`

_calcF

function _calcF(
        St memory st,
        IPlonkVerifier.VerifyingKey calldata vk,
        IPlonkVerifier.Proof calldata proof,
        uint256[2] memory d
    ) private view returns (uint256[2] memory f);

Parameters

Name	Type	Description
st	`St`
vk	`IPlonkVerifier.VerifyingKey`
proof	`IPlonkVerifier.Proof`
d	`uint256[2]`

Returns

Name	Type	Description
f	`uint256[2]`

_calcE

function _calcE(St memory st, IPlonkVerifier.Proof calldata proof) private view returns (uint256[2] memory);

Parameters

Name	Type	Description
st	`St`
proof	`IPlonkVerifier.Proof`

Returns

Name	Type	Description
<none>	`uint256[2]`

_validPairing

function _validPairing(
        St memory st,
        IPlonkVerifier.VerifyingKey calldata vk,
        IPlonkVerifier.Proof calldata proof,
        uint256[2] memory e,
        uint256[2] memory f
    ) private view returns (bool);

Parameters

Name	Type	Description
st	`St`
vk	`IPlonkVerifier.VerifyingKey`
proof	`IPlonkVerifier.Proof`
e	`uint256[2]`
f	`uint256[2]`

Returns

Name	Type	Description
<none>	`bool`

_calcB1

B1 = ξ·Wxi + (u·ξ·ω)·Wxiw + F - E.

function _calcB1(
        St memory st,
        IPlonkVerifier.VerifyingKey calldata vk,
        IPlonkVerifier.Proof calldata proof,
        uint256[2] memory e,
        uint256[2] memory f
    ) private view returns (uint256[2] memory b1);

Parameters

Name	Type	Description
st	`St`
vk	`IPlonkVerifier.VerifyingKey`
proof	`IPlonkVerifier.Proof`
e	`uint256[2]`
f	`uint256[2]`

Returns

Name	Type	Description
b1	`uint256[2]`

_pairCheck

e(-A1, X_2) · e(B1, [1]_2) == 1 via the pairing precompile (0x08).

function _pairCheck(uint256[2] memory a1neg, uint256[2][2] calldata x2, uint256[2] memory b1)
        private
        view
        returns (bool);

Parameters

Name	Type	Description
a1neg	`uint256[2]`
x2	`uint256[2][2]`
b1	`uint256[2]`

Returns

Name	Type	Description
<none>	`bool`

_wellConstructed

Checks every proof commitment is a valid BN254 G1 point (on-curve or the infinity (0,0)).

function _wellConstructed(IPlonkVerifier.Proof calldata p) private pure returns (bool);

Parameters

Name	Type	Description
p	`IPlonkVerifier.Proof`

Returns

Name	Type	Description
<none>	`bool`

_vkWellFormed

Checks every verifying-key G1 commitment is a valid BN254 point. The G2 point x2 is validated implicitly by the pairing precompile (a bad x2 makes the pairing return false).

function _vkWellFormed(IPlonkVerifier.VerifyingKey calldata vk) private pure returns (bool);

Parameters

Name	Type	Description
vk	`IPlonkVerifier.VerifyingKey`

Returns

Name	Type	Description
<none>	`bool`

_onCurve

BN254 G1 on-curve test: y² == x³ + 3 (mod QF), with (0,0) the valid point at infinity.

function _onCurve(uint256[2] calldata pt) private pure returns (bool);

Parameters

Name	Type	Description
pt	`uint256[2]`

Returns

Name	Type	Description
<none>	`bool`

_cm

Copies a calldata G1 point into memory (Solidity overloads ignore data location).

function _cm(uint256[2] calldata p) private pure returns (uint256[2] memory r);

Parameters

Name	Type	Description
p	`uint256[2]`

Returns

Name	Type	Description
r	`uint256[2]`

_mul

G1 scalar multiplication via the ecMul precompile (0x07). Reverts on precompile failure.

function _mul(uint256[2] memory p, uint256 s) private view returns (uint256[2] memory r);

Parameters

Name	Type	Description
p	`uint256[2]`
s	`uint256`

Returns

Name	Type	Description
r	`uint256[2]`

_add

G1 point addition via the ecAdd precompile (0x06). Reverts on precompile failure.

function _add(uint256[2] memory p1, uint256[2] memory p2) private view returns (uint256[2] memory r);

Parameters

Name	Type	Description
p1	`uint256[2]`
p2	`uint256[2]`

Returns

Name	Type	Description
r	`uint256[2]`

_sub

G1 subtraction: p1 - p2 = p1 + (-p2).

function _sub(uint256[2] memory p1, uint256[2] memory p2) private view returns (uint256[2] memory);

Parameters

Name	Type	Description
p1	`uint256[2]`
p2	`uint256[2]`

Returns

Name	Type	Description
<none>	`uint256[2]`

_neg

G1 negation: (x, QF - y), with (x, 0) mapping to itself.

function _neg(uint256[2] memory p) private pure returns (uint256[2] memory);

Parameters

Name	Type	Description
p	`uint256[2]`

Returns

Name	Type	Description
<none>	`uint256[2]`

_inv

Modular inverse mod Q via Fermat (a^(Q-2)) using the modexp precompile (0x05). Reverts on precompile failure.

function _inv(uint256 a) private view returns (uint256 r);

Parameters

Name	Type	Description
a	`uint256`

Returns

Name	Type	Description
r	`uint256`

Structs

St

Scratch space for challenges and derived scalars (memory to avoid stack-too-deep).

struct St {
        uint256 beta;
        uint256 gamma;
        uint256 alpha;
        uint256 xi;
        uint256 v1;
        uint256 v2;
        uint256 v3;
        uint256 v4;
        uint256 v5;
        uint256 u;
        uint256 xin;
        uint256 zh;
        uint256 l1;
        uint256 pi;
        uint256 r0;
    }

Properties

Name	Type	Description
beta	`uint256`
gamma	`uint256`
alpha	`uint256`
xi	`uint256`
v1	`uint256`
v2	`uint256`
v3	`uint256`
v4	`uint256`
v5	`uint256`
u	`uint256`
xin	`uint256`
zh	`uint256`
l1	`uint256`
pi	`uint256`
r0	`uint256`