1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 | 9× 9× 9× 9× 9× 9× 9× 9× 9× 9× 9× 9× 9× 9× 9× 9× 9× 9× 9× 9× 9× 9× 9× 27× 27× 9× 9× | // SPDX-License-Identifier: MIT pragma solidity ^0.8.0; import {Pairing} from '../libraries/Pairing.sol'; contract EpochKeyLiteVerifier { using Pairing for *; uint256 constant SNARK_SCALAR_FIELD = 21888242871839275222246405745257275088548364400416034343698204186575808495617; uint256 constant PRIME_Q = 21888242871839275222246405745257275088696311157297823662689037894645226208583; struct VerifyingKey { Pairing.G1Point alpha1; Pairing.G2Point beta2; Pairing.G2Point gamma2; Pairing.G2Point delta2; Pairing.G1Point[4] IC; } struct Proof { Pairing.G1Point A; Pairing.G2Point B; Pairing.G1Point C; } function verifyingKey() internal pure returns (VerifyingKey memory vk) { vk.alpha1 = Pairing.G1Point(uint256(20491192805390485299153009773594534940189261866228447918068658471970481763042),uint256(9383485363053290200918347156157836566562967994039712273449902621266178545958)); vk.beta2 = Pairing.G2Point([uint256(4252822878758300859123897981450591353533073413197771768651442665752259397132),uint256(6375614351688725206403948262868962793625744043794305715222011528459656738731)], [uint256(21847035105528745403288232691147584728191162732299865338377159692350059136679),uint256(10505242626370262277552901082094356697409835680220590971873171140371331206856)]); vk.gamma2 = Pairing.G2Point([uint256(11559732032986387107991004021392285783925812861821192530917403151452391805634),uint256(10857046999023057135944570762232829481370756359578518086990519993285655852781)], [uint256(4082367875863433681332203403145435568316851327593401208105741076214120093531),uint256(8495653923123431417604973247489272438418190587263600148770280649306958101930)]); vk.delta2 = Pairing.G2Point([uint256(13440073023333568585915204219913195347997266995659265899894771850348588361834),uint256(18069859885325288396008498523218189912958851354102141460392940549542930997863)], [uint256(21626399128563581756107278303388592546767160123600828542428642232860002752206),uint256(14750730693953113210939040464378321694511113873730680724564180748452836806444)]); vk.IC[0] = Pairing.G1Point(uint256(7449672843618338464302280671357613678500572860719122801209186410199964253416),uint256(8351311048654030689845730145246643861414415074803607975964203284782983325098)); vk.IC[1] = Pairing.G1Point(uint256(17809798735977039640417201064957289900381171940729675310831962710959737170352),uint256(680850245166524493879474704527965725037117173181668897208622619145418897576)); vk.IC[2] = Pairing.G1Point(uint256(3877905053385454329636634061538977496453984828927975319785346843413811637661),uint256(14597260238391043161945453942625778124582929962766302701202563135373486199131)); vk.IC[3] = Pairing.G1Point(uint256(12538806930854531087967615263425785962942171766086120739107190337827184612957),uint256(10524427675379808366986969955627893084653374301272300823188374452786105439815)); } /* * @returns Whether the proof is valid given the hardcoded verifying key * above and the public inputs */ function verifyProof( uint256[] calldata input, uint256[8] calldata _proof ) public view returns (bool) { Proof memory proof; proof.A = Pairing.G1Point(_proof[0], _proof[1]); proof.B = Pairing.G2Point([_proof[2], _proof[3]], [_proof[4], _proof[5]]); proof.C = Pairing.G1Point(_proof[6], _proof[7]); VerifyingKey memory vk = verifyingKey(); // Compute the linear combination vk_x Pairing.G1Point memory vk_x = Pairing.G1Point(0, 0); // Make sure that proof.A, B, and C are each less than the prime q Erequire(proof.A.X < PRIME_Q, "verifier-aX-gte-prime-q"); Erequire(proof.A.Y < PRIME_Q, "verifier-aY-gte-prime-q"); Erequire(proof.B.X[0] < PRIME_Q, "verifier-bX0-gte-prime-q"); Erequire(proof.B.Y[0] < PRIME_Q, "verifier-bY0-gte-prime-q"); Erequire(proof.B.X[1] < PRIME_Q, "verifier-bX1-gte-prime-q"); Erequire(proof.B.Y[1] < PRIME_Q, "verifier-bY1-gte-prime-q"); Erequire(proof.C.X < PRIME_Q, "verifier-cX-gte-prime-q"); Erequire(proof.C.Y < PRIME_Q, "verifier-cY-gte-prime-q"); // Make sure that every input is less than the snark scalar field //for (uint256 i = 0; i < input.length; i++) { for (uint256 i = 0; i < 3; i++) { Erequire(input[i] < SNARK_SCALAR_FIELD,"verifier-gte-snark-scalar-field"); vk_x = Pairing.plus(vk_x, Pairing.scalar_mul(vk.IC[i + 1], input[i])); } vk_x = Pairing.plus(vk_x, vk.IC[0]); return Pairing.pairing( Pairing.negate(proof.A), proof.B, vk.alpha1, vk.beta2, vk_x, vk.gamma2, proof.C, vk.delta2 ); } } |