snarkjs-algorand 0.5.0 → 0.5.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/index.cjs +866 -825
  2. package/dist/index.js +866 -825
  3. package/package.json +2 -2
package/dist/index.cjs CHANGED
@@ -884,12 +884,12 @@ var LSIG_SOURCE = `#pragma version 10
884
884
  // contracts/verifier.algo.ts::program() -> uint64:
885
885
  main:
886
886
  intcblock 96 32 0 1 384 192 288 480 576 672 768 992 864 896 928 960 1024 776 784 792 800
887
- bytecblock 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001 0x 0x01 TMPL_ROOT_OF_UNITY 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000000 TMPL_VERIFICATION_KEY
887
+ bytecblock 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001 0x 0x01 0x0000 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000000 TMPL_VERIFICATION_KEY TMPL_ROOT_OF_UNITY
888
888
  intc_2 // 0
889
- dupn 38
889
+ dupn 35
890
890
  bytec_1 // ""
891
- dupn 5
892
- // contracts/verifier.algo.ts:45
891
+ dupn 6
892
+ // contracts/verifier.algo.ts:55
893
893
  // assertMatch(Txn, { fee: 0, rekeyTo: Global.zeroAddress });
894
894
  txn Fee
895
895
  !
@@ -898,11 +898,11 @@ main:
898
898
  ==
899
899
  &&
900
900
  assert // assert target is match for conditions
901
- // contracts/verifier.algo.ts:66
901
+ // contracts/verifier.algo.ts:76
902
902
  // const proofBytes = Txn.applicationArgs(2);
903
903
  pushint 2 // 2
904
904
  txnas ApplicationArgs
905
- // contracts/verifier.algo.ts:68
905
+ // contracts/verifier.algo.ts:78
906
906
  // A: proofBytes.slice(0, 96).toFixed({ length: 96 }),
907
907
  dup
908
908
  len
@@ -929,7 +929,7 @@ main:
929
929
  intc_0 // 96
930
930
  ==
931
931
  assert // Length must be 96
932
- // contracts/verifier.algo.ts:69
932
+ // contracts/verifier.algo.ts:79
933
933
  // B: proofBytes.slice(96, 192).toFixed({ length: 96 }),
934
934
  intc 5 // 192
935
935
  dig 3
@@ -947,7 +947,7 @@ main:
947
947
  intc_0 // 96
948
948
  ==
949
949
  assert // Length must be 96
950
- // contracts/verifier.algo.ts:70
950
+ // contracts/verifier.algo.ts:80
951
951
  // C: proofBytes.slice(192, 288).toFixed({ length: 96 }),
952
952
  intc 6 // 288
953
953
  dig 4
@@ -965,7 +965,7 @@ main:
965
965
  intc_0 // 96
966
966
  ==
967
967
  assert // Length must be 96
968
- // contracts/verifier.algo.ts:71
968
+ // contracts/verifier.algo.ts:81
969
969
  // Z: proofBytes.slice(288, 384).toFixed({ length: 96 }),
970
970
  intc 4 // 384
971
971
  dig 5
@@ -983,7 +983,7 @@ main:
983
983
  intc_0 // 96
984
984
  ==
985
985
  assert // Length must be 96
986
- // contracts/verifier.algo.ts:72
986
+ // contracts/verifier.algo.ts:82
987
987
  // T1: proofBytes.slice(384, 480).toFixed({ length: 96 }),
988
988
  intc 7 // 480
989
989
  dig 6
@@ -1001,7 +1001,7 @@ main:
1001
1001
  intc_0 // 96
1002
1002
  ==
1003
1003
  assert // Length must be 96
1004
- // contracts/verifier.algo.ts:73
1004
+ // contracts/verifier.algo.ts:83
1005
1005
  // T2: proofBytes.slice(480, 576).toFixed({ length: 96 }),
1006
1006
  intc 8 // 576
1007
1007
  dig 7
@@ -1019,7 +1019,7 @@ main:
1019
1019
  intc_0 // 96
1020
1020
  ==
1021
1021
  assert // Length must be 96
1022
- // contracts/verifier.algo.ts:74
1022
+ // contracts/verifier.algo.ts:84
1023
1023
  // T3: proofBytes.slice(576, 672).toFixed({ length: 96 }),
1024
1024
  intc 9 // 672
1025
1025
  dig 8
@@ -1037,7 +1037,7 @@ main:
1037
1037
  intc_0 // 96
1038
1038
  ==
1039
1039
  assert // Length must be 96
1040
- // contracts/verifier.algo.ts:75
1040
+ // contracts/verifier.algo.ts:85
1041
1041
  // Wxi: proofBytes.slice(672, 768).toFixed({ length: 96 }),
1042
1042
  intc 10 // 768
1043
1043
  dig 9
@@ -1055,7 +1055,7 @@ main:
1055
1055
  intc_0 // 96
1056
1056
  ==
1057
1057
  assert // Length must be 96
1058
- // contracts/verifier.algo.ts:76
1058
+ // contracts/verifier.algo.ts:86
1059
1059
  // Wxiw: proofBytes.slice(768, 864).toFixed({ length: 96 }),
1060
1060
  intc 12 // 864
1061
1061
  dig 10
@@ -1073,7 +1073,7 @@ main:
1073
1073
  intc_0 // 96
1074
1074
  ==
1075
1075
  assert // Length must be 96
1076
- // contracts/verifier.algo.ts:77
1076
+ // contracts/verifier.algo.ts:87
1077
1077
  // eval_a: interpretAsArc4<Uint256>(proofBytes.slice(864, 896)),
1078
1078
  intc 13 // 896
1079
1079
  dig 11
@@ -1086,7 +1086,7 @@ main:
1086
1086
  uncover 3
1087
1087
  dig 2
1088
1088
  substring3
1089
- // contracts/verifier.algo.ts:78
1089
+ // contracts/verifier.algo.ts:88
1090
1090
  // eval_b: interpretAsArc4<Uint256>(proofBytes.slice(896, 928)),
1091
1091
  intc 14 // 928
1092
1092
  dig 12
@@ -1099,7 +1099,7 @@ main:
1099
1099
  uncover 3
1100
1100
  dig 2
1101
1101
  substring3
1102
- // contracts/verifier.algo.ts:79
1102
+ // contracts/verifier.algo.ts:89
1103
1103
  // eval_c: interpretAsArc4<Uint256>(proofBytes.slice(928, 960)),
1104
1104
  intc 15 // 960
1105
1105
  dig 13
@@ -1112,7 +1112,7 @@ main:
1112
1112
  uncover 3
1113
1113
  dig 2
1114
1114
  substring3
1115
- // contracts/verifier.algo.ts:80
1115
+ // contracts/verifier.algo.ts:90
1116
1116
  // eval_s1: interpretAsArc4<Uint256>(proofBytes.slice(960, 992)),
1117
1117
  intc 11 // 992
1118
1118
  dig 14
@@ -1125,7 +1125,7 @@ main:
1125
1125
  uncover 3
1126
1126
  dig 2
1127
1127
  substring3
1128
- // contracts/verifier.algo.ts:81
1128
+ // contracts/verifier.algo.ts:91
1129
1129
  // eval_s2: interpretAsArc4<Uint256>(proofBytes.slice(992, 1024)),
1130
1130
  intc 16 // 1024
1131
1131
  dig 15
@@ -1138,7 +1138,7 @@ main:
1138
1138
  uncover 3
1139
1139
  dig 2
1140
1140
  substring3
1141
- // contracts/verifier.algo.ts:82
1141
+ // contracts/verifier.algo.ts:92
1142
1142
  // eval_zw: interpretAsArc4<Uint256>(proofBytes.slice(1024, 1056)),
1143
1143
  pushint 1056 // 1056
1144
1144
  dig 16
@@ -1151,7 +1151,7 @@ main:
1151
1151
  uncover 3
1152
1152
  uncover 2
1153
1153
  substring3
1154
- // contracts/verifier.algo.ts:67-83
1154
+ // contracts/verifier.algo.ts:77-93
1155
1155
  // const proof: Proof = {
1156
1156
  // A: proofBytes.slice(0, 96).toFixed({ length: 96 }),
1157
1157
  // B: proofBytes.slice(96, 192).toFixed({ length: 96 }),
@@ -1198,23 +1198,23 @@ main:
1198
1198
  concat
1199
1199
  swap
1200
1200
  concat
1201
- // contracts/verifier.algo.ts:85
1201
+ // contracts/verifier.algo.ts:95
1202
1202
  // const signalBytes = Txn.applicationArgs(1);
1203
1203
  intc_3 // 1
1204
1204
  txnas ApplicationArgs
1205
1205
  dup
1206
- // contracts/verifier.algo.ts:89
1206
+ // contracts/verifier.algo.ts:99
1207
1207
  // const signals: Uint256[] = [];
1208
- pushbytes 0x0000
1208
+ bytec_3 // 0x0000
1209
1209
  swap
1210
- // contracts/verifier.algo.ts:91
1210
+ // contracts/verifier.algo.ts:100
1211
1211
  // for (const s of signalsArc4) {
1212
1212
  intc_2 // 0
1213
1213
  extract_uint16
1214
1214
  intc_2 // 0
1215
1215
 
1216
1216
  main_for_header@1:
1217
- // contracts/verifier.algo.ts:91
1217
+ // contracts/verifier.algo.ts:100
1218
1218
  // for (const s of signalsArc4) {
1219
1219
  dup
1220
1220
  dig 2
@@ -1229,7 +1229,7 @@ main_for_header@1:
1229
1229
  *
1230
1230
  intc_1 // 32
1231
1231
  extract3 // on error: index access is out of bounds
1232
- // contracts/verifier.algo.ts:92
1232
+ // contracts/verifier.algo.ts:101
1233
1233
  // signals.push(s);
1234
1234
  dig 4
1235
1235
  dup
@@ -1250,10 +1250,112 @@ main_for_header@1:
1250
1250
  b main_for_header@1
1251
1251
 
1252
1252
  main_after_for@4:
1253
- // contracts/plonk_bls12381.algo.ts:331
1254
- // return verify(decodeVk(vkBytes), signals, proof);
1253
+ // contracts/verifier.algo.ts:104
1254
+ // const lwBytes = Txn.applicationArgs(3);
1255
+ pushint 3 // 3
1256
+ txnas ApplicationArgs
1257
+ // contracts/verifier.algo.ts:112
1258
+ // xin: lwArc4.at(1),
1259
+ dup
1260
+ extract 2 32
1261
+ // contracts/verifier.algo.ts:113
1262
+ // zh: lwArc4.at(2),
1263
+ dig 1
1264
+ extract 34 32
1265
+ // contracts/verifier.algo.ts:110-114
1266
+ // const lw: LagrangeWitness = {
1267
+ // L: [] as Uint256[],
1268
+ // xin: lwArc4.at(1),
1269
+ // zh: lwArc4.at(2),
1270
+ // };
1271
+ pushbytes 0x0042
1272
+ uncover 2
1273
+ concat
1274
+ swap
1275
+ concat
1276
+ // contracts/verifier.algo.ts:99
1277
+ // const signals: Uint256[] = [];
1278
+ bytec_3 // 0x0000
1279
+ // contracts/verifier.algo.ts:110-114
1280
+ // const lw: LagrangeWitness = {
1281
+ // L: [] as Uint256[],
1282
+ // xin: lwArc4.at(1),
1283
+ // zh: lwArc4.at(2),
1284
+ // };
1285
+ concat
1286
+ bury 40
1287
+ // contracts/verifier.algo.ts:116
1288
+ // for (const v of lwArc4.at(0)) {
1289
+ dup
1290
+ intc_2 // 0
1291
+ extract_uint16
1292
+ dig 1
1293
+ len
1294
+ substring3
1295
+ dup
1296
+ bury 43
1297
+ intc_2 // 0
1298
+ extract_uint16
1299
+ bury 12
1300
+ intc_2 // 0
1301
+ bury 8
1302
+
1303
+ main_for_header@5:
1304
+ // contracts/verifier.algo.ts:116
1305
+ // for (const v of lwArc4.at(0)) {
1306
+ dig 7
1307
+ dig 12
1308
+ <
1309
+ bz main_after_for@8
1310
+ dig 41
1311
+ extract 2 0
1312
+ dig 8
1313
+ dup
1314
+ cover 2
1315
+ intc_1 // 32
1316
+ *
1317
+ intc_1 // 32
1318
+ extract3 // on error: index access is out of bounds
1319
+ // contracts/verifier.algo.ts:117
1320
+ // lw.L.push(v);
1321
+ dig 40
1322
+ dup
1323
+ intc_2 // 0
1324
+ extract_uint16
1325
+ dig 1
1326
+ len
1327
+ dig 2
1328
+ dig 2
1329
+ uncover 2
1330
+ substring3
1331
+ dup
1332
+ uncover 4
1333
+ concat // on error: max array length exceeded
1334
+ swap
1335
+ intc_2 // 0
1336
+ extract_uint16
1337
+ intc_3 // 1
1338
+ +
1339
+ itob
1340
+ extract 6 2
1341
+ replace2 0
1342
+ uncover 2
1343
+ intc_2 // 0
1344
+ uncover 3
1345
+ extract3
1346
+ swap
1347
+ concat
1348
+ bury 40
1349
+ intc_3 // 1
1350
+ +
1351
+ bury 8
1352
+ b main_for_header@5
1353
+
1354
+ main_after_for@8:
1355
+ // contracts/plonk_bls12381.algo.ts:340
1356
+ // return verify(decodeVk(vkBytes), signals, proof, lw);
1255
1357
  bytec 5 // TMPL_VERIFICATION_KEY
1256
- // contracts/plonk_bls12381.algo.ts:294
1358
+ // contracts/plonk_bls12381.algo.ts:301
1257
1359
  // Qm: vkBytes.slice(0, 96).toFixed({ length: 96 }),
1258
1360
  dup
1259
1361
  len
@@ -1280,7 +1382,7 @@ main_after_for@4:
1280
1382
  intc_0 // 96
1281
1383
  ==
1282
1384
  assert // Length must be 96
1283
- // contracts/plonk_bls12381.algo.ts:295
1385
+ // contracts/plonk_bls12381.algo.ts:302
1284
1386
  // Ql: vkBytes.slice(96, 192).toFixed({ length: 96 }),
1285
1387
  intc 5 // 192
1286
1388
  dig 3
@@ -1298,7 +1400,7 @@ main_after_for@4:
1298
1400
  intc_0 // 96
1299
1401
  ==
1300
1402
  assert // Length must be 96
1301
- // contracts/plonk_bls12381.algo.ts:296
1403
+ // contracts/plonk_bls12381.algo.ts:303
1302
1404
  // Qr: vkBytes.slice(192, 288).toFixed({ length: 96 }),
1303
1405
  intc 6 // 288
1304
1406
  dig 4
@@ -1316,7 +1418,7 @@ main_after_for@4:
1316
1418
  intc_0 // 96
1317
1419
  ==
1318
1420
  assert // Length must be 96
1319
- // contracts/plonk_bls12381.algo.ts:297
1421
+ // contracts/plonk_bls12381.algo.ts:304
1320
1422
  // Qo: vkBytes.slice(288, 384).toFixed({ length: 96 }),
1321
1423
  intc 4 // 384
1322
1424
  dig 5
@@ -1334,7 +1436,7 @@ main_after_for@4:
1334
1436
  intc_0 // 96
1335
1437
  ==
1336
1438
  assert // Length must be 96
1337
- // contracts/plonk_bls12381.algo.ts:298
1439
+ // contracts/plonk_bls12381.algo.ts:305
1338
1440
  // Qc: vkBytes.slice(384, 480).toFixed({ length: 96 }),
1339
1441
  intc 7 // 480
1340
1442
  dig 6
@@ -1352,7 +1454,7 @@ main_after_for@4:
1352
1454
  intc_0 // 96
1353
1455
  ==
1354
1456
  assert // Length must be 96
1355
- // contracts/plonk_bls12381.algo.ts:299
1457
+ // contracts/plonk_bls12381.algo.ts:306
1356
1458
  // S1: vkBytes.slice(480, 576).toFixed({ length: 96 }),
1357
1459
  intc 8 // 576
1358
1460
  dig 7
@@ -1370,7 +1472,7 @@ main_after_for@4:
1370
1472
  intc_0 // 96
1371
1473
  ==
1372
1474
  assert // Length must be 96
1373
- // contracts/plonk_bls12381.algo.ts:300
1475
+ // contracts/plonk_bls12381.algo.ts:307
1374
1476
  // S2: vkBytes.slice(576, 672).toFixed({ length: 96 }),
1375
1477
  intc 9 // 672
1376
1478
  dig 8
@@ -1388,7 +1490,7 @@ main_after_for@4:
1388
1490
  intc_0 // 96
1389
1491
  ==
1390
1492
  assert // Length must be 96
1391
- // contracts/plonk_bls12381.algo.ts:301
1493
+ // contracts/plonk_bls12381.algo.ts:308
1392
1494
  // S3: vkBytes.slice(672, 768).toFixed({ length: 96 }),
1393
1495
  intc 10 // 768
1394
1496
  dig 9
@@ -1406,7 +1508,7 @@ main_after_for@4:
1406
1508
  intc_0 // 96
1407
1509
  ==
1408
1510
  assert // Length must be 96
1409
- // contracts/plonk_bls12381.algo.ts:302
1511
+ // contracts/plonk_bls12381.algo.ts:309
1410
1512
  // power: op.btoi(vkBytes.slice(768, 776)),
1411
1513
  intc 17 // 776
1412
1514
  dig 10
@@ -1420,7 +1522,7 @@ main_after_for@4:
1420
1522
  dig 2
1421
1523
  substring3
1422
1524
  btoi
1423
- // contracts/plonk_bls12381.algo.ts:303
1525
+ // contracts/plonk_bls12381.algo.ts:310
1424
1526
  // nPublic: op.btoi(vkBytes.slice(776, 784)),
1425
1527
  intc 18 // 784
1426
1528
  dig 11
@@ -1434,7 +1536,7 @@ main_after_for@4:
1434
1536
  dig 2
1435
1537
  substring3
1436
1538
  btoi
1437
- // contracts/plonk_bls12381.algo.ts:304
1539
+ // contracts/plonk_bls12381.algo.ts:311
1438
1540
  // k1: op.btoi(vkBytes.slice(784, 792)),
1439
1541
  intc 19 // 792
1440
1542
  dig 12
@@ -1448,7 +1550,7 @@ main_after_for@4:
1448
1550
  dig 2
1449
1551
  substring3
1450
1552
  btoi
1451
- // contracts/plonk_bls12381.algo.ts:305
1553
+ // contracts/plonk_bls12381.algo.ts:312
1452
1554
  // k2: op.btoi(vkBytes.slice(792, 800)),
1453
1555
  intc 20 // 800
1454
1556
  dig 13
@@ -1462,7 +1564,7 @@ main_after_for@4:
1462
1564
  dig 2
1463
1565
  substring3
1464
1566
  btoi
1465
- // contracts/plonk_bls12381.algo.ts:306
1567
+ // contracts/plonk_bls12381.algo.ts:313
1466
1568
  // X_2: vkBytes.slice(800, 992).toFixed({ length: 192 }),
1467
1569
  intc 11 // 992
1468
1570
  dig 14
@@ -1480,7 +1582,7 @@ main_after_for@4:
1480
1582
  intc 5 // 192
1481
1583
  ==
1482
1584
  assert // Length must be 192
1483
- // contracts/plonk_bls12381.algo.ts:293-307
1585
+ // contracts/plonk_bls12381.algo.ts:300-314
1484
1586
  // return {
1485
1587
  // Qm: vkBytes.slice(0, 96).toFixed({ length: 96 }),
1486
1588
  // Ql: vkBytes.slice(96, 192).toFixed({ length: 96 }),
@@ -1526,20 +1628,277 @@ main_after_for@4:
1526
1628
  swap
1527
1629
  concat
1528
1630
  dup
1529
- bury 16
1530
- // contracts/plonk_bls12381.algo.ts:440
1631
+ bury 17
1632
+ // contracts/plonk_bls12381.algo.ts:406
1633
+ // assert(groupCheck(proof.A), "A not in G1");
1634
+ dig 5
1635
+ dup
1636
+ extract 0 96
1637
+ dup
1638
+ bury 39
1639
+ // contracts/plonk_bls12381.algo.ts:344
1640
+ // return op.EllipticCurve.subgroupCheck(op.Ec.BLS12_381g1, p);
1641
+ ec_subgroup_check BLS12_381g1
1642
+ // contracts/plonk_bls12381.algo.ts:406
1643
+ // assert(groupCheck(proof.A), "A not in G1");
1644
+ assert // A not in G1
1645
+ // contracts/plonk_bls12381.algo.ts:407
1646
+ // assert(groupCheck(proof.B), "B not in G1");
1647
+ dup
1648
+ extract 96 96
1649
+ dup
1650
+ bury 38
1651
+ // contracts/plonk_bls12381.algo.ts:344
1652
+ // return op.EllipticCurve.subgroupCheck(op.Ec.BLS12_381g1, p);
1653
+ ec_subgroup_check BLS12_381g1
1654
+ // contracts/plonk_bls12381.algo.ts:407
1655
+ // assert(groupCheck(proof.B), "B not in G1");
1656
+ assert // B not in G1
1657
+ // contracts/plonk_bls12381.algo.ts:408
1658
+ // assert(groupCheck(proof.C), "C not in G1");
1659
+ dup
1660
+ extract 192 96
1661
+ dup
1662
+ bury 37
1663
+ // contracts/plonk_bls12381.algo.ts:344
1664
+ // return op.EllipticCurve.subgroupCheck(op.Ec.BLS12_381g1, p);
1665
+ ec_subgroup_check BLS12_381g1
1666
+ // contracts/plonk_bls12381.algo.ts:408
1667
+ // assert(groupCheck(proof.C), "C not in G1");
1668
+ assert // C not in G1
1669
+ // contracts/plonk_bls12381.algo.ts:409
1670
+ // assert(groupCheck(proof.Z), "Z not in G1");
1671
+ dup
1672
+ intc 6 // 288
1673
+ intc_0 // 96
1674
+ extract3
1675
+ dup
1676
+ bury 36
1677
+ // contracts/plonk_bls12381.algo.ts:344
1678
+ // return op.EllipticCurve.subgroupCheck(op.Ec.BLS12_381g1, p);
1679
+ ec_subgroup_check BLS12_381g1
1680
+ // contracts/plonk_bls12381.algo.ts:409
1681
+ // assert(groupCheck(proof.Z), "Z not in G1");
1682
+ assert // Z not in G1
1683
+ // contracts/plonk_bls12381.algo.ts:410
1684
+ // assert(groupCheck(proof.T1), "T1 not in G1");
1685
+ dup
1686
+ intc 4 // 384
1687
+ intc_0 // 96
1688
+ extract3
1689
+ dup
1690
+ bury 35
1691
+ // contracts/plonk_bls12381.algo.ts:344
1692
+ // return op.EllipticCurve.subgroupCheck(op.Ec.BLS12_381g1, p);
1693
+ ec_subgroup_check BLS12_381g1
1694
+ // contracts/plonk_bls12381.algo.ts:410
1695
+ // assert(groupCheck(proof.T1), "T1 not in G1");
1696
+ assert // T1 not in G1
1697
+ // contracts/plonk_bls12381.algo.ts:411
1698
+ // assert(groupCheck(proof.T2), "T2 not in G1");
1699
+ dup
1700
+ intc 7 // 480
1701
+ intc_0 // 96
1702
+ extract3
1703
+ dup
1704
+ bury 34
1705
+ // contracts/plonk_bls12381.algo.ts:344
1706
+ // return op.EllipticCurve.subgroupCheck(op.Ec.BLS12_381g1, p);
1707
+ ec_subgroup_check BLS12_381g1
1708
+ // contracts/plonk_bls12381.algo.ts:411
1709
+ // assert(groupCheck(proof.T2), "T2 not in G1");
1710
+ assert // T2 not in G1
1711
+ // contracts/plonk_bls12381.algo.ts:412
1712
+ // assert(groupCheck(proof.T3), "T3 not in G1");
1713
+ dup
1714
+ intc 8 // 576
1715
+ intc_0 // 96
1716
+ extract3
1717
+ dup
1718
+ bury 41
1719
+ // contracts/plonk_bls12381.algo.ts:344
1720
+ // return op.EllipticCurve.subgroupCheck(op.Ec.BLS12_381g1, p);
1721
+ ec_subgroup_check BLS12_381g1
1722
+ // contracts/plonk_bls12381.algo.ts:412
1723
+ // assert(groupCheck(proof.T3), "T3 not in G1");
1724
+ assert // T3 not in G1
1725
+ // contracts/plonk_bls12381.algo.ts:413
1726
+ // assert(groupCheck(proof.Wxi), "Wxi not in G1");
1727
+ dup
1728
+ intc 9 // 672
1729
+ intc_0 // 96
1730
+ extract3
1731
+ dup
1732
+ bury 29
1733
+ // contracts/plonk_bls12381.algo.ts:344
1734
+ // return op.EllipticCurve.subgroupCheck(op.Ec.BLS12_381g1, p);
1735
+ ec_subgroup_check BLS12_381g1
1736
+ // contracts/plonk_bls12381.algo.ts:413
1737
+ // assert(groupCheck(proof.Wxi), "Wxi not in G1");
1738
+ assert // Wxi not in G1
1739
+ // contracts/plonk_bls12381.algo.ts:414
1740
+ // assert(groupCheck(proof.Wxiw), "Wxiw not in G1");
1741
+ dup
1742
+ intc 10 // 768
1743
+ intc_0 // 96
1744
+ extract3
1745
+ dup
1746
+ bury 40
1747
+ // contracts/plonk_bls12381.algo.ts:344
1748
+ // return op.EllipticCurve.subgroupCheck(op.Ec.BLS12_381g1, p);
1749
+ ec_subgroup_check BLS12_381g1
1750
+ // contracts/plonk_bls12381.algo.ts:414
1751
+ // assert(groupCheck(proof.Wxiw), "Wxiw not in G1");
1752
+ assert // Wxiw not in G1
1753
+ // contracts/plonk_bls12381.algo.ts:397
1754
+ // assert(inField(proof.eval_a), "eval_a not in Fr");
1755
+ dup
1756
+ intc 12 // 864
1757
+ intc_1 // 32
1758
+ extract3
1759
+ dup
1760
+ bury 25
1761
+ // contracts/plonk_bls12381.algo.ts:348
1762
+ // return value.native < BLS12_381_SCALAR_MODULUS;
1763
+ bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
1764
+ b<
1765
+ // contracts/plonk_bls12381.algo.ts:397
1766
+ // assert(inField(proof.eval_a), "eval_a not in Fr");
1767
+ assert // eval_a not in Fr
1768
+ // contracts/plonk_bls12381.algo.ts:398
1769
+ // assert(inField(proof.eval_b), "eval_b not in Fr");
1770
+ dup
1771
+ intc 13 // 896
1772
+ intc_1 // 32
1773
+ extract3
1774
+ dup
1775
+ bury 24
1776
+ // contracts/plonk_bls12381.algo.ts:348
1777
+ // return value.native < BLS12_381_SCALAR_MODULUS;
1778
+ bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
1779
+ b<
1780
+ // contracts/plonk_bls12381.algo.ts:398
1781
+ // assert(inField(proof.eval_b), "eval_b not in Fr");
1782
+ assert // eval_b not in Fr
1783
+ // contracts/plonk_bls12381.algo.ts:399
1784
+ // assert(inField(proof.eval_c), "eval_c not in Fr");
1785
+ dup
1786
+ intc 14 // 928
1787
+ intc_1 // 32
1788
+ extract3
1789
+ dup
1790
+ bury 23
1791
+ // contracts/plonk_bls12381.algo.ts:348
1792
+ // return value.native < BLS12_381_SCALAR_MODULUS;
1793
+ bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
1794
+ b<
1795
+ // contracts/plonk_bls12381.algo.ts:399
1796
+ // assert(inField(proof.eval_c), "eval_c not in Fr");
1797
+ assert // eval_c not in Fr
1798
+ // contracts/plonk_bls12381.algo.ts:400
1799
+ // assert(inField(proof.eval_s1), "eval_s1 not in Fr");
1800
+ dup
1801
+ intc 15 // 960
1802
+ intc_1 // 32
1803
+ extract3
1804
+ dup
1805
+ bury 22
1806
+ // contracts/plonk_bls12381.algo.ts:348
1807
+ // return value.native < BLS12_381_SCALAR_MODULUS;
1808
+ bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
1809
+ b<
1810
+ // contracts/plonk_bls12381.algo.ts:400
1811
+ // assert(inField(proof.eval_s1), "eval_s1 not in Fr");
1812
+ assert // eval_s1 not in Fr
1813
+ // contracts/plonk_bls12381.algo.ts:401
1814
+ // assert(inField(proof.eval_s2), "eval_s2 not in Fr");
1815
+ dup
1816
+ intc 11 // 992
1817
+ intc_1 // 32
1818
+ extract3
1819
+ dup
1820
+ bury 21
1821
+ // contracts/plonk_bls12381.algo.ts:348
1822
+ // return value.native < BLS12_381_SCALAR_MODULUS;
1823
+ bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
1824
+ b<
1825
+ // contracts/plonk_bls12381.algo.ts:401
1826
+ // assert(inField(proof.eval_s2), "eval_s2 not in Fr");
1827
+ assert // eval_s2 not in Fr
1828
+ // contracts/plonk_bls12381.algo.ts:402
1829
+ // assert(inField(proof.eval_zw), "eval_zw not in Fr");
1830
+ intc 16 // 1024
1831
+ intc_1 // 32
1832
+ extract3
1833
+ dup
1834
+ bury 19
1835
+ // contracts/plonk_bls12381.algo.ts:348
1836
+ // return value.native < BLS12_381_SCALAR_MODULUS;
1837
+ bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
1838
+ b<
1839
+ // contracts/plonk_bls12381.algo.ts:402
1840
+ // assert(inField(proof.eval_zw), "eval_zw not in Fr");
1841
+ assert // eval_zw not in Fr
1842
+ // contracts/plonk_bls12381.algo.ts:389
1843
+ // assert(signals.length === vk.nPublic, "Invalid number of public inputs");
1844
+ dig 3
1845
+ intc_2 // 0
1846
+ extract_uint16
1847
+ dup
1848
+ bury 13
1849
+ swap
1850
+ intc 17 // 776
1851
+ extract_uint64
1852
+ dup
1853
+ bury 8
1854
+ ==
1855
+ assert // Invalid number of public inputs
1856
+ intc_2 // 0
1857
+ bury 1
1858
+
1859
+ main_for_header@12:
1860
+ // contracts/plonk_bls12381.algo.ts:391
1861
+ // for (const signal of signals) {
1862
+ dup
1863
+ dig 11
1864
+ <
1865
+ bz main_after_for@14
1866
+ dig 2
1867
+ extract 2 0
1868
+ dig 1
1869
+ dup
1870
+ cover 2
1871
+ intc_1 // 32
1872
+ *
1873
+ intc_1 // 32
1874
+ extract3 // on error: index access is out of bounds
1875
+ // contracts/plonk_bls12381.algo.ts:348
1876
+ // return value.native < BLS12_381_SCALAR_MODULUS;
1877
+ bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
1878
+ b<
1879
+ // contracts/plonk_bls12381.algo.ts:392
1880
+ // assert(inField(signal), "public signal not in Fr");
1881
+ assert // public signal not in Fr
1882
+ intc_3 // 1
1883
+ +
1884
+ bury 1
1885
+ b main_for_header@12
1886
+
1887
+ main_after_for@14:
1888
+ // contracts/plonk_bls12381.algo.ts:534
1531
1889
  // let td = op.concat(vk.Qm, vk.Ql);
1890
+ dig 15
1532
1891
  dup
1533
1892
  extract 0 96
1534
1893
  dig 1
1535
1894
  extract 96 96
1536
1895
  concat
1537
- // contracts/plonk_bls12381.algo.ts:441
1896
+ // contracts/plonk_bls12381.algo.ts:535
1538
1897
  // td = op.concat(td, vk.Qr);
1539
1898
  dig 1
1540
1899
  extract 192 96
1541
1900
  concat
1542
- // contracts/plonk_bls12381.algo.ts:442
1901
+ // contracts/plonk_bls12381.algo.ts:536
1543
1902
  // td = op.concat(td, vk.Qo);
1544
1903
  dig 1
1545
1904
  intc 6 // 288
@@ -1547,60 +1906,54 @@ main_after_for@4:
1547
1906
  extract3
1548
1907
  concat
1549
1908
  dup
1550
- bury 22
1551
- // contracts/plonk_bls12381.algo.ts:443
1909
+ bury 31
1910
+ // contracts/plonk_bls12381.algo.ts:537
1552
1911
  // td = op.concat(td, vk.Qc);
1553
1912
  dig 1
1554
1913
  intc 4 // 384
1555
1914
  intc_0 // 96
1556
1915
  extract3
1557
1916
  dup
1558
- bury 27
1917
+ bury 49
1559
1918
  concat
1560
- // contracts/plonk_bls12381.algo.ts:444
1919
+ // contracts/plonk_bls12381.algo.ts:538
1561
1920
  // td = op.concat(td, vk.S1);
1562
1921
  dig 1
1563
1922
  intc 7 // 480
1564
1923
  intc_0 // 96
1565
1924
  extract3
1566
1925
  dup
1567
- bury 45
1926
+ bury 48
1568
1927
  concat
1569
- // contracts/plonk_bls12381.algo.ts:445
1928
+ // contracts/plonk_bls12381.algo.ts:539
1570
1929
  // td = op.concat(td, vk.S2);
1571
1930
  dig 1
1572
1931
  intc 8 // 576
1573
1932
  intc_0 // 96
1574
1933
  extract3
1575
1934
  dup
1576
- bury 44
1935
+ bury 47
1577
1936
  concat
1578
- // contracts/plonk_bls12381.algo.ts:446
1937
+ // contracts/plonk_bls12381.algo.ts:540
1579
1938
  // td = op.concat(td, vk.S3);
1580
1939
  swap
1581
1940
  intc 9 // 672
1582
1941
  intc_0 // 96
1583
1942
  extract3
1584
1943
  dup
1585
- bury 28
1944
+ bury 45
1586
1945
  concat
1587
- bury 18
1588
- // contracts/plonk_bls12381.algo.ts:448
1589
- // for (const signal of signals) {
1590
- dig 2
1591
- intc_2 // 0
1592
- extract_uint16
1593
- bury 11
1946
+ bury 27
1594
1947
  intc_2 // 0
1595
1948
  bury 1
1596
1949
 
1597
- main_for_header@8:
1598
- // contracts/plonk_bls12381.algo.ts:448
1950
+ main_for_header@15:
1951
+ // contracts/plonk_bls12381.algo.ts:542
1599
1952
  // for (const signal of signals) {
1600
1953
  dup
1601
1954
  dig 11
1602
1955
  <
1603
- bz main_after_for@10
1956
+ bz main_after_for@17
1604
1957
  dig 2
1605
1958
  extract 2 0
1606
1959
  dig 1
@@ -1614,178 +1967,117 @@ main_for_header@8:
1614
1967
  // return a % BLS12_381_SCALAR_MODULUS;
1615
1968
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
1616
1969
  b%
1617
- // contracts/plonk_bls12381.algo.ts:449
1970
+ // contracts/plonk_bls12381.algo.ts:543
1618
1971
  // td = op.concat(td, b32(frScalar(signal.native)));
1619
1972
  callsub b32
1620
- dig 19
1973
+ dig 28
1621
1974
  swap
1622
1975
  concat
1623
- bury 19
1976
+ bury 28
1624
1977
  intc_3 // 1
1625
1978
  +
1626
1979
  bury 1
1627
- b main_for_header@8
1980
+ b main_for_header@15
1628
1981
 
1629
- main_after_for@10:
1630
- // contracts/plonk_bls12381.algo.ts:453
1982
+ main_after_for@17:
1983
+ // contracts/plonk_bls12381.algo.ts:547
1631
1984
  // td = op.concat(td, proof.A);
1632
- dig 4
1633
- dup
1634
- extract 0 96
1635
- dup
1636
- bury 42
1637
- dig 19
1638
- swap
1985
+ dig 26
1986
+ dig 36
1639
1987
  concat
1640
- // contracts/plonk_bls12381.algo.ts:454
1988
+ // contracts/plonk_bls12381.algo.ts:548
1641
1989
  // td = op.concat(td, proof.B);
1642
- dig 1
1643
- extract 96 96
1644
- dup
1645
- bury 42
1990
+ dig 35
1646
1991
  concat
1647
- // contracts/plonk_bls12381.algo.ts:455
1992
+ // contracts/plonk_bls12381.algo.ts:549
1648
1993
  // td = op.concat(td, proof.C);
1649
- dig 1
1650
- extract 192 96
1651
- dup
1652
- bury 49
1994
+ dig 34
1653
1995
  concat
1654
- // contracts/plonk_bls12381.algo.ts:457
1996
+ // contracts/plonk_bls12381.algo.ts:551
1655
1997
  // const beta = getChallenge(td);
1656
1998
  callsub getChallenge
1657
- // contracts/plonk_bls12381.algo.ts:462
1999
+ // contracts/plonk_bls12381.algo.ts:556
1658
2000
  // const gamma = getChallenge(td);
1659
2001
  dup
1660
2002
  callsub getChallenge
1661
- // contracts/plonk_bls12381.algo.ts:469
2003
+ // contracts/plonk_bls12381.algo.ts:563
1662
2004
  // td = op.concat(td, gamma.bytes);
1663
2005
  concat
1664
2006
  dup
1665
- bury 20
1666
- // contracts/plonk_bls12381.algo.ts:470
2007
+ bury 28
2008
+ // contracts/plonk_bls12381.algo.ts:564
1667
2009
  // td = op.concat(td, proof.Z);
1668
- dig 1
1669
- intc 6 // 288
1670
- intc_0 // 96
1671
- extract3
1672
- dup
1673
- bury 30
2010
+ dig 33
1674
2011
  concat
1675
- // contracts/plonk_bls12381.algo.ts:471
2012
+ // contracts/plonk_bls12381.algo.ts:565
1676
2013
  // const alpha = getChallenge(td);
1677
2014
  callsub getChallenge
1678
2015
  dup
1679
- bury 40
1680
- // contracts/plonk_bls12381.algo.ts:478
2016
+ bury 42
2017
+ // contracts/plonk_bls12381.algo.ts:572
1681
2018
  // td = op.concat(td, proof.T1);
1682
- dig 1
1683
- intc 4 // 384
1684
- intc_0 // 96
1685
- extract3
1686
- dup
1687
- bury 48
2019
+ dig 32
1688
2020
  concat
1689
- // contracts/plonk_bls12381.algo.ts:479
2021
+ // contracts/plonk_bls12381.algo.ts:573
1690
2022
  // td = op.concat(td, proof.T2);
1691
- dig 1
1692
- intc 7 // 480
1693
- intc_0 // 96
1694
- extract3
1695
- dup
1696
- bury 47
2023
+ dig 31
1697
2024
  concat
1698
- // contracts/plonk_bls12381.algo.ts:480
2025
+ // contracts/plonk_bls12381.algo.ts:574
1699
2026
  // td = op.concat(td, proof.T3);
1700
- dig 1
1701
- intc 8 // 576
1702
- intc_0 // 96
1703
- extract3
1704
- dup
1705
- bury 46
2027
+ dig 38
1706
2028
  concat
1707
- // contracts/plonk_bls12381.algo.ts:481
2029
+ // contracts/plonk_bls12381.algo.ts:575
1708
2030
  // const xi = getChallenge(td);
1709
2031
  callsub getChallenge
1710
2032
  dup
1711
- bury 15
1712
- // contracts/plonk_bls12381.algo.ts:488
2033
+ bury 16
2034
+ // contracts/plonk_bls12381.algo.ts:582
1713
2035
  // td = op.concat(td, proof.eval_a.bytes);
1714
- dig 1
1715
- intc 12 // 864
1716
- intc_1 // 32
1717
- extract3
1718
- dup
1719
- bury 34
2036
+ dig 22
1720
2037
  concat
1721
- // contracts/plonk_bls12381.algo.ts:489
2038
+ // contracts/plonk_bls12381.algo.ts:583
1722
2039
  // td = op.concat(td, proof.eval_b.bytes);
1723
- dig 1
1724
- intc 13 // 896
1725
- intc_1 // 32
1726
- extract3
1727
- dup
1728
- bury 33
2040
+ dig 21
1729
2041
  concat
1730
- // contracts/plonk_bls12381.algo.ts:490
2042
+ // contracts/plonk_bls12381.algo.ts:584
1731
2043
  // td = op.concat(td, proof.eval_c.bytes);
1732
- dig 1
1733
- intc 14 // 928
1734
- intc_1 // 32
1735
- extract3
1736
- dup
1737
- bury 32
2044
+ dig 20
1738
2045
  concat
1739
- // contracts/plonk_bls12381.algo.ts:491
2046
+ // contracts/plonk_bls12381.algo.ts:585
1740
2047
  // td = op.concat(td, proof.eval_s1.bytes);
1741
- dig 1
1742
- intc 15 // 960
1743
- intc_1 // 32
1744
- extract3
1745
- dup
1746
- bury 37
2048
+ dig 19
1747
2049
  concat
1748
- // contracts/plonk_bls12381.algo.ts:492
2050
+ // contracts/plonk_bls12381.algo.ts:586
1749
2051
  // td = op.concat(td, proof.eval_s2.bytes);
1750
- dig 1
1751
- intc 11 // 992
1752
- intc_1 // 32
1753
- extract3
1754
- dup
1755
- bury 39
2052
+ dig 18
1756
2053
  concat
1757
- // contracts/plonk_bls12381.algo.ts:493
2054
+ // contracts/plonk_bls12381.algo.ts:587
1758
2055
  // td = op.concat(td, proof.eval_zw.bytes);
1759
- swap
1760
- intc 16 // 1024
1761
- intc_1 // 32
1762
- extract3
1763
- dup
1764
- bury 37
2056
+ dig 17
1765
2057
  concat
1766
- // contracts/plonk_bls12381.algo.ts:495
2058
+ // contracts/plonk_bls12381.algo.ts:589
1767
2059
  // const v = new FixedArray<Uint256, 6>();
1768
2060
  intc 5 // 192
1769
2061
  bzero
1770
- // contracts/plonk_bls12381.algo.ts:496
2062
+ // contracts/plonk_bls12381.algo.ts:590
1771
2063
  // v[1] = getChallenge(td); // v1
1772
2064
  swap
1773
2065
  callsub getChallenge
1774
2066
  replace2 32 // on error: index access is out of bounds
1775
- bury 16
1776
- // contracts/plonk_bls12381.algo.ts:497
2067
+ bury 25
2068
+ // contracts/plonk_bls12381.algo.ts:591
1777
2069
  // for (let i: uint64 = 2; i < 6; i++) {
1778
2070
  pushint 2 // 2
1779
2071
  bury 9
1780
2072
 
1781
- main_while_top@11:
1782
- // contracts/plonk_bls12381.algo.ts:497
2073
+ main_while_top@18:
2074
+ // contracts/plonk_bls12381.algo.ts:591
1783
2075
  // for (let i: uint64 = 2; i < 6; i++) {
1784
2076
  dig 8
1785
2077
  pushint 6 // 6
1786
2078
  <
1787
- bz main_after_while@13
1788
- // contracts/plonk_bls12381.algo.ts:498
2079
+ bz main_after_while@20
2080
+ // contracts/plonk_bls12381.algo.ts:592
1789
2081
  // v[i] = new Uint256(frMul((v[i - 1] as Uint256).native, v[1].native)); // v[i] = v1^i
1790
2082
  dig 8
1791
2083
  dup
@@ -1793,7 +2085,7 @@ main_while_top@11:
1793
2085
  -
1794
2086
  intc_1 // 32
1795
2087
  *
1796
- dig 17
2088
+ dig 26
1797
2089
  dup
1798
2090
  uncover 2
1799
2091
  intc_1 // 32
@@ -1805,7 +2097,7 @@ main_while_top@11:
1805
2097
  b*
1806
2098
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
1807
2099
  b%
1808
- // contracts/plonk_bls12381.algo.ts:498
2100
+ // contracts/plonk_bls12381.algo.ts:592
1809
2101
  // v[i] = new Uint256(frMul((v[i - 1] as Uint256).native, v[1].native)); // v[i] = v1^i
1810
2102
  dup
1811
2103
  len
@@ -1820,39 +2112,26 @@ main_while_top@11:
1820
2112
  *
1821
2113
  swap
1822
2114
  replace3 // on error: index access is out of bounds
1823
- bury 17
1824
- // contracts/plonk_bls12381.algo.ts:497
2115
+ bury 26
2116
+ // contracts/plonk_bls12381.algo.ts:591
1825
2117
  // for (let i: uint64 = 2; i < 6; i++) {
1826
2118
  intc_3 // 1
1827
2119
  +
1828
2120
  bury 9
1829
- b main_while_top@11
2121
+ b main_while_top@18
1830
2122
 
1831
- main_after_while@13:
1832
- // contracts/plonk_bls12381.algo.ts:505
1833
- // td = op.concat(td, proof.Wxi);
1834
- dig 4
1835
- dup
1836
- intc 9 // 672
1837
- intc_0 // 96
1838
- extract3
1839
- dup
1840
- cover 2
1841
- bury 21
1842
- // contracts/plonk_bls12381.algo.ts:506
2123
+ main_after_while@20:
2124
+ // contracts/plonk_bls12381.algo.ts:600
1843
2125
  // td = op.concat(td, proof.Wxiw);
1844
- intc 10 // 768
1845
- intc_0 // 96
1846
- extract3
1847
- dup
1848
- bury 27
2126
+ dig 25
2127
+ dig 37
1849
2128
  concat
1850
2129
  dup
1851
- bury 18
1852
- // contracts/plonk_bls12381.algo.ts:507
2130
+ bury 29
2131
+ // contracts/plonk_bls12381.algo.ts:601
1853
2132
  // const u = getChallenge(td);
1854
2133
  callsub getChallenge
1855
- // contracts/plonk_bls12381.algo.ts:509-518
2134
+ // contracts/plonk_bls12381.algo.ts:603-612
1856
2135
  // return {
1857
2136
  // beta,
1858
2137
  // gamma,
@@ -1863,67 +2142,146 @@ main_after_while@13:
1863
2142
  // xin: new Uint256(),
1864
2143
  // zh: new Uint256(),
1865
2144
  // };
1866
- dig 18
1867
- dig 39
2145
+ dig 27
2146
+ dig 42
1868
2147
  concat
1869
- dig 14
2148
+ dig 16
1870
2149
  concat
1871
- dig 17
2150
+ dig 26
1872
2151
  concat
1873
2152
  swap
1874
2153
  concat
1875
2154
  pushbytes 0x00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
1876
2155
  concat
2156
+ bury 40
2157
+ // contracts/plonk_bls12381.algo.ts:352
2158
+ // assert(inField(lw.xin), "lw.xin not in Fr");
2159
+ dig 38
1877
2160
  dup
1878
- bury 34
1879
- // contracts/plonk_bls12381.algo.ts:529
2161
+ extract 2 32
2162
+ dup
2163
+ bury 26
2164
+ // contracts/plonk_bls12381.algo.ts:348
2165
+ // return value.native < BLS12_381_SCALAR_MODULUS;
2166
+ bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2167
+ b<
2168
+ // contracts/plonk_bls12381.algo.ts:352
2169
+ // assert(inField(lw.xin), "lw.xin not in Fr");
2170
+ assert // lw.xin not in Fr
2171
+ // contracts/plonk_bls12381.algo.ts:353
2172
+ // assert(inField(lw.zh), "lw.zh not in Fr");
2173
+ extract 34 32
2174
+ dup
2175
+ bury 24
2176
+ // contracts/plonk_bls12381.algo.ts:348
2177
+ // return value.native < BLS12_381_SCALAR_MODULUS;
2178
+ bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2179
+ b<
2180
+ // contracts/plonk_bls12381.algo.ts:353
2181
+ // assert(inField(lw.zh), "lw.zh not in Fr");
2182
+ assert // lw.zh not in Fr
2183
+ // contracts/plonk_bls12381.algo.ts:354
2184
+ // for (let i: uint64 = 0; i < lw.L.length; i++) {
2185
+ intc_2 // 0
2186
+ bury 9
2187
+
2188
+ main_while_top@21:
2189
+ // contracts/plonk_bls12381.algo.ts:354
2190
+ // for (let i: uint64 = 0; i < lw.L.length; i++) {
2191
+ dig 38
2192
+ dup
2193
+ intc_2 // 0
2194
+ extract_uint16
2195
+ dig 1
2196
+ len
2197
+ substring3
2198
+ dup
2199
+ bury 49
2200
+ intc_2 // 0
2201
+ extract_uint16
2202
+ dup
2203
+ bury 11
2204
+ dig 9
2205
+ >
2206
+ bz main_after_while@23
2207
+ // contracts/plonk_bls12381.algo.ts:354-355
2208
+ // for (let i: uint64 = 0; i < lw.L.length; i++) {
2209
+ // assert(inField(lw.L[i] as Uint256), "lw.L not in Fr");
2210
+ dig 47
2211
+ extract 2 0
2212
+ dig 9
2213
+ dup
2214
+ cover 2
2215
+ intc_1 // 32
2216
+ *
2217
+ intc_1 // 32
2218
+ extract3 // on error: index access is out of bounds
2219
+ // contracts/plonk_bls12381.algo.ts:348
2220
+ // return value.native < BLS12_381_SCALAR_MODULUS;
2221
+ bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2222
+ b<
2223
+ // contracts/plonk_bls12381.algo.ts:355
2224
+ // assert(inField(lw.L[i] as Uint256), "lw.L not in Fr");
2225
+ assert // lw.L not in Fr
2226
+ // contracts/plonk_bls12381.algo.ts:354
2227
+ // for (let i: uint64 = 0; i < lw.L.length; i++) {
2228
+ intc_3 // 1
2229
+ +
2230
+ bury 9
2231
+ b main_while_top@21
2232
+
2233
+ main_after_while@23:
2234
+ // contracts/plonk_bls12381.algo.ts:367
2235
+ // let nPow: uint64 = 1;
2236
+ intc_3 // 1
2237
+ bury 7
2238
+ // contracts/plonk_bls12381.algo.ts:368
1880
2239
  // let xin = challenges.xi.native;
2240
+ dig 39
1881
2241
  extract 96 32
1882
- bury 12
1883
- // contracts/plonk_bls12381.algo.ts:532
1884
- // let domainSize: uint64 = 1;
1885
- intc_3 // 1
1886
- bury 10
1887
- // contracts/plonk_bls12381.algo.ts:533
2242
+ dup
2243
+ bury 15
2244
+ // contracts/plonk_bls12381.algo.ts:369
1888
2245
  // for (let i: uint64 = 0; i < vk.power; i++) {
1889
2246
  intc_2 // 0
1890
- bury 9
2247
+ bury 10
2248
+ bury 13
1891
2249
 
1892
- main_while_top@14:
1893
- // contracts/plonk_bls12381.algo.ts:533
2250
+ main_while_top@24:
2251
+ // contracts/plonk_bls12381.algo.ts:369
1894
2252
  // for (let i: uint64 = 0; i < vk.power; i++) {
1895
- dig 14
2253
+ dig 15
1896
2254
  intc 10 // 768
1897
2255
  extract_uint64
1898
2256
  dig 9
1899
2257
  >
1900
- bz main_after_while@16
2258
+ bz main_after_while@26
1901
2259
  // contracts/plonk_bls12381.algo.ts:64
1902
2260
  // return (a * b) % BLS12_381_SCALAR_MODULUS;
1903
- dig 11
2261
+ dig 12
1904
2262
  dup
1905
2263
  b*
1906
2264
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
1907
2265
  b%
1908
- bury 12
1909
- // contracts/plonk_bls12381.algo.ts:535
1910
- // domainSize *= 2;
1911
- dig 9
2266
+ bury 13
2267
+ // contracts/plonk_bls12381.algo.ts:371
2268
+ // nPow *= 2;
2269
+ dig 6
1912
2270
  pushint 2 // 2
1913
2271
  *
1914
- bury 10
1915
- // contracts/plonk_bls12381.algo.ts:533
2272
+ bury 7
2273
+ // contracts/plonk_bls12381.algo.ts:369
1916
2274
  // for (let i: uint64 = 0; i < vk.power; i++) {
1917
2275
  dig 8
1918
2276
  intc_3 // 1
1919
2277
  +
1920
2278
  bury 9
1921
- b main_while_top@14
2279
+ b main_while_top@24
1922
2280
 
1923
- main_after_while@16:
1924
- // contracts/plonk_bls12381.algo.ts:538
1925
- // challenges.xin = new Uint256(xin);
1926
- dig 11
2281
+ main_after_while@26:
2282
+ // contracts/plonk_bls12381.algo.ts:373
2283
+ // const xinExpected = new Uint256(xin);
2284
+ dig 12
1927
2285
  dup
1928
2286
  len
1929
2287
  intc_1 // 32
@@ -1932,16 +2290,18 @@ main_after_while@16:
1932
2290
  intc_1 // 32
1933
2291
  bzero
1934
2292
  dup
1935
- bury 50
1936
- dup2
2293
+ bury 49
2294
+ swap
2295
+ dig 1
1937
2296
  b|
1938
- dig 35
1939
- pushint 352 // 352
1940
- uncover 2
1941
- replace3
1942
- // contracts/plonk_bls12381.algo.ts:539
1943
- // challenges.zh = new Uint256(frSub(xin, BigUint(1))); // Vanishing polynomial Z_H(\u03BE) = \u03BE^n - 1
1944
- uncover 2
2297
+ // contracts/plonk_bls12381.algo.ts:374
2298
+ // assert(lw.xin.native === xinExpected.native, "lw.xin != xi^n");
2299
+ dig 25
2300
+ dig 1
2301
+ b==
2302
+ assert // lw.xin != xi^n
2303
+ // contracts/plonk_bls12381.algo.ts:377
2304
+ // const zhExpected = new Uint256(frSub(xinExpected.native, BigUint(1)));
1945
2305
  bytec_2 // 0x01
1946
2306
  callsub frSub
1947
2307
  dup
@@ -1949,264 +2309,61 @@ main_after_while@16:
1949
2309
  intc_1 // 32
1950
2310
  <=
1951
2311
  assert // overflow
1952
- uncover 2
1953
2312
  b|
1954
- intc 4 // 384
1955
- swap
1956
- replace3
1957
- bury 33
1958
- // contracts/plonk_bls12381.algo.ts:541
1959
- // const n = frScalar(BigUint(domainSize));
1960
- dig 9
1961
- itob
1962
- // contracts/plonk_bls12381.algo.ts:158
1963
- // return a % BLS12_381_SCALAR_MODULUS;
1964
- bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
1965
- b%
1966
- bury 28
1967
- // contracts/plonk_bls12381.algo.ts:547
1968
- // let w = BigUint(1);
1969
- bytec_2 // 0x01
1970
- bury 14
1971
- // contracts/plonk_bls12381.algo.ts:556
1972
- // const L: Uint256[] = [new Uint256()];
1973
- pushbytes 0x00010000000000000000000000000000000000000000000000000000000000000000
1974
- bury 50
1975
- // contracts/plonk_bls12381.algo.ts:559
1976
- // const iterations: uint64 = vk.nPublic === 0 ? 1 : vk.nPublic;
1977
- dig 14
1978
- intc 17 // 776
1979
- extract_uint64
1980
- dup
1981
- bury 7
1982
- bnz main_ternary_false@18
2313
+ // contracts/plonk_bls12381.algo.ts:378
2314
+ // assert(lw.zh.native === zhExpected.native, "lw.zh != xi^n - 1");
2315
+ dig 23
2316
+ b==
2317
+ assert // lw.zh != xi^n - 1
2318
+ // contracts/plonk_bls12381.algo.ts:381
2319
+ // const required: uint64 = vk.nPublic === 0 ? 1 : vk.nPublic;
2320
+ dig 5
2321
+ bnz main_ternary_false@28
1983
2322
  intc_3 // 1
1984
- bury 8
1985
2323
 
1986
- main_ternary_merge@19:
1987
- // contracts/plonk_bls12381.algo.ts:560
1988
- // for (let i: uint64 = 1; i <= iterations; i++) {
2324
+ main_ternary_merge@29:
2325
+ // contracts/plonk_bls12381.algo.ts:382
2326
+ // assert(lw.L.length >= required + 1, "lw.L length too short"); // L[0] unused; start at index 1
1989
2327
  intc_3 // 1
1990
- bury 7
1991
-
1992
- main_while_top@20:
1993
- // contracts/plonk_bls12381.algo.ts:560
1994
- // for (let i: uint64 = 1; i <= iterations; i++) {
1995
- dig 6
1996
- dig 8
2328
+ +
2329
+ dig 10
1997
2330
  <=
1998
- bz main_after_while@22
1999
- // contracts/plonk_bls12381.algo.ts:564
2000
- // frMul(w, challenges.zh.native),
2001
- dig 32
2002
- dup
2003
- intc 4 // 384
2004
- intc_1 // 32
2005
- extract3
2006
- // contracts/plonk_bls12381.algo.ts:64
2007
- // return (a * b) % BLS12_381_SCALAR_MODULUS;
2008
- dig 15
2009
- dup
2010
- uncover 2
2011
- b*
2012
- bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2013
- b%
2014
- // contracts/plonk_bls12381.algo.ts:565
2015
- // frMul(n, frSub(challenges.xi.native, w)),
2016
- uncover 2
2017
- extract 96 32
2018
- uncover 2
2019
- callsub frSub
2020
- // contracts/plonk_bls12381.algo.ts:64
2021
- // return (a * b) % BLS12_381_SCALAR_MODULUS;
2022
- dig 29
2023
- b*
2024
- bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2025
- b%
2026
- // contracts/plonk_bls12381.algo.ts:158
2027
- // return a % BLS12_381_SCALAR_MODULUS;
2028
- swap
2029
- bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2030
- b%
2031
- bury 50
2032
- bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2033
- b%
2034
- // contracts/plonk_bls12381.algo.ts:111
2035
- // assert(x !== (0n as biguint), "Fr inverse of zero");
2036
- dup
2037
- bytec_1 // 0x
2038
- b!=
2039
- assert // Fr inverse of zero
2040
- // contracts/plonk_bls12381.algo.ts:112
2041
- // const inv = modPow(x, BLS12_381_R_MINUS_2, r);
2042
- pushbytes 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfefffffffeffffffff
2043
- // contracts/plonk_bls12381.algo.ts:90
2044
- // let result = 1n as biguint;
2045
- bytec_2 // 0x01
2046
- bury 24
2047
- // contracts/plonk_bls12381.algo.ts:91
2048
- // let b: biguint = base % mod;
2049
- swap
2050
- // contracts/plonk_bls12381.algo.ts:112
2051
- // const inv = modPow(x, BLS12_381_R_MINUS_2, r);
2052
- bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2053
- // contracts/plonk_bls12381.algo.ts:91
2054
- // let b: biguint = base % mod;
2055
- b%
2056
- bury 38
2057
- bury 32
2058
-
2059
- main_while_top@27:
2060
- // contracts/plonk_bls12381.algo.ts:93
2061
- // while (e > (0n as biguint)) {
2062
- dig 31
2063
- bytec_1 // 0x
2064
- b>
2065
- // contracts/plonk_bls12381.algo.ts:93-99
2066
- // while (e > (0n as biguint)) {
2067
- // if ((e & (1n as biguint)) !== (0n as biguint)) {
2068
- // result = (result * b) % mod;
2069
- // }
2070
- // b = (b * b) % mod;
2071
- // e = e / BigUint(2);
2072
- // }
2073
- bz main_after_while@31
2074
- // contracts/plonk_bls12381.algo.ts:94
2075
- // if ((e & (1n as biguint)) !== (0n as biguint)) {
2076
- dig 31
2331
+ assert // lw.L length too short
2332
+ // contracts/plonk_bls12381.algo.ts:385
2333
+ // assert(challenges.xi.native !== BigUint(1), "invalid xi (equals 1)");
2334
+ dig 13
2077
2335
  bytec_2 // 0x01
2078
- b&
2079
- bytec_1 // 0x
2080
2336
  b!=
2081
- dig 22
2082
- bury 22
2083
- bz main_after_if_else@30
2084
- // contracts/plonk_bls12381.algo.ts:95
2085
- // result = (result * b) % mod;
2086
- dig 21
2087
- dig 37
2088
- b*
2089
- // contracts/plonk_bls12381.algo.ts:112
2090
- // const inv = modPow(x, BLS12_381_R_MINUS_2, r);
2091
- bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2092
- // contracts/plonk_bls12381.algo.ts:95
2093
- // result = (result * b) % mod;
2094
- b%
2095
- bury 21
2096
-
2097
- main_after_if_else@30:
2098
- dig 20
2099
- bury 22
2100
- // contracts/plonk_bls12381.algo.ts:97
2101
- // b = (b * b) % mod;
2102
- dig 36
2103
- dup
2104
- b*
2105
- // contracts/plonk_bls12381.algo.ts:112
2106
- // const inv = modPow(x, BLS12_381_R_MINUS_2, r);
2107
- bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2108
- // contracts/plonk_bls12381.algo.ts:97
2109
- // b = (b * b) % mod;
2110
- b%
2111
- bury 37
2112
- // contracts/plonk_bls12381.algo.ts:98
2113
- // e = e / BigUint(2);
2114
- dig 31
2115
- pushbytes 0x02
2116
- b/
2117
- bury 32
2118
- b main_while_top@27
2119
-
2120
- main_after_while@31:
2121
- // contracts/plonk_bls12381.algo.ts:125
2122
- // return (aN * bInv) % r;
2123
- dig 48
2124
- dig 22
2125
- b*
2126
- bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2127
- b%
2128
- // contracts/plonk_bls12381.algo.ts:562-567
2129
- // new Uint256(
2130
- // frDiv(
2131
- // frMul(w, challenges.zh.native),
2132
- // frMul(n, frSub(challenges.xi.native, w)),
2133
- // ),
2134
- // ),
2135
- dup
2136
- len
2137
- intc_1 // 32
2138
- <=
2139
- assert // overflow
2140
- dig 48
2141
- b|
2142
- // contracts/plonk_bls12381.algo.ts:561-568
2143
- // L.push(
2144
- // new Uint256(
2145
- // frDiv(
2146
- // frMul(w, challenges.zh.native),
2147
- // frMul(n, frSub(challenges.xi.native, w)),
2148
- // ),
2149
- // ),
2150
- // );
2151
- dig 50
2152
- dup
2153
- uncover 2
2154
- concat // on error: max array length exceeded
2155
- swap
2156
- intc_2 // 0
2157
- extract_uint16
2158
- intc_3 // 1
2159
- +
2160
- itob
2161
- extract 6 2
2162
- replace2 0
2163
- bury 50
2164
- // contracts/plonk_bls12381.algo.ts:64
2165
- // return (a * b) % BLS12_381_SCALAR_MODULUS;
2166
- dig 13
2167
- // contracts/plonk_bls12381.algo.ts:569
2168
- // w = frMul(w, ROOT_OF_UNITY); // Next root of unity step (\u03C9^i)
2169
- bytec_3 // TMPL_ROOT_OF_UNITY
2170
- // contracts/plonk_bls12381.algo.ts:64
2171
- // return (a * b) % BLS12_381_SCALAR_MODULUS;
2172
- b*
2173
- bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2174
- b%
2175
- bury 14
2176
- // contracts/plonk_bls12381.algo.ts:560
2177
- // for (let i: uint64 = 1; i <= iterations; i++) {
2178
- dig 6
2179
- intc_3 // 1
2180
- +
2181
- bury 7
2182
- b main_while_top@20
2183
-
2184
- main_after_while@22:
2185
- // contracts/plonk_bls12381.algo.ts:571
2186
- // return { L, challenges };
2187
- pushbytes 0x01a2
2188
- dig 33
2189
- concat
2190
- dig 50
2191
- concat
2192
- bury 47
2193
- // contracts/plonk_bls12381.algo.ts:581
2337
+ assert // invalid xi (equals 1)
2338
+ // contracts/plonk_bls12381.algo.ts:443
2339
+ // challenges.xin = lw.xin;
2340
+ dig 39
2341
+ pushint 352 // 352
2342
+ dig 25
2343
+ replace3
2344
+ // contracts/plonk_bls12381.algo.ts:444
2345
+ // challenges.zh = lw.zh;
2346
+ intc 4 // 384
2347
+ dig 24
2348
+ replace3
2349
+ bury 40
2350
+ // contracts/plonk_bls12381.algo.ts:675
2194
2351
  // let pi = BigUint(0);
2195
2352
  bytec_1 // 0x
2196
- bury 23
2197
- // contracts/plonk_bls12381.algo.ts:582
2353
+ bury 30
2354
+ // contracts/plonk_bls12381.algo.ts:676
2198
2355
  // for (let i: uint64 = 0; i < publicSignals.length; i++) {
2199
2356
  intc_2 // 0
2200
2357
  bury 9
2201
2358
 
2202
- main_while_top@23:
2203
- // contracts/plonk_bls12381.algo.ts:582
2359
+ main_while_top@30:
2360
+ // contracts/plonk_bls12381.algo.ts:676
2204
2361
  // for (let i: uint64 = 0; i < publicSignals.length; i++) {
2205
2362
  dig 8
2206
2363
  dig 11
2207
2364
  <
2208
- bz main_after_while@25
2209
- // contracts/plonk_bls12381.algo.ts:583
2365
+ bz main_after_while@32
2366
+ // contracts/plonk_bls12381.algo.ts:677
2210
2367
  // const w = frScalar((publicSignals[i] as Uint256).native);
2211
2368
  dig 2
2212
2369
  extract 2 0
@@ -2221,20 +2378,14 @@ main_while_top@23:
2221
2378
  // return a % BLS12_381_SCALAR_MODULUS;
2222
2379
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2223
2380
  b%
2224
- // contracts/plonk_bls12381.algo.ts:584
2381
+ // contracts/plonk_bls12381.algo.ts:678
2225
2382
  // pi = frSub(pi, frMul(w, (L[i + 1] as Uint256).native));
2226
2383
  swap
2227
2384
  intc_3 // 1
2228
2385
  +
2229
2386
  dup
2230
2387
  bury 11
2231
- dig 48
2232
- dup
2233
- intc_2 // 0
2234
- extract_uint16
2235
- dig 1
2236
- len
2237
- substring3
2388
+ dig 49
2238
2389
  extract 2 0
2239
2390
  swap
2240
2391
  intc_1 // 32
@@ -2246,45 +2397,36 @@ main_while_top@23:
2246
2397
  b*
2247
2398
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2248
2399
  b%
2249
- // contracts/plonk_bls12381.algo.ts:584
2400
+ // contracts/plonk_bls12381.algo.ts:678
2250
2401
  // pi = frSub(pi, frMul(w, (L[i + 1] as Uint256).native));
2251
- dig 23
2402
+ dig 30
2252
2403
  swap
2253
2404
  callsub frSub
2254
- bury 23
2255
- b main_while_top@23
2405
+ bury 30
2406
+ b main_while_top@30
2256
2407
 
2257
- main_after_while@25:
2258
- // contracts/plonk_bls12381.algo.ts:586
2408
+ main_after_while@32:
2409
+ // contracts/plonk_bls12381.algo.ts:680
2259
2410
  // return new Uint256(pi);
2260
- dig 22
2411
+ dig 29
2261
2412
  dup
2262
2413
  len
2263
2414
  intc_1 // 32
2264
2415
  <=
2265
2416
  assert // overflow
2266
- dig 48
2417
+ dig 47
2267
2418
  dup
2268
2419
  cover 2
2269
2420
  b|
2270
- // contracts/plonk_bls12381.algo.ts:356
2271
- // const r0 = calculateR0(proof, challenges, pi, L[1] as Uint256);
2272
- dig 48
2273
- dup
2274
- intc_2 // 0
2275
- extract_uint16
2276
- dig 1
2277
- len
2278
- dig 2
2279
- cover 2
2280
- substring3
2421
+ // contracts/plonk_bls12381.algo.ts:450
2422
+ // const r0 = calculateR0(proof, challenges, pi, lw.L[1] as Uint256);
2423
+ dig 49
2281
2424
  extract 34 32
2282
- // contracts/plonk_bls12381.algo.ts:607
2425
+ // contracts/plonk_bls12381.algo.ts:701
2283
2426
  // frMul(challenges.alpha.native, challenges.alpha.native),
2284
- swap
2285
- pushints 2 416 // 2, 416
2286
- extract3
2427
+ dig 42
2287
2428
  dup
2429
+ cover 2
2288
2430
  extract 64 32
2289
2431
  // contracts/plonk_bls12381.algo.ts:64
2290
2432
  // return (a * b) % BLS12_381_SCALAR_MODULUS;
@@ -2293,18 +2435,18 @@ main_after_while@25:
2293
2435
  b*
2294
2436
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2295
2437
  b%
2296
- uncover 3
2438
+ uncover 2
2297
2439
  b*
2298
2440
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2299
2441
  b%
2300
- // contracts/plonk_bls12381.algo.ts:614
2442
+ // contracts/plonk_bls12381.algo.ts:708
2301
2443
  // frMul(challenges.beta.native, proof.eval_s1.native),
2302
2444
  dig 2
2303
2445
  extract 0 32
2304
2446
  // contracts/plonk_bls12381.algo.ts:64
2305
2447
  // return (a * b) % BLS12_381_SCALAR_MODULUS;
2306
2448
  dup
2307
- dig 40
2449
+ dig 25
2308
2450
  dup
2309
2451
  cover 8
2310
2452
  b*
@@ -2312,9 +2454,9 @@ main_after_while@25:
2312
2454
  b%
2313
2455
  // contracts/plonk_bls12381.algo.ts:147
2314
2456
  // const aN: biguint = a % r;
2315
- dig 38
2457
+ dig 29
2316
2458
  dup
2317
- cover 6
2459
+ cover 7
2318
2460
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2319
2461
  b%
2320
2462
  // contracts/plonk_bls12381.algo.ts:148
@@ -2328,7 +2470,7 @@ main_after_while@25:
2328
2470
  b+
2329
2471
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2330
2472
  b%
2331
- // contracts/plonk_bls12381.algo.ts:616
2473
+ // contracts/plonk_bls12381.algo.ts:710
2332
2474
  // e3a = frAdd(e3a, challenges.gamma.native);
2333
2475
  dig 5
2334
2476
  extract 32 32
@@ -2352,7 +2494,7 @@ main_after_while@25:
2352
2494
  // contracts/plonk_bls12381.algo.ts:64
2353
2495
  // return (a * b) % BLS12_381_SCALAR_MODULUS;
2354
2496
  dig 3
2355
- dig 47
2497
+ dig 29
2356
2498
  dup
2357
2499
  cover 12
2358
2500
  b*
@@ -2360,7 +2502,7 @@ main_after_while@25:
2360
2502
  b%
2361
2503
  // contracts/plonk_bls12381.algo.ts:147
2362
2504
  // const aN: biguint = a % r;
2363
- dig 42
2505
+ dig 33
2364
2506
  dup
2365
2507
  cover 4
2366
2508
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
@@ -2388,9 +2530,9 @@ main_after_while@25:
2388
2530
  b%
2389
2531
  // contracts/plonk_bls12381.algo.ts:147
2390
2532
  // const aN: biguint = a % r;
2391
- dig 43
2533
+ dig 34
2392
2534
  dup
2393
- cover 9
2535
+ cover 14
2394
2536
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2395
2537
  b%
2396
2538
  // contracts/plonk_bls12381.algo.ts:149
@@ -2412,76 +2554,68 @@ main_after_while@25:
2412
2554
  b*
2413
2555
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2414
2556
  b%
2415
- dig 51
2557
+ dig 33
2416
2558
  dup
2417
- cover 15
2559
+ cover 14
2418
2560
  b*
2419
2561
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2420
2562
  b%
2421
- dig 10
2563
+ dig 9
2422
2564
  b*
2423
2565
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2424
2566
  b%
2425
- // contracts/plonk_bls12381.algo.ts:631
2567
+ // contracts/plonk_bls12381.algo.ts:725
2426
2568
  // const r0 = frSub(frSub(e1, e2), e3);
2427
- uncover 13
2569
+ uncover 11
2428
2570
  dig 9
2429
2571
  callsub frSub
2430
2572
  swap
2431
2573
  callsub frSub
2432
- // contracts/plonk_bls12381.algo.ts:632
2574
+ // contracts/plonk_bls12381.algo.ts:726
2433
2575
  // return new Uint256(r0);
2434
2576
  dup
2435
2577
  len
2436
2578
  intc_1 // 32
2437
2579
  <=
2438
2580
  assert // overflow
2439
- uncover 14
2581
+ uncover 13
2440
2582
  b|
2441
- // contracts/plonk_bls12381.algo.ts:658
2442
- // dPoints = op.concat(dPoints, proof.T1);
2443
- dig 35
2444
- dig 61
2583
+ // contracts/plonk_bls12381.algo.ts:754
2584
+ // points = op.concat(points, proof.T1);
2585
+ dig 44
2586
+ dig 48
2445
2587
  concat
2446
- // contracts/plonk_bls12381.algo.ts:659
2447
- // dPoints = op.concat(dPoints, proof.T2);
2448
- dig 60
2588
+ // contracts/plonk_bls12381.algo.ts:755
2589
+ // points = op.concat(points, proof.T2);
2590
+ dig 47
2591
+ concat
2592
+ // contracts/plonk_bls12381.algo.ts:756
2593
+ // points = op.concat(points, proof.T3);
2594
+ dig 54
2449
2595
  concat
2450
- // contracts/plonk_bls12381.algo.ts:660
2451
- // dPoints = op.concat(dPoints, proof.T3);
2452
- dig 59
2596
+ // contracts/plonk_bls12381.algo.ts:757
2597
+ // points = op.concat(points, vk.Qc);
2598
+ dig 62
2453
2599
  concat
2454
2600
  // contracts/plonk_bls12381.algo.ts:64
2455
2601
  // return (a * b) % BLS12_381_SCALAR_MODULUS;
2456
- dig 13
2602
+ dig 12
2457
2603
  dig 7
2458
2604
  b*
2459
2605
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2460
2606
  b%
2461
- // contracts/plonk_bls12381.algo.ts:671
2462
- // frMul(BigUint(1), challenges.zh.native),
2463
- dig 13
2607
+ // contracts/plonk_bls12381.algo.ts:766
2608
+ // const quotientScalar1 = frSub(BigUint(0), challenges.zh.native); // \u2212zh (applies to T1)
2609
+ dig 12
2464
2610
  intc 4 // 384
2465
2611
  intc_1 // 32
2466
2612
  extract3
2467
- // contracts/plonk_bls12381.algo.ts:64
2468
- // return (a * b) % BLS12_381_SCALAR_MODULUS;
2469
- dup
2470
- bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2471
- b%
2472
- // contracts/plonk_bls12381.algo.ts:670
2473
- // BigUint(0),
2474
2613
  bytec_1 // 0x
2475
- // contracts/plonk_bls12381.algo.ts:669-672
2476
- // const quotientScalar1 = frSub(
2477
- // BigUint(0),
2478
- // frMul(BigUint(1), challenges.zh.native),
2479
- // ); // -T1*zh
2480
- swap
2614
+ dig 1
2481
2615
  callsub frSub
2482
- // contracts/plonk_bls12381.algo.ts:675
2616
+ // contracts/plonk_bls12381.algo.ts:769
2483
2617
  // frMul(challenges.xin.native, challenges.zh.native),
2484
- dig 15
2618
+ dig 14
2485
2619
  pushint 352 // 352
2486
2620
  intc_1 // 32
2487
2621
  extract3
@@ -2492,14 +2626,14 @@ main_after_while@25:
2492
2626
  b*
2493
2627
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2494
2628
  b%
2495
- // contracts/plonk_bls12381.algo.ts:674
2629
+ // contracts/plonk_bls12381.algo.ts:768
2496
2630
  // BigUint(0),
2497
2631
  bytec_1 // 0x
2498
- // contracts/plonk_bls12381.algo.ts:673-676
2632
+ // contracts/plonk_bls12381.algo.ts:767-770
2499
2633
  // const quotientScalar2 = frSub(
2500
2634
  // BigUint(0),
2501
2635
  // frMul(challenges.xin.native, challenges.zh.native),
2502
- // ); // -T2*xin*zh
2636
+ // ); // \u2212xin\xB7zh (applies to T2)
2503
2637
  swap
2504
2638
  callsub frSub
2505
2639
  // contracts/plonk_bls12381.algo.ts:64
@@ -2513,85 +2647,26 @@ main_after_while@25:
2513
2647
  b*
2514
2648
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2515
2649
  b%
2516
- // contracts/plonk_bls12381.algo.ts:678
2650
+ // contracts/plonk_bls12381.algo.ts:772
2517
2651
  // BigUint(0),
2518
2652
  bytec_1 // 0x
2519
- // contracts/plonk_bls12381.algo.ts:677-683
2653
+ // contracts/plonk_bls12381.algo.ts:771-777
2520
2654
  // const quotientScalar3 = frSub(
2521
2655
  // BigUint(0),
2522
2656
  // frMul(
2523
2657
  // frMul(challenges.xin.native, challenges.xin.native),
2524
2658
  // challenges.zh.native,
2525
2659
  // ),
2526
- // ); // -T3*xin\xB2*zh
2660
+ // ); // \u2212xin\xB2\xB7zh (applies to T3)
2527
2661
  swap
2528
2662
  callsub frSub
2529
- // contracts/plonk_bls12381.algo.ts:686
2530
- // let dScalars = op.concat(b32(gateScalar1), b32(gateScalar2));
2531
- uncover 3
2532
- callsub b32
2533
- dig 17
2534
- callsub b32
2535
- concat
2536
- // contracts/plonk_bls12381.algo.ts:687
2537
- // dScalars = op.concat(dScalars, b32(gateScalar3));
2538
- dig 10
2539
- callsub b32
2540
- concat
2541
- // contracts/plonk_bls12381.algo.ts:688
2542
- // dScalars = op.concat(dScalars, b32(gateScalar4));
2543
- dig 14
2544
- callsub b32
2545
- concat
2546
- // contracts/plonk_bls12381.algo.ts:689
2547
- // dScalars = op.concat(dScalars, b32(quotientScalar1));
2548
- uncover 3
2549
- callsub b32
2550
- concat
2551
- // contracts/plonk_bls12381.algo.ts:690
2552
- // dScalars = op.concat(dScalars, b32(quotientScalar2));
2553
- uncover 2
2554
- callsub b32
2555
- concat
2556
- // contracts/plonk_bls12381.algo.ts:691
2557
- // dScalars = op.concat(dScalars, b32(quotientScalar3));
2558
- swap
2559
- callsub b32
2560
- concat
2561
- // contracts/plonk_bls12381.algo.ts:694-698
2562
- // const dBatched = op.EllipticCurve.scalarMulMulti(
2563
- // op.Ec.BLS12_381g1,
2564
- // dPoints,
2565
- // dScalars,
2566
- // );
2567
- ec_multi_scalar_mul BLS12_381g1
2568
- // contracts/plonk_bls12381.algo.ts:699
2569
- // let D = g1Add(dBatched.toFixed({ length: 96 }), vk.Qc); // Add Qc constant term
2570
- dup
2571
- len
2572
- intc_0 // 96
2573
- ==
2574
- assert // Length must be 96
2575
- // contracts/plonk_bls12381.algo.ts:234
2576
- // return op.EllipticCurve.add(op.Ec.BLS12_381g1, p1, p2).toFixed({
2577
- dig 40
2578
- ec_add BLS12_381g1
2579
- // contracts/plonk_bls12381.algo.ts:234-236
2580
- // return op.EllipticCurve.add(op.Ec.BLS12_381g1, p1, p2).toFixed({
2581
- // length: 96,
2582
- // });
2583
- dup
2584
- len
2585
- intc_0 // 96
2586
- ==
2587
- assert // Length must be 96
2588
- // contracts/plonk_bls12381.algo.ts:702
2663
+ // contracts/plonk_bls12381.algo.ts:780
2589
2664
  // const betaxi = frMul(challenges.beta.native, challenges.xi.native);
2590
- dig 12
2665
+ dig 15
2591
2666
  extract 96 32
2592
2667
  // contracts/plonk_bls12381.algo.ts:64
2593
2668
  // return (a * b) % BLS12_381_SCALAR_MODULUS;
2594
- dig 9
2669
+ dig 13
2595
2670
  dig 1
2596
2671
  b*
2597
2672
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
@@ -2603,7 +2678,7 @@ main_after_while@25:
2603
2678
  b%
2604
2679
  // contracts/plonk_bls12381.algo.ts:149
2605
2680
  // return (aN + bN) % r;
2606
- uncover 10
2681
+ uncover 14
2607
2682
  b+
2608
2683
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2609
2684
  b%
@@ -2613,13 +2688,13 @@ main_after_while@25:
2613
2688
  b%
2614
2689
  // contracts/plonk_bls12381.algo.ts:149
2615
2690
  // return (aN + bN) % r;
2616
- dig 8
2691
+ dig 12
2617
2692
  b+
2618
2693
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2619
2694
  b%
2620
- // contracts/plonk_bls12381.algo.ts:708
2695
+ // contracts/plonk_bls12381.algo.ts:786
2621
2696
  // frAdd(proof.eval_b.native, frMul(betaxi, BigUint(vk.k1))),
2622
- dig 33
2697
+ dig 38
2623
2698
  dup
2624
2699
  cover 3
2625
2700
  intc 18 // 784
@@ -2637,7 +2712,7 @@ main_after_while@25:
2637
2712
  b%
2638
2713
  // contracts/plonk_bls12381.algo.ts:149
2639
2714
  // return (aN + bN) % r;
2640
- uncover 9
2715
+ uncover 13
2641
2716
  b+
2642
2717
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2643
2718
  b%
@@ -2647,11 +2722,11 @@ main_after_while@25:
2647
2722
  b%
2648
2723
  // contracts/plonk_bls12381.algo.ts:149
2649
2724
  // return (aN + bN) % r;
2650
- dig 9
2725
+ dig 13
2651
2726
  b+
2652
2727
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2653
2728
  b%
2654
- // contracts/plonk_bls12381.algo.ts:712
2729
+ // contracts/plonk_bls12381.algo.ts:790
2655
2730
  // frAdd(proof.eval_c.native, frMul(betaxi, BigUint(vk.k2))),
2656
2731
  dig 3
2657
2732
  intc 19 // 792
@@ -2669,7 +2744,7 @@ main_after_while@25:
2669
2744
  b%
2670
2745
  // contracts/plonk_bls12381.algo.ts:149
2671
2746
  // return (aN + bN) % r;
2672
- uncover 8
2747
+ uncover 12
2673
2748
  b+
2674
2749
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2675
2750
  b%
@@ -2679,7 +2754,7 @@ main_after_while@25:
2679
2754
  b%
2680
2755
  // contracts/plonk_bls12381.algo.ts:149
2681
2756
  // return (aN + bN) % r;
2682
- uncover 8
2757
+ uncover 12
2683
2758
  b+
2684
2759
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2685
2760
  b%
@@ -2692,7 +2767,7 @@ main_after_while@25:
2692
2767
  b*
2693
2768
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2694
2769
  b%
2695
- dig 10
2770
+ dig 13
2696
2771
  b*
2697
2772
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2698
2773
  b%
@@ -2702,7 +2777,7 @@ main_after_while@25:
2702
2777
  b%
2703
2778
  // contracts/plonk_bls12381.algo.ts:148
2704
2779
  // const bN: biguint = b % r;
2705
- uncover 8
2780
+ uncover 12
2706
2781
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2707
2782
  b%
2708
2783
  // contracts/plonk_bls12381.algo.ts:149
@@ -2710,9 +2785,9 @@ main_after_while@25:
2710
2785
  b+
2711
2786
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2712
2787
  b%
2713
- // contracts/plonk_bls12381.algo.ts:720
2788
+ // contracts/plonk_bls12381.algo.ts:798
2714
2789
  // const zScalar = frAdd(frAdd(d2a, d2b), challenges.u.native);
2715
- dig 10
2790
+ dig 13
2716
2791
  pushint 320 // 320
2717
2792
  intc_1 // 32
2718
2793
  extract3
@@ -2731,180 +2806,161 @@ main_after_while@25:
2731
2806
  b+
2732
2807
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2733
2808
  b%
2734
- // contracts/plonk_bls12381.algo.ts:223
2735
- // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
2736
- dig 42
2737
- swap
2738
- ec_scalar_mul BLS12_381g1
2739
- // contracts/plonk_bls12381.algo.ts:223-225
2740
- // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
2741
- // length: 96,
2742
- // });
2743
- dup
2744
- len
2745
- intc_0 // 96
2746
- ==
2747
- assert // Length must be 96
2748
- // contracts/plonk_bls12381.algo.ts:234
2749
- // return op.EllipticCurve.add(op.Ec.BLS12_381g1, p1, p2).toFixed({
2750
- uncover 4
2751
- swap
2752
- ec_add BLS12_381g1
2753
- // contracts/plonk_bls12381.algo.ts:234-236
2754
- // return op.EllipticCurve.add(op.Ec.BLS12_381g1, p1, p2).toFixed({
2755
- // length: 96,
2756
- // });
2757
- dup
2758
- len
2759
- intc_0 // 96
2760
- ==
2761
- assert // Length must be 96
2762
2809
  // contracts/plonk_bls12381.algo.ts:64
2763
2810
  // return (a * b) % BLS12_381_SCALAR_MODULUS;
2764
- uncover 9
2765
- uncover 8
2811
+ uncover 13
2812
+ uncover 13
2766
2813
  b*
2767
2814
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2768
2815
  b%
2769
- dig 11
2816
+ dig 15
2770
2817
  b*
2771
2818
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2772
2819
  b%
2773
- uncover 6
2820
+ uncover 11
2774
2821
  b*
2775
2822
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2776
2823
  b%
2777
- // contracts/plonk_bls12381.algo.ts:223
2778
- // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
2779
- dig 38
2780
- swap
2781
- ec_scalar_mul BLS12_381g1
2782
- // contracts/plonk_bls12381.algo.ts:223-225
2783
- // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
2784
- // length: 96,
2785
- // });
2786
- dup
2787
- len
2788
- intc_0 // 96
2789
- ==
2790
- assert // Length must be 96
2791
- // contracts/plonk_bls12381.algo.ts:254
2792
- // return g1Add(p, g1Neg(q));
2793
- callsub g1Neg
2794
- // contracts/plonk_bls12381.algo.ts:234
2795
- // return op.EllipticCurve.add(op.Ec.BLS12_381g1, p1, p2).toFixed({
2796
- ec_add BLS12_381g1
2797
- // contracts/plonk_bls12381.algo.ts:234-236
2798
- // return op.EllipticCurve.add(op.Ec.BLS12_381g1, p1, p2).toFixed({
2799
- // length: 96,
2800
- // });
2801
- dup
2802
- len
2803
- intc_0 // 96
2804
- ==
2805
- assert // Length must be 96
2806
- // contracts/plonk_bls12381.algo.ts:749
2807
- // let fPoints = op.concat(proof.A, proof.B);
2808
- dig 51
2824
+ // contracts/plonk_bls12381.algo.ts:822
2825
+ // points = op.concat(points, proof.Z);
2826
+ uncover 9
2827
+ dig 50
2828
+ concat
2829
+ // contracts/plonk_bls12381.algo.ts:823
2830
+ // points = op.concat(points, vk.S3);
2831
+ dig 60
2832
+ concat
2833
+ // contracts/plonk_bls12381.algo.ts:824
2834
+ // points = op.concat(points, proof.A);
2835
+ dig 53
2836
+ concat
2837
+ // contracts/plonk_bls12381.algo.ts:825
2838
+ // points = op.concat(points, proof.B);
2839
+ dig 52
2840
+ concat
2841
+ // contracts/plonk_bls12381.algo.ts:826
2842
+ // points = op.concat(points, proof.C);
2809
2843
  dig 51
2810
2844
  concat
2811
- // contracts/plonk_bls12381.algo.ts:750
2812
- // fPoints = op.concat(fPoints, proof.C);
2813
- dig 58
2845
+ // contracts/plonk_bls12381.algo.ts:827
2846
+ // points = op.concat(points, vk.S1);
2847
+ dig 62
2814
2848
  concat
2815
- // contracts/plonk_bls12381.algo.ts:751
2816
- // fPoints = op.concat(fPoints, vk.S1);
2817
- dig 54
2849
+ // contracts/plonk_bls12381.algo.ts:828
2850
+ // points = op.concat(points, vk.S2);
2851
+ dig 61
2818
2852
  concat
2819
- // contracts/plonk_bls12381.algo.ts:752
2820
- // fPoints = op.concat(fPoints, vk.S2);
2821
- dig 53
2853
+ // contracts/plonk_bls12381.algo.ts:831
2854
+ // let scalars = op.concat(b32(gateScalar1), b32(gateScalar2));
2855
+ uncover 9
2856
+ callsub b32
2857
+ dig 13
2858
+ callsub b32
2822
2859
  concat
2823
- // contracts/plonk_bls12381.algo.ts:756
2824
- // (challenges.v[1] as Uint256).bytes,
2860
+ // contracts/plonk_bls12381.algo.ts:832
2861
+ // scalars = op.concat(scalars, b32(gateScalar3));
2862
+ dig 11
2863
+ callsub b32
2864
+ concat
2865
+ // contracts/plonk_bls12381.algo.ts:833
2866
+ // scalars = op.concat(scalars, b32(gateScalar4));
2867
+ dig 15
2868
+ callsub b32
2869
+ concat
2870
+ // contracts/plonk_bls12381.algo.ts:834
2871
+ // scalars = op.concat(scalars, b32(quotientScalar1));
2872
+ uncover 9
2873
+ callsub b32
2874
+ concat
2875
+ // contracts/plonk_bls12381.algo.ts:835
2876
+ // scalars = op.concat(scalars, b32(quotientScalar2));
2825
2877
  uncover 8
2878
+ callsub b32
2879
+ concat
2880
+ // contracts/plonk_bls12381.algo.ts:836
2881
+ // scalars = op.concat(scalars, b32(quotientScalar3));
2882
+ uncover 7
2883
+ callsub b32
2884
+ concat
2885
+ // contracts/plonk_bls12381.algo.ts:837
2886
+ // scalars = op.concat(scalars, b32(BigUint(1))); // Qc with scalar 1
2887
+ bytec_2 // 0x01
2888
+ callsub b32
2889
+ concat
2890
+ // contracts/plonk_bls12381.algo.ts:838
2891
+ // scalars = op.concat(scalars, b32(zScalar)); // Z with zScalar
2892
+ uncover 3
2893
+ callsub b32
2894
+ concat
2895
+ // contracts/plonk_bls12381.algo.ts:839
2896
+ // scalars = op.concat(scalars, b32(frSub(BigUint(0), s3Scalar))); // S3 with -s3Scalar
2897
+ bytec_1 // 0x
2898
+ uncover 3
2899
+ callsub frSub
2900
+ callsub b32
2901
+ concat
2902
+ // contracts/plonk_bls12381.algo.ts:840
2903
+ // scalars = op.concat(scalars, (challenges.v[1] as Uint256).bytes);
2904
+ uncover 7
2826
2905
  extract 128 192
2827
2906
  dup
2828
2907
  extract 32 32 // on error: index access is out of bounds
2829
- // contracts/plonk_bls12381.algo.ts:756-757
2830
- // (challenges.v[1] as Uint256).bytes,
2831
- // (challenges.v[2] as Uint256).bytes,
2908
+ uncover 2
2832
2909
  dig 1
2910
+ concat
2911
+ // contracts/plonk_bls12381.algo.ts:840-841
2912
+ // scalars = op.concat(scalars, (challenges.v[1] as Uint256).bytes);
2913
+ // scalars = op.concat(scalars, (challenges.v[2] as Uint256).bytes);
2914
+ dig 2
2833
2915
  extract 64 32 // on error: index access is out of bounds
2834
- // contracts/plonk_bls12381.algo.ts:755-758
2835
- // let fScalars = op.concat(
2836
- // (challenges.v[1] as Uint256).bytes,
2837
- // (challenges.v[2] as Uint256).bytes,
2838
- // );
2839
- dup2
2916
+ // contracts/plonk_bls12381.algo.ts:841
2917
+ // scalars = op.concat(scalars, (challenges.v[2] as Uint256).bytes);
2918
+ swap
2919
+ dig 1
2840
2920
  concat
2841
- // contracts/plonk_bls12381.algo.ts:759
2842
- // fScalars = op.concat(fScalars, (challenges.v[3] as Uint256).bytes);
2921
+ // contracts/plonk_bls12381.algo.ts:842
2922
+ // scalars = op.concat(scalars, (challenges.v[3] as Uint256).bytes);
2843
2923
  dig 3
2844
2924
  extract 96 32 // on error: index access is out of bounds
2845
2925
  swap
2846
2926
  dig 1
2847
2927
  concat
2848
- // contracts/plonk_bls12381.algo.ts:760
2849
- // fScalars = op.concat(fScalars, (challenges.v[4] as Uint256).bytes);
2928
+ // contracts/plonk_bls12381.algo.ts:843
2929
+ // scalars = op.concat(scalars, (challenges.v[4] as Uint256).bytes);
2850
2930
  dig 4
2851
2931
  extract 128 32 // on error: index access is out of bounds
2852
2932
  swap
2853
2933
  dig 1
2854
2934
  concat
2855
- // contracts/plonk_bls12381.algo.ts:761
2856
- // fScalars = op.concat(fScalars, (challenges.v[5] as Uint256).bytes);
2935
+ // contracts/plonk_bls12381.algo.ts:844
2936
+ // scalars = op.concat(scalars, (challenges.v[5] as Uint256).bytes);
2857
2937
  uncover 5
2858
2938
  extract 160 32 // on error: index access is out of bounds
2859
2939
  swap
2860
2940
  dig 1
2861
2941
  concat
2862
- // contracts/plonk_bls12381.algo.ts:763-767
2863
- // const fBatched = op.EllipticCurve.scalarMulMulti(
2942
+ // contracts/plonk_bls12381.algo.ts:847-851
2943
+ // const F = op.EllipticCurve.scalarMulMulti(
2864
2944
  // op.Ec.BLS12_381g1,
2865
- // fPoints,
2866
- // fScalars,
2867
- // );
2945
+ // points,
2946
+ // scalars,
2947
+ // ).toFixed({ length: 96 });
2868
2948
  uncover 6
2869
2949
  swap
2870
2950
  ec_multi_scalar_mul BLS12_381g1
2871
- // contracts/plonk_bls12381.algo.ts:768
2872
- // const F = g1Add(D, fBatched.toFixed({ length: 96 }));
2873
- dup
2874
- len
2875
- intc_0 // 96
2876
- ==
2877
- assert // Length must be 96
2878
- // contracts/plonk_bls12381.algo.ts:234
2879
- // return op.EllipticCurve.add(op.Ec.BLS12_381g1, p1, p2).toFixed({
2880
- dig 6
2881
- swap
2882
- ec_add BLS12_381g1
2883
- // contracts/plonk_bls12381.algo.ts:234-236
2884
- // return op.EllipticCurve.add(op.Ec.BLS12_381g1, p1, p2).toFixed({
2885
- // length: 96,
2886
- // });
2887
2951
  dup
2888
2952
  len
2889
2953
  intc_0 // 96
2890
2954
  ==
2891
2955
  assert // Length must be 96
2892
- // contracts/plonk_bls12381.algo.ts:770
2893
- // return { D, F };
2894
- uncover 6
2895
- swap
2896
- concat
2897
- // contracts/plonk_bls12381.algo.ts:359
2898
- // const { D: d, F: f } = calculateDF(proof, challenges, vk, L[1] as Uint256);
2899
- extract 96 96
2900
2956
  // contracts/plonk_bls12381.algo.ts:64
2901
2957
  // return (a * b) % BLS12_381_SCALAR_MODULUS;
2902
2958
  uncover 5
2903
- uncover 12
2959
+ uncover 11
2904
2960
  b*
2905
2961
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2906
2962
  b%
2907
- // contracts/plonk_bls12381.algo.ts:784-787
2963
+ // contracts/plonk_bls12381.algo.ts:867-870
2908
2964
  // let e = frSub(
2909
2965
  // frMul((challenges.v[1] as Uint256).native, proof.eval_a.native),
2910
2966
  // r0.native,
@@ -2936,7 +2992,7 @@ main_after_while@25:
2936
2992
  // contracts/plonk_bls12381.algo.ts:64
2937
2993
  // return (a * b) % BLS12_381_SCALAR_MODULUS;
2938
2994
  uncover 4
2939
- uncover 8
2995
+ uncover 9
2940
2996
  b*
2941
2997
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
2942
2998
  b%
@@ -3021,14 +3077,14 @@ main_after_while@25:
3021
3077
  b+
3022
3078
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
3023
3079
  b%
3024
- // contracts/plonk_bls12381.algo.ts:800
3080
+ // contracts/plonk_bls12381.algo.ts:883
3025
3081
  // const res = g1TimesFr(G1_ONE.toFixed({ length: 96 }), e);
3026
3082
  pushbytes 0x17f1d3a73197d7942695638c4fa9ac0fc3688c4f9774b905a14e3a3f171bac586c55e83ff97a1aeffb3af00adb22c6bb08b3f481e3aaa0f1a09e30ed741d8ae4fcf5e095d5d00af600db18cb2c04b3edd03cc744a2888ae40caa232946c5e7e1
3027
- // contracts/plonk_bls12381.algo.ts:223
3083
+ // contracts/plonk_bls12381.algo.ts:230
3028
3084
  // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
3029
3085
  swap
3030
3086
  ec_scalar_mul BLS12_381g1
3031
- // contracts/plonk_bls12381.algo.ts:223-225
3087
+ // contracts/plonk_bls12381.algo.ts:230-232
3032
3088
  // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
3033
3089
  // length: 96,
3034
3090
  // });
@@ -3037,12 +3093,12 @@ main_after_while@25:
3037
3093
  intc_0 // 96
3038
3094
  ==
3039
3095
  assert // Length must be 96
3040
- // contracts/plonk_bls12381.algo.ts:223
3096
+ // contracts/plonk_bls12381.algo.ts:230
3041
3097
  // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
3042
- dig 29
3098
+ dig 41
3043
3099
  dig 3
3044
3100
  ec_scalar_mul BLS12_381g1
3045
- // contracts/plonk_bls12381.algo.ts:223-225
3101
+ // contracts/plonk_bls12381.algo.ts:230-232
3046
3102
  // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
3047
3103
  // length: 96,
3048
3104
  // });
@@ -3051,12 +3107,12 @@ main_after_while@25:
3051
3107
  intc_0 // 96
3052
3108
  ==
3053
3109
  assert // Length must be 96
3054
- // contracts/plonk_bls12381.algo.ts:234
3110
+ // contracts/plonk_bls12381.algo.ts:241
3055
3111
  // return op.EllipticCurve.add(op.Ec.BLS12_381g1, p1, p2).toFixed({
3056
- dig 24
3112
+ dig 31
3057
3113
  swap
3058
3114
  ec_add BLS12_381g1
3059
- // contracts/plonk_bls12381.algo.ts:234-236
3115
+ // contracts/plonk_bls12381.algo.ts:241-243
3060
3116
  // return op.EllipticCurve.add(op.Ec.BLS12_381g1, p1, p2).toFixed({
3061
3117
  // length: 96,
3062
3118
  // });
@@ -3072,27 +3128,27 @@ main_after_while@25:
3072
3128
  b*
3073
3129
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
3074
3130
  b%
3075
- // contracts/plonk_bls12381.algo.ts:832
3131
+ // contracts/plonk_bls12381.algo.ts:915
3076
3132
  // ROOT_OF_UNITY,
3077
- bytec_3 // TMPL_ROOT_OF_UNITY
3133
+ bytec 6 // TMPL_ROOT_OF_UNITY
3078
3134
  // contracts/plonk_bls12381.algo.ts:64
3079
3135
  // return (a * b) % BLS12_381_SCALAR_MODULUS;
3080
3136
  b*
3081
3137
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
3082
3138
  b%
3083
- // contracts/plonk_bls12381.algo.ts:834
3139
+ // contracts/plonk_bls12381.algo.ts:917
3084
3140
  // const pairingScalars = op.concat(challenges.xi.bytes, b32(s));
3085
3141
  callsub b32
3086
3142
  uncover 5
3087
3143
  swap
3088
3144
  concat
3089
- // contracts/plonk_bls12381.algo.ts:836-840
3145
+ // contracts/plonk_bls12381.algo.ts:919-923
3090
3146
  // let B1 = op.EllipticCurve.scalarMulMulti(
3091
3147
  // op.Ec.BLS12_381g1,
3092
3148
  // pairingPoints,
3093
3149
  // pairingScalars,
3094
3150
  // ).toFixed({ length: 96 });
3095
- dig 21
3151
+ dig 32
3096
3152
  swap
3097
3153
  ec_multi_scalar_mul BLS12_381g1
3098
3154
  dup
@@ -3100,11 +3156,11 @@ main_after_while@25:
3100
3156
  intc_0 // 96
3101
3157
  ==
3102
3158
  assert // Length must be 96
3103
- // contracts/plonk_bls12381.algo.ts:234
3159
+ // contracts/plonk_bls12381.algo.ts:241
3104
3160
  // return op.EllipticCurve.add(op.Ec.BLS12_381g1, p1, p2).toFixed({
3105
3161
  uncover 3
3106
3162
  ec_add BLS12_381g1
3107
- // contracts/plonk_bls12381.algo.ts:234-236
3163
+ // contracts/plonk_bls12381.algo.ts:241-243
3108
3164
  // return op.EllipticCurve.add(op.Ec.BLS12_381g1, p1, p2).toFixed({
3109
3165
  // length: 96,
3110
3166
  // });
@@ -3113,14 +3169,28 @@ main_after_while@25:
3113
3169
  intc_0 // 96
3114
3170
  ==
3115
3171
  assert // Length must be 96
3116
- // contracts/plonk_bls12381.algo.ts:254
3117
- // return g1Add(p, g1Neg(q));
3172
+ // contracts/plonk_bls12381.algo.ts:230
3173
+ // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
3118
3174
  uncover 2
3119
- callsub g1Neg
3120
- // contracts/plonk_bls12381.algo.ts:234
3175
+ // contracts/plonk_bls12381.algo.ts:252
3176
+ // return g1TimesFr(p, R_MINUS_1);
3177
+ bytec 4 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000000
3178
+ // contracts/plonk_bls12381.algo.ts:230
3179
+ // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
3180
+ ec_scalar_mul BLS12_381g1
3181
+ // contracts/plonk_bls12381.algo.ts:230-232
3182
+ // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
3183
+ // length: 96,
3184
+ // });
3185
+ dup
3186
+ len
3187
+ intc_0 // 96
3188
+ ==
3189
+ assert // Length must be 96
3190
+ // contracts/plonk_bls12381.algo.ts:241
3121
3191
  // return op.EllipticCurve.add(op.Ec.BLS12_381g1, p1, p2).toFixed({
3122
3192
  ec_add BLS12_381g1
3123
- // contracts/plonk_bls12381.algo.ts:234-236
3193
+ // contracts/plonk_bls12381.algo.ts:241-243
3124
3194
  // return op.EllipticCurve.add(op.Ec.BLS12_381g1, p1, p2).toFixed({
3125
3195
  // length: 96,
3126
3196
  // });
@@ -3129,16 +3199,16 @@ main_after_while@25:
3129
3199
  intc_0 // 96
3130
3200
  ==
3131
3201
  assert // Length must be 96
3132
- // contracts/plonk_bls12381.algo.ts:223
3202
+ // contracts/plonk_bls12381.algo.ts:230
3133
3203
  // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
3134
3204
  swap
3135
- // contracts/plonk_bls12381.algo.ts:245
3205
+ // contracts/plonk_bls12381.algo.ts:252
3136
3206
  // return g1TimesFr(p, R_MINUS_1);
3137
3207
  bytec 4 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000000
3138
- // contracts/plonk_bls12381.algo.ts:223
3208
+ // contracts/plonk_bls12381.algo.ts:230
3139
3209
  // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
3140
3210
  ec_scalar_mul BLS12_381g1
3141
- // contracts/plonk_bls12381.algo.ts:223-225
3211
+ // contracts/plonk_bls12381.algo.ts:230-232
3142
3212
  // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
3143
3213
  // length: 96,
3144
3214
  // });
@@ -3147,11 +3217,11 @@ main_after_while@25:
3147
3217
  intc_0 // 96
3148
3218
  ==
3149
3219
  assert // Length must be 96
3150
- // contracts/plonk_bls12381.algo.ts:847
3220
+ // contracts/plonk_bls12381.algo.ts:930
3151
3221
  // op.concat(g1Neg(A1), B1), // G1 points
3152
3222
  swap
3153
3223
  concat
3154
- // contracts/plonk_bls12381.algo.ts:848
3224
+ // contracts/plonk_bls12381.algo.ts:931
3155
3225
  // op.concat(vk.X_2, G2_ONE), // G2 points
3156
3226
  swap
3157
3227
  intc 20 // 800
@@ -3159,25 +3229,24 @@ main_after_while@25:
3159
3229
  extract3
3160
3230
  pushbytes 0x024aa2b2f08f0a91260805272dc51051c6e47ad4fa403b02b4510b647ae3d1770bac0326a805bbefd48056c8c121bdb813e02b6052719f607dacd3a088274f65596bd0d09920b61ab5da61bbdc7f5049334cf11213945d57e5ac7d055d042b7e0ce5d527727d6e118cc9cdc6da2e351aadfd9baa8cbdd3a76d429a695160d12c923ac9cc3baca289e193548608b828010606c4a02ea734cc32acd2b02bc28b99cb3e287e85a763af267492ab572e99ab3f370d275cec1da1aaa9075ff05f79be
3161
3231
  concat
3162
- // contracts/plonk_bls12381.algo.ts:845-849
3232
+ // contracts/plonk_bls12381.algo.ts:928-932
3163
3233
  // const res = op.EllipticCurve.pairingCheck(
3164
3234
  // op.Ec.BLS12_381g1,
3165
3235
  // op.concat(g1Neg(A1), B1), // G1 points
3166
3236
  // op.concat(vk.X_2, G2_ONE), // G2 points
3167
3237
  // );
3168
3238
  ec_pairing_check BLS12_381g1
3169
- // contracts/verifier.algo.ts:95
3170
- // assert(verifyFromTemplate(signals, proof), "Verification failed");
3239
+ // contracts/verifier.algo.ts:120
3240
+ // assert(verifyFromTemplate(signals, proof, lw), "Verification failed");
3171
3241
  assert // Verification failed
3172
- // contracts/verifier.algo.ts:97
3242
+ // contracts/verifier.algo.ts:122
3173
3243
  // return true;
3174
3244
  intc_3 // 1
3175
3245
  return
3176
3246
 
3177
- main_ternary_false@18:
3247
+ main_ternary_false@28:
3178
3248
  dig 5
3179
- bury 8
3180
- b main_ternary_merge@19
3249
+ b main_ternary_merge@29
3181
3250
 
3182
3251
 
3183
3252
  // contracts/plonk_bls12381.algo.ts::frSub(a: bytes, b: bytes) -> bytes:
@@ -3231,40 +3300,12 @@ b32:
3231
3300
  retsub
3232
3301
 
3233
3302
 
3234
- // contracts/plonk_bls12381.algo.ts::g1Neg(p: bytes) -> bytes:
3235
- g1Neg:
3236
- // contracts/plonk_bls12381.algo.ts:244
3237
- // function g1Neg(p: bytes<96>): bytes<96> {
3238
- proto 1 1
3239
- // contracts/plonk_bls12381.algo.ts:223
3240
- // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
3241
- frame_dig -1
3242
- // contracts/plonk_bls12381.algo.ts:245
3243
- // return g1TimesFr(p, R_MINUS_1);
3244
- bytec 4 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000000
3245
- // contracts/plonk_bls12381.algo.ts:223
3246
- // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
3247
- ec_scalar_mul BLS12_381g1
3248
- // contracts/plonk_bls12381.algo.ts:223-225
3249
- // return op.EllipticCurve.scalarMul(op.Ec.BLS12_381g1, p, Bytes(s)).toFixed({
3250
- // length: 96,
3251
- // });
3252
- dup
3253
- len
3254
- intc_0 // 96
3255
- ==
3256
- assert // Length must be 96
3257
- // contracts/plonk_bls12381.algo.ts:245
3258
- // return g1TimesFr(p, R_MINUS_1);
3259
- retsub
3260
-
3261
-
3262
3303
  // contracts/plonk_bls12381.algo.ts::getChallenge(td: bytes) -> bytes:
3263
3304
  getChallenge:
3264
- // contracts/plonk_bls12381.algo.ts:423
3305
+ // contracts/plonk_bls12381.algo.ts:517
3265
3306
  // export function getChallenge(td: bytes): Uint256 {
3266
3307
  proto 1 1
3267
- // contracts/plonk_bls12381.algo.ts:424
3308
+ // contracts/plonk_bls12381.algo.ts:518
3268
3309
  // let hash = op.keccak256(td);
3269
3310
  frame_dig -1
3270
3311
  keccak256
@@ -3272,7 +3313,7 @@ getChallenge:
3272
3313
  // return a % BLS12_381_SCALAR_MODULUS;
3273
3314
  bytec_0 // 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001
3274
3315
  b%
3275
- // contracts/plonk_bls12381.algo.ts:425
3316
+ // contracts/plonk_bls12381.algo.ts:519
3276
3317
  // return new Uint256(frScalar(BigUint(hash)));
3277
3318
  dup
3278
3319
  len
@@ -4589,7 +4630,7 @@ async function getLagrangeWitness(proof, signals, algorand, vkBytes, rootOfUnity
4589
4630
  onComplete: import_algosdk5.OnApplicationComplete.DeleteApplicationOC
4590
4631
  });
4591
4632
  const simResult = await algorand.newGroup().addTransaction(calcTxn.transactions[0]).simulate({
4592
- extraOpcodeBudget: 700 * 255,
4633
+ extraOpcodeBudget: 2e4 * 16,
4593
4634
  skipSignatures: true
4594
4635
  });
4595
4636
  const log = simResult.confirmations[0].logs.at(-1);