Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Move current decider public inputs into actual private inputs to reduce gas costs #139

Open
arnaucube opened this issue Aug 8, 2024 · 0 comments

Comments

@arnaucube
Copy link
Collaborator

Current decider circuit has a lot of public inputs, which increase the gas cost of the verification method in the solidity contract, since for the Groth16 verification we compute a scalar mult (of BN254's G1) for each input in the contract.

Next step is to do the usual trick in these cases: moving most of those public inputs to be 'private inputs' in the DeciderEthCircuit, and computing a hash of them, which is the actual public input of the circuit. Thin in-circuit the old-public-inputs are now private inputs, which are hashed and check to match the hash-value that is a public input. The hash used can be a sha256, which is available both in solidity and in arkworks r1cs constraints.

The idea is that it is cheaper to hash all those inputs in the contract and feed the hash as public input to the Groth16 proof verification (onchain), rather than not computing the hash and having to do a scalar mult for each public input.

This should be done both in the current Nova decider circuit & HyperNova decider circuit, along as the solidity verifier template, and should reduce substantially the gas cost of onchain verification.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant