Circuit is satisfied but plonk proof verification fails about bellman

[shamatar]

As far as I remember "is_satisfied" doesn't verify that gate that is tied to public input allocation. In any case you can just put a breakpoint inside a "is_satisfied" function and see a gate number or relation that fails. You can also do the same in verification function and check whether polynomial equality on random point fails (which I would guess), or something more exotic

[Schaeff]

I see, I don't have time to dig into it now so here are some other programs I tried which fail:

// fails in `log2_floor`
def main() { 
   return; 
}

// fails in `z_2.add_assign_scaled` inside `second_step_from_first_step`
def main(private field a, private field b) { 
   assert(a == b);
   return; 
}

// fails in `z_2.add_assign_scaled` inside `second_step_from_first_step`
def main(private field a, private field b) { 
   assert(a * a == b);
   return; 
}

// proof generated but not verified
def main(private field a, private field b) { 
   assert(a * a == b);
   assert(a * a == b);
   return; 
}

I am not using any public variable except ~one in any of these.

[georgwiese]

Debugging the program, all I can see is that the very last verification check fails, not sure how to go from there.

@shamatar Could you point me to a minimal working example going from a Circuit to a verified Plonk proof? Then I'd take it from there.

[shamatar]

Hey George.

There is a test, cargo test --release -- --nocapture test_prove_trivial_circuit that passes on my machine. I can see potential problems as:

• you are using better_cs subfolder implementation that is legacy and is more about the time when we transitioned form R1CS into Plonk arithmetization using transpiler. It works well in zkSync1 (actually using beta branch), but it's anyway legacy
• if you are using non-multithreaded implementation then it may contain problems by itself. Such case was never interesting for us, and while implementations are written such they should not depend on number of worker cores, it was never a focus point

I'm neglecting any trivial cases like if you used different trusted setups for VK and proving. The test above generates trusted setup as powers of 42, but it's not important for that test