matter-labs-archive / groth16batchverifier Goto Github PK

The implementation in https://github.com/matter-labs/Groth16BatchVerifier/blob/master/BatchedSnarkVerifier/contracts/BatchVerifier.sol doesn't appear to do any G₂ subgroup checks. See appendix B.2 of the Zcash Protocol Specification for the required checks.

This is broken.

The attack description is here.

I propose to use hashes of input data to calculate the entropy safely.

In solidity v0.8.21 the verifyBatch function returns innerError: [Eip838ExecutionError: execution reverted: Failed to call pairings functions]

const VK_STATIC = {
"scheme": "g16",
"curve": "bn128",
"alpha": [
"0x0e4ca801d4c30cfbeb53a9e7d3bfbbf57fa7d1a45a1cdc013de5295be8b51a17",
"0x26524c015118e1228e949df6e6cc159ddc024538519603eed8f72722b73b4371"
],
"beta": [
[
"0x105ad2df6d83b41b5d2c316ba5528b7d5f6d4f742359f0e60623819ac5ef667f",
"0x2bc89acc3ab8e4e819998570830a01885531015c542263fbe960b2455ac3ad5f"
],
[
"0x2edb5aa4f971757771f0a3648548b0e0a24b6dc33a6c0360e8408b5a53980b57",
"0x0fb49bf989c44b1058625ee975eef7c7f289f427ab64820368e6ee4b5c5116b7"
]
],
"gamma": [
[
"0x0bceab4875593efe0dfb423725f0ca8db72778c94dbbb098ccb091c0a580275c",
"0x0df6f7454c05c5a86521fb32065948908cdc7876006968c1efc92f644390175f"
],
[
"0x13fc0bf9967ad55528d71e0d2915876406753f727f08cd62f4349b5280b373d8",
"0x11f53fd258ec7cede95be13c0fb0adaa7d9793290ed07a50cd4603fe5e17307e"
]
],
"delta": [
[
"0x1740051b26a59e3d406d8442c79a28fa56e6d160036c5f8417a508366bc6d810",
"0x2b82a5f05a0efb0b3196ee670104d17f4c80c145f1b0ecc895593fdb39aff4d6"
],
[
"0x1920f196065efcc201d6a939c23e6304f924250fec62ca1abf67c64db29c4ef8",
"0x2ab92b2816177b7c701d5804a60f363c7402d7fffd887e7224edbf06ea89b088"
]
],
"gamma_abc": [
[
"0x0951b233d6da93bd1126cd6077e553bf32f26ce9b45976d598d978de1e33e6ce",
"0x301debbc62079b5a88dd8699af8dc74a35290966e5a2f8d0db4163f836a4df89"
],
[
"0x0319dadb1c17925366819e960b4a56c445cf1ddebcc0f1bd8ac71b5666c935fa",
"0x1e91261b5c523b14cb8f3711bc7a450c268231e6edec46ec69bf0f06ebda48f7"
],
[
"0x2d3201295b10e13bc4295afb07177323a254330658aeca41ab736f3aa3bc9ee8",
"0x1ef51ba5d912f9d4312ff37d6688ef42900857fbd9515840a2a0528987a1b675"
]
]
};
const PROOF_STATIC = {
"A": [
"0x2e5725978ccc597372da1514b031fd3401424c18493e1c7109b63e16d7e67837",
"0x1508d0fa3c542913d4b77ea588a0f8939d2b877c14938cbfbaf305efdeba835c"
],
"B": [
[
"0x03df2b4b180b51495064770b9a246fc98e07f97cc068699d175270e76c4ea224",
"0x2fea6dd47587ed38f280bd691e643ea0b0a2ab92d3d944425b8374e1d89dcbf4"
],
[
"0x19f4b9678bfef7ed7c3368cd58f7221a15a14fe18f42f1707d645dee6144345f",
"0x2f018f9a5043dc11716bd5e4da1ad2ac020211498d930e1008e3013881e46322"
]
],
"C": [
"0x2311d123213f18add4bd3dec50603493a37c00da62c6b9067703efb9f8b05b2d",
"0x0849632ea1cac51ce8129cbf8ca05e4521482ad6bc65ba0d8dbb3d9fa79e94c9"
],
"input": [
"0x0000000000000000000000000000000000000000000000000000000000000003",
"0x000000000000000000000000000000000000000000000000000000000000000c"
]
};

The link in "Full construction description is here." is broken.