Starky proof is generated but can't be verified

[Dimo99]

I am trying to use the starky_bls12_381 library, and there is a specific case where a certain STARK is generated but fails to verify, showing a Mismatch between evaluation and opening of quotient polynomial error. I have described this issue in more detail here: issue link.

Because the proof is generated successfully and has the correct public inputs, I suspect this might actually be a problem with starky. The code uses an old version of Plonky2, but I am also reproducing the error with the latest Plonky2 version here: example link.

[Nashtare]

Hi! I've had a quick look at your code. It seems the issue lies in the following function calls when defining the constraints:

add_fp12_multiplication_constraints(local_values, next_values, yield_constr, FINAL_EXP_OP_OFFSET, Some(local_values[FINAL_EXP_MUL_SELECTOR]));
add_cyclotomic_exp_constraints(local_values, next_values, yield_constr, FINAL_EXP_OP_OFFSET, Some(local_values[FINAL_EXP_CYCLOTOMIC_EXP_SELECTOR]));

I checked that native & recursive constraints match, so you most likely replicated the errors in both methods. I haven't had the time to dive much more into it, but I'd suggest spending some time auditing the method to try identify where the issue lies.

Orthogonally, you'd probably benefit from testing all individual modules within your main FinalExponentiateStark, especially during development, as it should be pretty helpful for debugging to identify easily where the issue lies (although at the moment it seems your test suite is broken).

[Nashtare]

Just realized this isn't your repo 😅 You'll probably want to report this finding upstream for them to investigate!