@solarity/zkit 0.2.5 → 0.3.0-rc.0

package/dist/core/templates/verifier_plonk.sol.ejs

@@ -0,0 +1,681 @@
+// SPDX-License-Identifier: MIT
+
+/* AUTOGENERATED FILE BY HARDHAT-ZKIT. DO NOT EDIT. */
+
+pragma solidity >=0.7.0 <0.9.0;
+
+contract <%=verifier_id%> {
+    // Omega
+    uint256 constant W1 = <%=w%>;    
+    // Scalar field size
+    uint256 constant Q  = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
+    // Base field size
+    uint256 constant QF = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
+    
+    // [1]_1
+    uint256 constant G1_X = 1;
+    uint256 constant G1_Y = 2;
+    // [1]_2
+    uint256 constant G2_X1 = 10857046999023057135944570762232829481370756359578518086990519993285655852781;
+    uint256 constant G2_X2 = 11559732032986387107991004021392285783925812861821192530917403151452391805634;
+    uint256 constant G2_Y1 = 8495653923123431417604973247489272438418190587263600148770280649306958101930;
+    uint256 constant G2_Y2 = 4082367875863433681332203403145435568316851327593401208105741076214120093531;
+    
+    // Verification Key data
+    uint32 constant N          = <%=2**power%>;
+    uint16 constant N_PUBLIC   = <%=nPublic%>;
+    uint16 constant N_LAGRANGE = <%=Math.max(nPublic, 1)%>;
+    
+    uint256 constant QM_X  = <%=Qm[0]%>;
+    uint256 constant QM_Y  = <%=Qm[0] == "0" ? "0" : Qm[1]%>;
+    uint256 constant QL_X  = <%=Ql[0]%>;
+    uint256 constant QL_Y  = <%=Ql[0] == "0" ? "0" : Ql[1]%>;
+    uint256 constant QR_X  = <%=Qr[0]%>;
+    uint256 constant QR_Y  = <%=Qr[0] == "0" ? "0" : Qr[1]%>;
+    uint256 constant QO_X  = <%=Qo[0]%>;
+    uint256 constant QO_Y  = <%=Qo[0] == "0" ? "0" : Qo[1]%>;
+    uint256 constant QC_X  = <%=Qc[0]%>;
+    uint256 constant QC_Y  = <%=Qc[0] == "0" ? "0" : Qc[1]%>;
+    uint256 constant S1_X  = <%=S1[0]%>;
+    uint256 constant S1_Y  = <%=S1[0] == "0" ? "0" : S1[1]%>;
+    uint256 constant S2_X  = <%=S2[0]%>;
+    uint256 constant S2_Y  = <%=S2[0] == "0" ? "0" : S2[1]%>;
+    uint256 constant S3_X  = <%=S3[0]%>;
+    uint256 constant S3_Y  = <%=S3[0] == "0" ? "0" : S3[1]%>;
+    uint256 constant K1    = <%=k1%>;
+    uint256 constant K2    = <%=k2%>;
+    uint256 constant X2_X1 = <%=X_2[0][0]%>;
+    uint256 constant X2_X2 = <%=X_2[0][1]%>;
+    uint256 constant X2_Y1 = <%=X_2[1][0]%>;
+    uint256 constant X2_Y2 = <%=X_2[1][1]%>;
+    
+    // Proof calldata
+    // Byte offset of every parameter of the calldata
+    // Polynomial commitments
+    uint16 constant P_A       = 4 + 0;
+    uint16 constant P_B       = 4 + 64;
+    uint16 constant P_C       = 4 + 128;
+    uint16 constant P_Z       = 4 + 192;
+    uint16 constant P_T1      = 4 + 256;
+    uint16 constant P_T2      = 4 + 320;
+    uint16 constant P_T3      = 4 + 384;
+    uint16 constant P_WX_I    = 4 + 448;
+    uint16 constant P_WX_IW   = 4 + 512;
+    // Opening evaluations
+    uint16 constant P_EVAL_A  = 4 + 576;
+    uint16 constant P_EVAL_B  = 4 + 608;
+    uint16 constant P_EVAL_C  = 4 + 640;
+    uint16 constant P_EVAL_S1 = 4 + 672;
+    uint16 constant P_EVAL_S2 = 4 + 704;
+    uint16 constant P_EVAL_ZW = 4 + 736;
+
+    // Memory data
+    // Challenges
+    uint16 constant P_ALPHA   = 0;
+    uint16 constant P_BETA    = 32;
+    uint16 constant P_GAMMA   = 64;
+    uint16 constant P_XI      = 96;
+    uint16 constant P_XIN     = 128;
+    uint16 constant P_BETA_XI = 160;
+    uint16 constant P_V1      = 192;
+    uint16 constant P_V2      = 224;
+    uint16 constant P_V3      = 256;
+    uint16 constant P_V4      = 288;
+    uint16 constant P_V5      = 320;
+    uint16 constant P_U       = 352;
+    
+    uint16 constant P_PI      = 384;
+    uint16 constant P_EVAL_R0 = 416;
+    uint16 constant P_D       = 448;
+    uint16 constant P_F       = 512;
+    uint16 constant P_E       = 576;
+    uint16 constant P_TMP     = 640;
+    uint16 constant P_ALPHA2  = 704;
+    uint16 constant P_ZH      = 736;
+    uint16 constant P_ZH_INV  = 768;
+
+    <% for (let i=1; i<=Math.max(nPublic, 1); i++) { %>
+    uint16 constant P_EVAL_L<%=i%> = <%=768+i*32%>;
+    <% } %>
+    <% let pLastMem = 800+32*Math.max(nPublic,1) %>
+    uint16 constant LAST_MEM = <%=pLastMem%>;
+
+    function verifyProof(uint256[24] calldata proof_, uint256[<%=nPublic%>] calldata pubSignals_) public view returns (bool) {
+        assembly {
+            function inverse(a, q) -> inv {
+                let t := 0     
+                let newt := 1
+                let r := q     
+                let newr := a
+                let quotient
+                let aux
+                
+                for { } newr { } {
+                    quotient := sdiv(r, newr)
+                    aux := sub(t, mul(quotient, newt))
+                    t:= newt
+                    newt:= aux
+                    
+                    aux := sub(r,mul(quotient, newr))
+                    r := newr
+                    newr := aux
+                }
+                
+                if gt(r, 1) { revert(0,0) }
+                if slt(t, 0) { t:= add(t, q) }
+
+                inv := t
+            }
+
+            function inverseArray(pVals, n) {
+                let pAux := mload(0x40)     // Point to the next free position
+                let pIn := pVals
+                let lastPIn := add(pVals, mul(n, 32))  // Read n elemnts
+                let acc := mload(pIn)       // Read the first element
+                pIn := add(pIn, 32)         // Point to the second element
+                let inv
+    
+                for { } lt(pIn, lastPIn) { 
+                    pAux := add(pAux, 32) 
+                    pIn := add(pIn, 32)
+                } 
+                {
+                    mstore(pAux, acc)
+                    acc := mulmod(acc, mload(pIn), Q)
+                }
+                acc := inverse(acc, Q)
+                
+                // At this point pAux pint to the next free position we substract 1 to point to the last used
+                pAux := sub(pAux, 32)
+                // pIn points to the n+1 element, we substract to point to n
+                pIn := sub(pIn, 32)
+                lastPIn := pVals  // We don't process the first element 
+                for { } gt(pIn, lastPIn) { 
+                    pAux := sub(pAux, 32) 
+                    pIn := sub(pIn, 32)
+                } 
+                {
+                    inv := mulmod(acc, mload(pAux), Q)
+                    acc := mulmod(acc, mload(pIn), Q)
+                    mstore(pIn, inv)
+                }
+                // pIn points to first element, we just set it.
+                mstore(pIn, acc)
+            }
+            
+            function checkField(v) {
+                if iszero(lt(v, Q)) {
+                    mstore(0, 0)
+                    return(0,0x20)
+                }
+            }
+            
+            function checkInput() {
+                checkField(calldataload(P_EVAL_A))
+                checkField(calldataload(P_EVAL_B))
+                checkField(calldataload(P_EVAL_C))
+                checkField(calldataload(P_EVAL_S1))
+                checkField(calldataload(P_EVAL_S2))
+                checkField(calldataload(P_EVAL_ZW))
+            }
+            
+            function calculateChallenges(pMem, pPublic) {
+                let beta
+                let aux
+
+                let mIn := mload(0x40)     // Pointer to the next free memory position
+
+                // Compute challenge.beta & challenge.gamma
+                mstore(mIn, QM_X)
+                mstore(add(mIn, 32), QM_Y)
+                mstore(add(mIn, 64), QL_X)
+                mstore(add(mIn, 96), QL_Y)
+                mstore(add(mIn, 128), QR_X)
+                mstore(add(mIn, 160), QR_Y)
+                mstore(add(mIn, 192), QO_X)
+                mstore(add(mIn, 224), QO_Y)
+                mstore(add(mIn, 256), QC_X)
+                mstore(add(mIn, 288), QC_Y)
+                mstore(add(mIn, 320), S1_X)
+                mstore(add(mIn, 352), S1_Y)
+                mstore(add(mIn, 384), S2_X)
+                mstore(add(mIn, 416), S2_Y)
+                mstore(add(mIn, 448), S3_X)
+                mstore(add(mIn, 480), S3_Y)
+
+                <%for (let i=0; i<nPublic;i++) {%>
+                mstore(add(mIn, <%= 512 + i*32 %>), calldataload(add(pPublic, <%=i*32%>)))
+                <%}%>
+                mstore(add(mIn, <%= 512 + nPublic*32 + 0 %> ), calldataload(P_A))
+                mstore(add(mIn, <%= 512 + nPublic*32 + 32 %> ), calldataload(add(P_A, 32)))
+                mstore(add(mIn, <%= 512 + nPublic*32 + 64 %> ), calldataload(P_B))
+                mstore(add(mIn, <%= 512 + nPublic*32 + 96 %> ), calldataload(add(P_B, 32)))
+                mstore(add(mIn, <%= 512 + nPublic*32 + 128 %> ), calldataload(P_C))
+                mstore(add(mIn, <%= 512 + nPublic*32 + 160 %> ), calldataload(add(P_C, 32)))
+                
+                beta := mod(keccak256(mIn, <%= 704 + 32 * nPublic %>), Q) 
+                mstore(add(pMem, P_BETA), beta)
+
+                // challenges.gamma
+                mstore(add(pMem, P_GAMMA), mod(keccak256(add(pMem, P_BETA), 32), Q))
+                
+                // challenges.alpha
+                mstore(mIn, mload(add(pMem, P_BETA)))
+                mstore(add(mIn, 32), mload(add(pMem, P_GAMMA)))
+                mstore(add(mIn, 64), calldataload(P_Z))
+                mstore(add(mIn, 96), calldataload(add(P_Z, 32)))
+
+                aux := mod(keccak256(mIn, 128), Q)
+                mstore(add(pMem, P_ALPHA), aux)
+                mstore(add(pMem, P_ALPHA2), mulmod(aux, aux, Q))
+
+                // challenges.xi
+                mstore(mIn, aux)
+                mstore(add(mIn, 32),  calldataload(P_T1))
+                mstore(add(mIn, 64),  calldataload(add(P_T1, 32)))
+                mstore(add(mIn, 96),  calldataload(P_T2))
+                mstore(add(mIn, 128), calldataload(add(P_T2, 32)))
+                mstore(add(mIn, 160), calldataload(P_T3))
+                mstore(add(mIn, 192), calldataload(add(P_T3, 32)))
+
+                aux := mod(keccak256(mIn, 224), Q)
+                mstore( add(pMem, P_XI), aux)
+
+                // challenges.v
+                mstore(mIn, aux)
+                mstore(add(mIn, 32),  calldataload(P_EVAL_A))
+                mstore(add(mIn, 64),  calldataload(P_EVAL_B))
+                mstore(add(mIn, 96),  calldataload(P_EVAL_C))
+                mstore(add(mIn, 128), calldataload(P_EVAL_S1))
+                mstore(add(mIn, 160), calldataload(P_EVAL_S2))
+                mstore(add(mIn, 192), calldataload(P_EVAL_ZW))
+
+                let v1 := mod(keccak256(mIn, 224), Q)
+                mstore(add(pMem, P_V1), v1)
+
+                // challenges.beta * challenges.xi
+                mstore(add(pMem, P_BETA_XI), mulmod(beta, aux, Q))
+
+                // challenges.xi^n
+                <%for (let i=0; i<power;i++) {%>
+                aux:= mulmod(aux, aux, Q)
+                <%}%>
+                mstore(add(pMem, P_XIN), aux)
+
+                // Zh
+                aux:= mod(add(sub(aux, 1), Q), Q)
+                mstore(add(pMem, P_ZH), aux)
+                mstore(add(pMem, P_ZH_INV), aux)  // We will invert later together with lagrange pols
+                                
+                // challenges.v^2, challenges.v^3, challenges.v^4, challenges.v^5
+                aux := mulmod(v1, v1,  Q)
+                mstore(add(pMem, P_V2), aux)
+                aux := mulmod(aux, v1, Q)
+                mstore(add(pMem, P_V3), aux)
+                aux := mulmod(aux, v1, Q)
+                mstore(add(pMem, P_V4), aux)
+                aux := mulmod(aux, v1, Q)
+                mstore(add(pMem, P_V5), aux)
+
+                // challenges.u
+                mstore(mIn, calldataload(P_WX_I))
+                mstore(add(mIn, 32), calldataload(add(P_WX_I, 32)))
+                mstore(add(mIn, 64), calldataload(P_WX_IW))
+                mstore(add(mIn, 96), calldataload(add(P_WX_IW, 32)))
+
+                mstore(add(pMem, P_U), mod(keccak256(mIn, 128), Q))
+            }
+            
+            function calculateLagrange(pMem) {
+                let w := 1                
+                <% for (let i=1; i<=Math.max(nPublic, 1); i++) { %>
+                mstore(
+                    add(pMem, P_EVAL_L<%=i%>), 
+                    mulmod(
+                        N, 
+                        mod(
+                            add(
+                                sub(
+                                    mload(add(pMem, P_XI)), 
+                                    w
+                                ), 
+                                Q
+                            ),
+                            Q
+                        ), 
+                        Q
+                    )
+                )
+                <% if (i<Math.max(nPublic, 1)) { %>
+                w := mulmod(w, W1, Q)
+                <% } %>
+                <% } %>
+                
+                inverseArray(add(pMem, P_ZH_INV), <%=Math.max(nPublic, 1)+1%> )
+                
+                let zh := mload(add(pMem, P_ZH))
+                w := 1
+                <% for (let i=1; i<=Math.max(nPublic, 1); i++) { %>
+                <% if (i==1) { %>
+                mstore(
+                    add(pMem, P_EVAL_L1 ), 
+                    mulmod(
+                        mload(add(pMem, P_EVAL_L1 )),
+                        zh,
+                        Q
+                    )
+                )
+                <% } else { %>
+                mstore(
+                    add(pMem, P_EVAL_L<%=i%>), 
+                    mulmod(
+                        w,
+                        mulmod(
+                            mload(add(pMem, P_EVAL_L<%=i%>)),
+                            zh,
+                            Q
+                        ),
+                        Q
+                    )
+                )
+                <% } %>
+                <% if (i<Math.max(nPublic, 1)) { %>
+                w := mulmod(w, W1, Q)
+                <% } %>
+                <% } %>
+
+
+            }
+            
+            function calculatePI(pMem, pPub) {
+                let pl := 0
+                
+                <% for (let i=0; i<nPublic; i++) { %> 
+                pl := mod(
+                    add(
+                        sub(
+                            pl,  
+                            mulmod(
+                                mload(add(pMem, P_EVAL_L<%=i+1%>)),
+                                calldataload(add(pPub, <%=i*32%>)),
+                                Q
+                            )
+                        ),
+                        Q
+                    ),
+                    Q
+                )
+                <% } %>
+                
+                mstore(add(pMem, P_PI), pl)
+            }
+
+            function calculateR0(pMem) {
+                let e1 := mload(add(pMem, P_PI))
+
+                let e2 :=  mulmod(mload(add(pMem, P_EVAL_L1)), mload(add(pMem, P_ALPHA2)), Q)
+
+                let e3a := addmod(
+                    calldataload(P_EVAL_A),
+                    mulmod(mload(add(pMem, P_BETA)), calldataload(P_EVAL_S1), Q),
+                    Q)
+                e3a := addmod(e3a, mload(add(pMem, P_GAMMA)), Q)
+
+                let e3b := addmod(
+                    calldataload(P_EVAL_B),
+                    mulmod(mload(add(pMem, P_BETA)), calldataload(P_EVAL_S2), Q),
+                    Q)
+                e3b := addmod(e3b, mload(add(pMem, P_GAMMA)), Q)
+
+                let e3c := addmod(
+                    calldataload(P_EVAL_C),
+                    mload(add(pMem, P_GAMMA)),
+                    Q)
+
+                let e3 := mulmod(mulmod(e3a, e3b, Q), e3c, Q)
+                e3 := mulmod(e3, calldataload(P_EVAL_ZW), Q)
+                e3 := mulmod(e3, mload(add(pMem, P_ALPHA)), Q)
+            
+                let r0 := addmod(e1, mod(sub(Q, e2), Q), Q)
+                r0 := addmod(r0, mod(sub(Q, e3), Q), Q)
+                
+                mstore(add(pMem, P_EVAL_R0) , r0)
+            }
+            
+            function g1_set(pR, pP) {
+                mstore(pR, mload(pP))
+                mstore(add(pR, 32), mload(add(pP,32)))
+            }   
+
+            function g1_setC(pR, x, y) {
+                mstore(pR, x)
+                mstore(add(pR, 32), y)
+            }
+
+            function g1_calldataSet(pR, pP) {
+                mstore(pR,          calldataload(pP))
+                mstore(add(pR, 32), calldataload(add(pP, 32)))
+            }
+
+            function g1_acc(pR, pP) {
+                let mIn := mload(0x40)
+                mstore(mIn, mload(pR))
+                mstore(add(mIn,32), mload(add(pR, 32)))
+                mstore(add(mIn,64), mload(pP))
+                mstore(add(mIn,96), mload(add(pP, 32)))
+
+                let success := staticcall(sub(gas(), 2000), 6, mIn, 128, pR, 64)
+                
+                if iszero(success) {
+                    mstore(0, 0)
+                    return(0,0x20)
+                }
+            }
+
+            function g1_mulAcc(pR, pP, s) {
+                let success
+                let mIn := mload(0x40)
+                mstore(mIn, mload(pP))
+                mstore(add(mIn,32), mload(add(pP, 32)))
+                mstore(add(mIn,64), s)
+
+                success := staticcall(sub(gas(), 2000), 7, mIn, 96, mIn, 64)
+                
+                if iszero(success) {
+                    mstore(0, 0)
+                    return(0,0x20)
+                }
+                
+                mstore(add(mIn,64), mload(pR))
+                mstore(add(mIn,96), mload(add(pR, 32)))
+
+                success := staticcall(sub(gas(), 2000), 6, mIn, 128, pR, 64)
+                
+                if iszero(success) {
+                    mstore(0, 0)
+                    return(0,0x20)
+                }
+                
+            }
+
+            function g1_mulAccC(pR, x, y, s) {
+                let success
+                let mIn := mload(0x40)
+                mstore(mIn, x)
+                mstore(add(mIn,32), y)
+                mstore(add(mIn,64), s)
+
+                success := staticcall(sub(gas(), 2000), 7, mIn, 96, mIn, 64)
+                
+                if iszero(success) {
+                    mstore(0, 0)
+                    return(0,0x20)
+                }
+                
+                mstore(add(mIn,64), mload(pR))
+                mstore(add(mIn,96), mload(add(pR, 32)))
+
+                success := staticcall(sub(gas(), 2000), 6, mIn, 128, pR, 64)
+                
+                if iszero(success) {
+                    mstore(0, 0)
+                    return(0,0x20)
+                }
+            }
+
+            function g1_mulSetC(pR, x, y, s) {
+                let success
+                let mIn := mload(0x40)
+                mstore(mIn, x)
+                mstore(add(mIn,32), y)
+                mstore(add(mIn,64), s)
+
+                success := staticcall(sub(gas(), 2000), 7, mIn, 96, pR, 64)
+                
+                if iszero(success) {
+                    mstore(0, 0)
+                    return(0,0x20)
+                }
+            }
+
+            function g1_mulSet(pR, pP, s) {
+                g1_mulSetC(pR, mload(pP), mload(add(pP, 32)), s)
+            }
+
+            function calculateD(pMem) {
+                let _pD:= add(pMem, P_D)
+                let gamma := mload(add(pMem, P_GAMMA))
+                let mIn := mload(0x40)
+                mstore(0x40, add(mIn, 256)) // d1, d2, d3 & d4 (4*64 bytes)
+
+                g1_setC(_pD, QC_X, QC_Y)
+                g1_mulAccC(_pD, QM_X, QM_Y, mulmod(calldataload(P_EVAL_A), calldataload(P_EVAL_B), Q))
+                g1_mulAccC(_pD, QL_X, QL_Y, calldataload(P_EVAL_A))
+                g1_mulAccC(_pD, QR_X, QR_Y, calldataload(P_EVAL_B))
+                g1_mulAccC(_pD, QO_X, QO_Y, calldataload(P_EVAL_C))            
+
+                let betaxi := mload(add(pMem, P_BETA_XI))
+                let val1 := addmod(
+                    addmod(calldataload(P_EVAL_A), betaxi, Q),
+                    gamma, Q)
+
+                let val2 := addmod(
+                    addmod(
+                        calldataload(P_EVAL_B),
+                        mulmod(betaxi, K1, Q),
+                        Q), gamma, Q)
+
+                let val3 := addmod(
+                    addmod(
+                        calldataload(P_EVAL_C),
+                        mulmod(betaxi, K2, Q),
+                        Q), gamma, Q)
+
+                let d2a := mulmod(
+                    mulmod(mulmod(val1, val2, Q), val3, Q),
+                    mload(add(pMem, P_ALPHA)),
+                    Q
+                )
+
+                let d2b := mulmod(
+                    mload(add(pMem, P_EVAL_L1)),
+                    mload(add(pMem, P_ALPHA2)),
+                    Q
+                )
+
+                // We'll use mIn to save d2
+                g1_calldataSet(add(mIn, 192), P_Z)
+                g1_mulSet(
+                    mIn,
+                    add(mIn, 192),
+                    addmod(addmod(d2a, d2b, Q), mload(add(pMem, P_U)), Q))
+
+
+                val1 := addmod(
+                    addmod(
+                        calldataload(P_EVAL_A),
+                        mulmod(mload(add(pMem, P_BETA)), calldataload(P_EVAL_S1), Q),
+                        Q), gamma, Q)
+
+                val2 := addmod(
+                    addmod(
+                        calldataload(P_EVAL_B),
+                        mulmod(mload(add(pMem, P_BETA)), calldataload(P_EVAL_S2), Q),
+                        Q), gamma, Q)
+    
+                val3 := mulmod(
+                    mulmod(mload(add(pMem, P_ALPHA)), mload(add(pMem, P_BETA)), Q),
+                    calldataload(P_EVAL_ZW), Q)
+    
+
+                // We'll use mIn + 64 to save d3
+                g1_mulSetC(
+                    add(mIn, 64),
+                    S3_X,
+                    S3_Y,
+                    mulmod(mulmod(val1, val2, Q), val3, Q))
+
+                // We'll use mIn + 128 to save d4
+                g1_calldataSet(add(mIn, 128), P_T1)
+
+                g1_mulAccC(add(mIn, 128), calldataload(P_T2), calldataload(add(P_T2, 32)), mload(add(pMem, P_XIN)))
+                let xin2 := mulmod(mload(add(pMem, P_XIN)), mload(add(pMem, P_XIN)), Q)
+                g1_mulAccC(add(mIn, 128), calldataload(P_T3), calldataload(add(P_T3, 32)) , xin2)
+                
+                g1_mulSetC(add(mIn, 128), mload(add(mIn, 128)), mload(add(mIn, 160)), mload(add(pMem, P_ZH)))
+
+                mstore(add(add(mIn, 64), 32), mod(sub(QF, mload(add(add(mIn, 64), 32))), QF))
+                mstore(add(mIn, 160), mod(sub(QF, mload(add(mIn, 160))), QF))
+                g1_acc(_pD, mIn)
+                g1_acc(_pD, add(mIn, 64))
+                g1_acc(_pD, add(mIn, 128))
+            }
+            
+            function calculateF(pMem) {
+                let p := add(pMem, P_F)
+
+                g1_set(p, add(pMem, P_D))
+                g1_mulAccC(p, calldataload(P_A), calldataload(add(P_A, 32)), mload(add(pMem, P_V1)))
+                g1_mulAccC(p, calldataload(P_B), calldataload(add(P_B, 32)), mload(add(pMem, P_V2)))
+                g1_mulAccC(p, calldataload(P_C), calldataload(add(P_C, 32)), mload(add(pMem, P_V3)))
+                g1_mulAccC(p, S1_X, S1_Y, mload(add(pMem, P_V4)))
+                g1_mulAccC(p, S2_X, S2_Y, mload(add(pMem, P_V5)))
+            }
+            
+            function calculateE(pMem) {
+                let s := mod(sub(Q, mload(add(pMem, P_EVAL_R0))), Q)
+
+                s := addmod(s, mulmod(calldataload(P_EVAL_A),  mload(add(pMem, P_V1)), Q), Q)
+                s := addmod(s, mulmod(calldataload(P_EVAL_B),  mload(add(pMem, P_V2)), Q), Q)
+                s := addmod(s, mulmod(calldataload(P_EVAL_C),  mload(add(pMem, P_V3)), Q), Q)
+                s := addmod(s, mulmod(calldataload(P_EVAL_S1), mload(add(pMem, P_V4)), Q), Q)
+                s := addmod(s, mulmod(calldataload(P_EVAL_S2), mload(add(pMem, P_V5)), Q), Q)
+                s := addmod(s, mulmod(calldataload(P_EVAL_ZW), mload(add(pMem, P_U)),  Q), Q)
+
+                g1_mulSetC(add(pMem, P_E), G1_X, G1_Y, s)
+            }
+            
+            function checkPairing(pMem) -> isOk {
+                let mIn := mload(0x40)
+                mstore(0x40, add(mIn, 576)) // [0..383] = pairing data, [384..447] = P_WX_I, [448..512] = P_WX_IW
+
+                let _pWxi := add(mIn, 384)
+                let _pWxiw := add(mIn, 448)
+                let _aux := add(mIn, 512)
+
+                g1_calldataSet(_pWxi, P_WX_I)
+                g1_calldataSet(_pWxiw, P_WX_IW)
+
+                // A1
+                g1_mulSet(mIn, _pWxiw, mload(add(pMem, P_U)))
+                g1_acc(mIn, _pWxi)
+                mstore(add(mIn, 32), mod(sub(QF, mload(add(mIn, 32))), QF))
+
+                // [X]_2
+                mstore(add(mIn,64), X2_X2)
+                mstore(add(mIn,96), X2_X1)
+                mstore(add(mIn,128), X2_Y2)
+                mstore(add(mIn,160), X2_Y1)
+
+                // B1
+                g1_mulSet(add(mIn, 192), _pWxi, mload(add(pMem, P_XI)))
+
+                let s := mulmod(mload(add(pMem, P_U)), mload(add(pMem, P_XI)), Q)
+                s := mulmod(s, W1, Q)
+                g1_mulSet(_aux, _pWxiw, s)
+                g1_acc(add(mIn, 192), _aux)
+                g1_acc(add(mIn, 192), add(pMem, P_F))
+                mstore(add(pMem, add(P_E, 32)), mod(sub(QF, mload(add(pMem, add(P_E, 32)))), QF))
+                g1_acc(add(mIn, 192), add(pMem, P_E))
+
+                // [1]_2
+                mstore(add(mIn,256), G2_X2)
+                mstore(add(mIn,288), G2_X1)
+                mstore(add(mIn,320), G2_Y2)
+                mstore(add(mIn,352), G2_Y1)
+                
+                let success := staticcall(sub(gas(), 2000), 8, mIn, 384, mIn, 0x20)
+                
+                isOk := and(success, mload(mIn))
+            }
+            
+            let pMem := mload(0x40)
+            mstore(0x40, add(pMem, LAST_MEM))
+            
+            checkInput()
+            calculateChallenges(pMem, pubSignals_)
+            calculateLagrange(pMem)
+            calculatePI(pMem, pubSignals_)
+            calculateR0(pMem)
+            calculateD(pMem)
+            calculateF(pMem)
+            calculateE(pMem)
+            let isValid := checkPairing(pMem)
+   
+            mstore(0x40, sub(pMem, LAST_MEM))
+            mstore(0, isValid)
+            return(0,0x20)
+        }
+        
+    }
+}