search

Consensys / corset

4 stars 10 forks source link

Incorrect Constant-Time Exponent Evaluation #95

Closed DavePearce closed 1 month ago

DavePearce commented 1 month ago

Currently, the corset tool can respond with an error such as:

thread 'main' panicked at src/exporters/wizardiop.rs:118:21:
Exponent `4222230874714185212124412469390773265687949667577031913967616727958704619521` is too large

However, it doesn't provide any information about where in the original source the error occurred. It would be nice to fix this!

DavePearce commented 1 month ago

This input file illustrates the error:

(module test)
(defcolumns A)
(defconstraint test () (vanishes! (^ A 2)))

To recreate, use the following:

corset wizard-iop test.lisp
DavePearce commented 1 month ago

UPDATE for some reason the 2 in (^ A 2) is being translated as the large constant above. For example, running the above with this command:

cargo run -- debug -Nceeeex exp.lisp

Gives this:

test.test :=
A^4222230874714185212124412469390773265687949667577031913967616727958704619521

So, it looks to me like this is an encoding / decoding bug. That is, before unrolling the exponent, we should be decoding it from the field format. Is that even possible?

NOTE: The above can of course be translated as (* A A) which works fine.