Consensys / gnark

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. The library is open source and developed under the Apache 2.0 license
https://hackmd.io/@gnark
Apache License 2.0
1.43k stars 368 forks source link

Odd behavior with hint #727

Open kevjue opened 1 year ago

kevjue commented 1 year ago

I am using a hint to help perform arithmetic operations within Goldilocks. When the proof is being generated, the number of times the hint function is called is much higher than the number of times the calling function is called (there should be a one-to-one mapping).

Also, I see at least one invocation of the hint function with parameters that was NOT explicitly passed to it via the calling function.

I encounter this issue only when using the Assert.ProverSucceeded function and not when using the test.isSolved one.

Here is a link to the circuit frontend function that is using the hint: https://github.com/succinctlabs/gnark-plonky2-verifier/blob/30c64a3084bdc641079d7fcc024632d1df4cc751/field/goldilocks.go#L145

Here is a link to the hint function: https://github.com/succinctlabs/gnark-plonky2-verifier/blob/30c64a3084bdc641079d7fcc024632d1df4cc751/field/goldilocks.go#L168

We are currently using Gnark 0.8 (https://github.com/succinctlabs/gnark-plonky2-verifier/blob/30c64a3084bdc641079d7fcc024632d1df4cc751/go.mod#L6) with this PR cherry picked.

kevjue commented 1 year ago

One thought I had is that this may be related to this closed (and merged) issue.

The function in question does take inputs values that were produced by another hint function (specifically from the gnark's std emulated field reduce function).

Specifically, the code will first call this function: https://github.com/succinctlabs/gnark-plonky2-verifier/blob/30c64a3084bdc641079d7fcc024632d1df4cc751/poseidon/poseidon.go#L94

and then will shortly call this function:

https://github.com/succinctlabs/gnark-plonky2-verifier/blob/30c64a3084bdc641079d7fcc024632d1df4cc751/poseidon/poseidon.go#L143

gbotrel commented 1 year ago

hi -- didn't check in details, but it could also be that assert.PoverSucceeded by default may run some fuzz test. Can you reproduce with test.NoFuzzing option?

kevjue commented 1 year ago

hi -- didn't check in details, but it could also be that assert.PoverSucceeded by default may run some fuzz test. Can you reproduce with test.NoFuzzing option?

It is running it with that option. It's running it like so:

    assert.ProverSucceeded(
        &circuit,
        &witness,
        test.WithBackends(backend.GROTH16),
        test.WithCurves(ecc.BN254),
        test.NoFuzzing(),
        test.NoSerialization(),
    )