all files / contracts/verifiers/ ReputationVerifier.sol

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
9×
9×
9×
9×
9×
9×
9×
9×
9×
9×
9×
 
 
 
 
 
 
 
 
 
 
 
 
9×
9×
9×
9×
 
9×
 
 
9×
 
 
9×
9×
 
9×
9×
 
9×
9×
 
9×
9×
 
 
 
9×
54×
54×
 
 
9×
 
9×
 
 
 
 
 
 
 
 
 
 
 
 
// SPDX-License-Identifier: MIT
 
pragma solidity ^0.8.0;
 
import {Pairing} from '../libraries/Pairing.sol';
 
contract ReputationVerifier {
 
    using Pairing for *;
 
    uint256 constant SNARK_SCALAR_FIELD = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
    uint256 constant PRIME_Q = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
 
    struct VerifyingKey {
        Pairing.G1Point alpha1;
        Pairing.G2Point beta2;
        Pairing.G2Point gamma2;
        Pairing.G2Point delta2;
        Pairing.G1Point[7] IC;
    }
 
    struct Proof {
        Pairing.G1Point A;
        Pairing.G2Point B;
        Pairing.G1Point C;
    }
 
    function verifyingKey() internal pure returns (VerifyingKey memory vk) {
        vk.alpha1 = Pairing.G1Point(uint256(20491192805390485299153009773594534940189261866228447918068658471970481763042),uint256(9383485363053290200918347156157836566562967994039712273449902621266178545958));
        vk.beta2 = Pairing.G2Point([uint256(4252822878758300859123897981450591353533073413197771768651442665752259397132),uint256(6375614351688725206403948262868962793625744043794305715222011528459656738731)], [uint256(21847035105528745403288232691147584728191162732299865338377159692350059136679),uint256(10505242626370262277552901082094356697409835680220590971873171140371331206856)]);
        vk.gamma2 = Pairing.G2Point([uint256(11559732032986387107991004021392285783925812861821192530917403151452391805634),uint256(10857046999023057135944570762232829481370756359578518086990519993285655852781)], [uint256(4082367875863433681332203403145435568316851327593401208105741076214120093531),uint256(8495653923123431417604973247489272438418190587263600148770280649306958101930)]);
        vk.delta2 = Pairing.G2Point([uint256(11800441128394969842755868552361097689274456099141474752048824282700544277973),uint256(3907574735689258556073597710090621074680222808865876861090843576964305785314)], [uint256(13797239694576935865264594295843556489025850925136555486738803260014646102309),uint256(18410197993021871301132138822449895680397642878374476399073525850148159034013)]);
        vk.IC[0] = Pairing.G1Point(uint256(20127220509530564833532062406759276098423736293101899996107125216165677669595),uint256(3876626058350390259704705021706297441377110327404039849062897974360231282980));
        vk.IC[1] = Pairing.G1Point(uint256(10465025065065026218891652775178327151152830178909032274817487179576031477351),uint256(7026375829661892348502728029872079929929410920177552937784736061916332003831));
        vk.IC[2] = Pairing.G1Point(uint256(728911340104385050304634877978911420713678929978133068139171616716743402875),uint256(3592021757871377853066959325290752975572216488542658935218072445870726077312));
        vk.IC[3] = Pairing.G1Point(uint256(12694020877579581673346817580105265665073182443646447595051500544565082849962),uint256(877944025101065026319760503925738653003166270435733219248431984493891070226));
        vk.IC[4] = Pairing.G1Point(uint256(7178137137102701384334568210009316577928073877621380896548012571394814113587),uint256(16138733351610365272168297158339095748907196905297258286251468464840485557015));
        vk.IC[5] = Pairing.G1Point(uint256(10165482625002467203073510852538933657548600525784083277974246465716944783305),uint256(18368732145693932434552059416914405133193665521527739122873464207771539166552));
        vk.IC[6] = Pairing.G1Point(uint256(13728312536078725837319858996939800595945892779852873761626683944082021987776),uint256(13956417114753724177710592956449414132208922051362632428729245204040032124809));
 
    }
 
    /*
     * @returns Whether the proof is valid given the hardcoded verifying key
     *          above and the public inputs
     */
    function verifyProof(
        uint256[] calldata input,
        uint256[8] calldata _proof
    ) public view returns (bool) {
 
        Proof memory proof;
        proof.A = Pairing.G1Point(_proof[0], _proof[1]);
        proof.B = Pairing.G2Point([_proof[2], _proof[3]], [_proof[4], _proof[5]]);
        proof.C = Pairing.G1Point(_proof[6], _proof[7]);
 
        VerifyingKey memory vk = verifyingKey();
 
        // Compute the linear combination vk_x
        Pairing.G1Point memory vk_x = Pairing.G1Point(0, 0);
 
        // Make sure that proof.A, B, and C are each less than the prime q
        Erequire(proof.A.X < PRIME_Q, "verifier-aX-gte-prime-q");
        Erequire(proof.A.Y < PRIME_Q, "verifier-aY-gte-prime-q");
 
        Erequire(proof.B.X[0] < PRIME_Q, "verifier-bX0-gte-prime-q");
        Erequire(proof.B.Y[0] < PRIME_Q, "verifier-bY0-gte-prime-q");
 
        Erequire(proof.B.X[1] < PRIME_Q, "verifier-bX1-gte-prime-q");
        Erequire(proof.B.Y[1] < PRIME_Q, "verifier-bY1-gte-prime-q");
 
        Erequire(proof.C.X < PRIME_Q, "verifier-cX-gte-prime-q");
        Erequire(proof.C.Y < PRIME_Q, "verifier-cY-gte-prime-q");
 
        // Make sure that every input is less than the snark scalar field
        //for (uint256 i = 0; i < input.length; i++) {
        for (uint256 i = 0; i < 6; i++) {
            Erequire(input[i] < SNARK_SCALAR_FIELD,"verifier-gte-snark-scalar-field");
            vk_x = Pairing.plus(vk_x, Pairing.scalar_mul(vk.IC[i + 1], input[i]));
        }
 
        vk_x = Pairing.plus(vk_x, vk.IC[0]);
 
        return Pairing.pairing(
            Pairing.negate(proof.A),
            proof.B,
            vk.alpha1,
            vk.beta2,
            vk_x,
            vk.gamma2,
            proof.C,
            vk.delta2
        );
    }
}