|
| 1 | +use super::groth16_verifier_constants::{N_PUBLIC_INPUTS, vk, ic, precomputed_lines}; |
| 2 | + |
| 3 | +#[starknet::interface] |
| 4 | +trait IGroth16VerifierBN254<TContractState> { |
| 5 | + fn verify_groth16_proof_bn254( |
| 6 | + self: @TContractState, full_proof_with_hints: Span<felt252>, |
| 7 | + ) -> Option<Span<u256>>; |
| 8 | +} |
| 9 | + |
| 10 | +#[starknet::contract] |
| 11 | +mod Groth16VerifierBN254 { |
| 12 | + use starknet::SyscallResultTrait; |
| 13 | + use garaga::definitions::{G1Point, G1G2Pair}; |
| 14 | + use garaga::groth16::{multi_pairing_check_bn254_3P_2F_with_extra_miller_loop_result}; |
| 15 | + use garaga::ec_ops::{G1PointTrait, ec_safe_add}; |
| 16 | + use garaga::ec_ops_g2::{G2PointTrait}; |
| 17 | + use garaga::utils::calldata::{deserialize_full_proof_with_hints_bn254}; |
| 18 | + use super::{N_PUBLIC_INPUTS, vk, ic, precomputed_lines}; |
| 19 | + |
| 20 | + const ECIP_OPS_CLASS_HASH: felt252 = |
| 21 | + 0x70c1d1c709c75e3cf51d79d19cf7c84a0d4521f3a2b8bf7bff5cb45ee0dd289; |
| 22 | + use starknet::ContractAddress; |
| 23 | + |
| 24 | + #[storage] |
| 25 | + struct Storage {} |
| 26 | + |
| 27 | + #[abi(embed_v0)] |
| 28 | + impl IGroth16VerifierBN254 of super::IGroth16VerifierBN254<ContractState> { |
| 29 | + fn verify_groth16_proof_bn254( |
| 30 | + self: @ContractState, full_proof_with_hints: Span<felt252>, |
| 31 | + ) -> Option<Span<u256>> { |
| 32 | + // DO NOT EDIT THIS FUNCTION UNLESS YOU KNOW WHAT YOU ARE DOING. |
| 33 | + // This function returns an Option for the public inputs if the proof is valid. |
| 34 | + // If the proof is invalid, the execution will either fail or return None. |
| 35 | + // Read the documentation to learn how to generate the full_proof_with_hints array given |
| 36 | + // a proof and a verifying key. |
| 37 | + let fph = deserialize_full_proof_with_hints_bn254(full_proof_with_hints); |
| 38 | + let groth16_proof = fph.groth16_proof; |
| 39 | + let mpcheck_hint = fph.mpcheck_hint; |
| 40 | + let small_Q = fph.small_Q; |
| 41 | + let msm_hint = fph.msm_hint; |
| 42 | + |
| 43 | + groth16_proof.a.assert_on_curve(0); |
| 44 | + groth16_proof.b.assert_on_curve(0); |
| 45 | + groth16_proof.c.assert_on_curve(0); |
| 46 | + |
| 47 | + let ic = ic.span(); |
| 48 | + |
| 49 | + let vk_x: G1Point = match ic.len() { |
| 50 | + 0 => panic!("Malformed VK"), |
| 51 | + 1 => *ic.at(0), |
| 52 | + _ => { |
| 53 | + // Start serialization with the hint array directly to avoid copying it. |
| 54 | + let mut msm_calldata: Array<felt252> = msm_hint; |
| 55 | + // Add the points from VK and public inputs to the proof. |
| 56 | + Serde::serialize(@ic.slice(1, N_PUBLIC_INPUTS), ref msm_calldata); |
| 57 | + Serde::serialize(@groth16_proof.public_inputs, ref msm_calldata); |
| 58 | + // Complete with the curve indentifier (0 for BN254): |
| 59 | + msm_calldata.append(0); |
| 60 | + |
| 61 | + // Call the multi scalar multiplication endpoint on the Garaga ECIP ops contract |
| 62 | + // to obtain vk_x. |
| 63 | + let mut _vx_x_serialized = core::starknet::syscalls::library_call_syscall( |
| 64 | + ECIP_OPS_CLASS_HASH.try_into().unwrap(), |
| 65 | + selector!("msm_g1"), |
| 66 | + msm_calldata.span() |
| 67 | + ) |
| 68 | + .unwrap_syscall(); |
| 69 | + |
| 70 | + ec_safe_add( |
| 71 | + Serde::<G1Point>::deserialize(ref _vx_x_serialized).unwrap(), *ic.at(0), 0 |
| 72 | + ) |
| 73 | + } |
| 74 | + }; |
| 75 | + // Perform the pairing check. |
| 76 | + let check = multi_pairing_check_bn254_3P_2F_with_extra_miller_loop_result( |
| 77 | + G1G2Pair { p: vk_x, q: vk.gamma_g2 }, |
| 78 | + G1G2Pair { p: groth16_proof.c, q: vk.delta_g2 }, |
| 79 | + G1G2Pair { p: groth16_proof.a.negate(0), q: groth16_proof.b }, |
| 80 | + vk.alpha_beta_miller_loop_result, |
| 81 | + precomputed_lines.span(), |
| 82 | + mpcheck_hint, |
| 83 | + small_Q |
| 84 | + ); |
| 85 | + if check == true { |
| 86 | + return Option::Some(groth16_proof.public_inputs); |
| 87 | + } else { |
| 88 | + return Option::None; |
| 89 | + } |
| 90 | + } |
| 91 | + } |
| 92 | +} |
| 93 | + |
0 commit comments