Skip to content

fix: skip default pp in sol aggregation #20521

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
iakovenkos merged 6 commits into from
Feb 16, 2026
+826 −665
Merged

fix: skip default pp in sol aggregation #20521

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a7e83e9
skip default pp in sol aggregation
iakovenkos Feb 14, 2026
c354859
[[maybe_unused]] for tags
iakovenkos Feb 14, 2026
9f8452c
update failure test to use arbitrary invalid points instead of (0,0)
ledwards2225 Feb 15, 2026
d7ebcbd
add a script checking that auto-gen hpp's are up-to-date
iakovenkos Feb 16, 2026
e343cf7
generate blake opt first
iakovenkos Feb 16, 2026
041050b
Merge branch 'merge-train/barretenberg' into si/fix-pp-in-sol
iakovenkos Feb 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
550 changes: 286 additions & 264 deletions barretenberg/cpp/src/barretenberg/dsl/acir_proofs/honk_contract.hpp
View file
Open in desktop
Copy link
Contributor Author

@iakovenkos iakovenkos Feb 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

mostly the changes from regeneration

Copy link
Collaborator

@ludamad ludamad Feb 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I dont like that we can get so out of date

Copy link
Contributor Author

@iakovenkos iakovenkos Feb 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we uncommit these?

Copy link
Collaborator

@ludamad ludamad Feb 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The smallest move, if we do want to manually check these diffs, is to add a test that it gets generated the same way

Large diffs are not rendered by default.

87 changes: 50 additions & 37 deletions barretenberg/cpp/src/barretenberg/dsl/acir_proofs/honk_optimized_contract.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3516,55 +3516,68 @@ contract HonkVerifier is IVerifier {
let p1_other_y := mload(PAIRING_POINT_1_Y_0_LOC)
p1_other_y := or(shl(136, mload(PAIRING_POINT_1_Y_1_LOC)), p1_other_y)
// Reconstructed coordinates must be < Q to prevent malleability
if iszero(and(
and(lt(p0_other_x, q), lt(p0_other_y, q)),
and(lt(p1_other_x, q), lt(p1_other_y, q))
)) {
mstore(0x00, VALUE_GE_GROUP_ORDER_SELECTOR)
revert(0x00, 0x04)
}
// Check if pairing points are default (all zero = infinity = no recursive verification)
let pairing_points_are_default := iszero(or(or(p0_other_x, p0_other_y), or(p1_other_x, p1_other_y)))
let success := 1
// Only aggregate if pairing points are non-default
if iszero(pairing_points_are_default) {
// Reconstructed coordinates must be < Q to prevent malleability
if iszero(and(
and(lt(p0_other_x, q), lt(p0_other_y, q)),
and(lt(p1_other_x, q), lt(p1_other_y, q))
)) {
mstore(0x00, VALUE_GE_GROUP_ORDER_SELECTOR)
revert(0x00, 0x04)
}
// Validate p_0_other not point of infinity
let success := iszero(iszero(or(p0_other_x, p0_other_y)))
// Validate p_1_other not point of infinity
success := and(success, iszero(iszero(or(p1_other_x, p1_other_y))))
// Validate p_0_other not point of infinity
success := iszero(iszero(or(p0_other_x, p0_other_y)))
// Validate p_1_other not point of infinity
success := and(success, iszero(iszero(or(p1_other_x, p1_other_y))))
// p_0
mstore(0x00, p0_other_x)
mstore(0x20, p0_other_y)
// p_0
mstore(0x00, p0_other_x)
mstore(0x20, p0_other_y)
// p_1
mstore(0x40, p1_other_x)
mstore(0x60, p1_other_y)
// p_1
mstore(0x40, p1_other_x)
mstore(0x60, p1_other_y)
// p_1_agg is already in the correct location
// p_1_agg is already in the correct location
let recursion_separator := keccak256(0x00, 0x100)
let recursion_separator := keccak256(0x00, 0x100)
// Write separator back to scratch space
mstore(0x00, p0_other_x)
// Write separator back to scratch space
mstore(0x00, p0_other_x)
mstore(0x40, recursion_separator)
// recursion_separator * p_0_other
success := and(success, staticcall(gas(), 0x07, 0x00, 0x60, 0x00, 0x40))
mstore(0x40, recursion_separator)
// recursion_separator * p_0_other
success := and(success, staticcall(gas(), 0x07, 0x00, 0x60, 0x00, 0x40))
// (recursion_separator * p_0_other) + p_0_agg
mcopy(0x40, 0x80, 0x40)
// p_0 = (recursion_separator * p_0_other) + p_0_agg
success := and(success, staticcall(gas(), 6, 0x00, 0x80, 0x00, 0x40))
// (recursion_separator * p_0_other) + p_0_agg
mcopy(0x40, 0x80, 0x40)
// p_0 = (recursion_separator * p_0_other) + p_0_agg
success := and(success, staticcall(gas(), 6, 0x00, 0x80, 0x00, 0x40))
mstore(0x40, p1_other_x)
mstore(0x60, p1_other_y)
mstore(0x80, recursion_separator)
mstore(0x40, p1_other_x)
mstore(0x60, p1_other_y)
mstore(0x80, recursion_separator)
success := and(success, staticcall(gas(), 7, 0x40, 0x60, 0x40, 0x40))
success := and(success, staticcall(gas(), 7, 0x40, 0x60, 0x40, 0x40))
// Write p_1_agg back to scratch space
mcopy(0x80, 0xc0, 0x40)
// Write p_1_agg back to scratch space
mcopy(0x80, 0xc0, 0x40)
// 0xc0 - (recursion_separator * p_1_other) + p_1_agg
success := and(success, staticcall(gas(), 6, 0x40, 0x80, 0xc0, 0x40))
// 0xc0 - (recursion_separator * p_1_other) + p_1_agg
success := and(success, staticcall(gas(), 6, 0x40, 0x80, 0xc0, 0x40))
}
// If default pairing points, use p_0_agg and p_1_agg directly (already at 0x80, 0xc0)
if pairing_points_are_default {
// Copy p_0_agg to 0x00 for pairing input
mcopy(0x00, 0x80, 0x40)
// p_1_agg stays at 0xc0
}
// G2 [1]
mstore(0x40, 0x198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c2)
Expand Down
Loading
Loading