From 7704f1d4a68decb870f2b2910f127eed80efc960 Mon Sep 17 00:00:00 2001
From: Thomas Piellard <thomas.piellard@consensys.net>
Date: Wed, 26 Oct 2022 18:57:41 +0200
Subject: [PATCH] fix: fixed Lagrange polynomials construction

---
 internal/backend/bls12-377/plonkfri/prove.go  |  3 ---
 internal/backend/bls12-377/plonkfri/verify.go | 25 +++++++++++++----
 internal/backend/bls12-381/plonkfri/prove.go  |  3 ---
 internal/backend/bls12-381/plonkfri/verify.go | 25 +++++++++++++----
 internal/backend/bls24-315/plonkfri/prove.go  |  3 ---
 internal/backend/bls24-315/plonkfri/verify.go | 25 +++++++++++++----
 internal/backend/bls24-317/plonkfri/prove.go  |  3 ---
 internal/backend/bls24-317/plonkfri/verify.go | 25 +++++++++++++----
 internal/backend/bn254/plonkfri/prove.go      |  3 ---
 internal/backend/bn254/plonkfri/verify.go     | 25 +++++++++++++----
 internal/backend/bw6-633/plonkfri/prove.go    |  3 ---
 internal/backend/bw6-633/plonkfri/verify.go   | 25 +++++++++++++----
 internal/backend/bw6-761/plonkfri/prove.go    |  3 ---
 internal/backend/bw6-761/plonkfri/verify.go   | 25 +++++++++++++----
 .../zkpschemes/plonkfri/plonk.prove.go.tmpl   |  3 ---
 .../zkpschemes/plonkfri/plonk.verify.go.tmpl  | 27 ++++++++++++++-----
 test/assert.go                                |  1 -
 17 files changed, 161 insertions(+), 66 deletions(-)

diff --git a/internal/backend/bls12-377/plonkfri/prove.go b/internal/backend/bls12-377/plonkfri/prove.go
index a9dd5a44e3..213719567b 100644
--- a/internal/backend/bls12-377/plonkfri/prove.go
+++ b/internal/backend/bls12-377/plonkfri/prove.go
@@ -231,9 +231,6 @@ func Prove(spr *cs.SparseR1CS, pk *ProvingKey, fullWitness bls12_377witness.Witn
 	bOpeningPosition.SetBytes(frOpeningPosition.Marshal()).Mod(&bOpeningPosition, &bFriSize)
 	openingPosition := bOpeningPosition.Uint64()
 
-	// derive a query position, which is 0<=i<domain[1].Size
-	// openingPosition := uint64(2)
-
 	// ql, qr, qm, qo, qkIncomplete
 	proof.OpeningsQlQrQmQoQkincompletemp[0], err = pk.Vk.Iopp.Open(pk.CQl, openingPosition)
 	if err != nil {
diff --git a/internal/backend/bls12-377/plonkfri/verify.go b/internal/backend/bls12-377/plonkfri/verify.go
index 3a4d7cfdb7..4c3c04b4c3 100644
--- a/internal/backend/bls12-377/plonkfri/verify.go
+++ b/internal/backend/bls12-377/plonkfri/verify.go
@@ -358,14 +358,22 @@ func completeQk(publicWitness bls12_377witness.Witness, vk *VerifyingKey, zeta f
 
 	var res fr.Element
 
-	// use L_i+1 = w*Li*(X-z**i)/(X-z**i+1)
+	// compute l1(zeta). Exceptional case: if zeta=1, then l1(zeta)=1,
+	// we need to manually initialise l to this value otherwise there
+	// is a denominator equal to zero in the formula.
 	var l, tmp, acc, one fr.Element
 	one.SetOne()
 	acc.SetOne()
-	l.Sub(&zeta, &one).Inverse(&l).Mul(&l, &vk.SizeInv)
-	tmp.Exp(zeta, big.NewInt(int64(vk.Size))).Sub(&tmp, &one)
-	l.Mul(&l, &tmp)
+	l.Sub(&zeta, &one)
+	if l.IsZero() {
+		l.SetOne()
+	} else {
+		l.Inverse(&l).Mul(&l, &vk.SizeInv)
+		tmp.Exp(zeta, big.NewInt(int64(vk.Size))).Sub(&tmp, &one)
+		l.Mul(&l, &tmp)
+	}
 
+	// use L_i+1 = w*Li*(X-z**i)/(X-z**i+1)
 	for i := 0; i < len(publicWitness); i++ {
 
 		tmp.Mul(&l, &publicWitness[i])
@@ -375,7 +383,14 @@ func completeQk(publicWitness bls12_377witness.Witness, vk *VerifyingKey, zeta f
 		l.Mul(&l, &tmp).Mul(&l, &vk.Generator)
 		acc.Mul(&acc, &vk.Generator)
 		tmp.Sub(&zeta, &acc)
-		l.Div(&l, &tmp)
+		// if tmp==0, then zeta=vk.Generator**i, so l_i(zeta)=1. We need
+		// to manually set the value to 1, exacty as in the case l_0 before
+		// the loop, otherwise the generic formula leads to a division by zero.
+		if tmp.IsZero() {
+			l.SetOne()
+		} else {
+			l.Div(&l, &tmp)
+		}
 	}
 
 	return res
diff --git a/internal/backend/bls12-381/plonkfri/prove.go b/internal/backend/bls12-381/plonkfri/prove.go
index 6afcbf250d..16b2248f10 100644
--- a/internal/backend/bls12-381/plonkfri/prove.go
+++ b/internal/backend/bls12-381/plonkfri/prove.go
@@ -231,9 +231,6 @@ func Prove(spr *cs.SparseR1CS, pk *ProvingKey, fullWitness bls12_381witness.Witn
 	bOpeningPosition.SetBytes(frOpeningPosition.Marshal()).Mod(&bOpeningPosition, &bFriSize)
 	openingPosition := bOpeningPosition.Uint64()
 
-	// derive a query position, which is 0<=i<domain[1].Size
-	// openingPosition := uint64(2)
-
 	// ql, qr, qm, qo, qkIncomplete
 	proof.OpeningsQlQrQmQoQkincompletemp[0], err = pk.Vk.Iopp.Open(pk.CQl, openingPosition)
 	if err != nil {
diff --git a/internal/backend/bls12-381/plonkfri/verify.go b/internal/backend/bls12-381/plonkfri/verify.go
index f348f632fd..276d297a57 100644
--- a/internal/backend/bls12-381/plonkfri/verify.go
+++ b/internal/backend/bls12-381/plonkfri/verify.go
@@ -358,14 +358,22 @@ func completeQk(publicWitness bls12_381witness.Witness, vk *VerifyingKey, zeta f
 
 	var res fr.Element
 
-	// use L_i+1 = w*Li*(X-z**i)/(X-z**i+1)
+	// compute l1(zeta). Exceptional case: if zeta=1, then l1(zeta)=1,
+	// we need to manually initialise l to this value otherwise there
+	// is a denominator equal to zero in the formula.
 	var l, tmp, acc, one fr.Element
 	one.SetOne()
 	acc.SetOne()
-	l.Sub(&zeta, &one).Inverse(&l).Mul(&l, &vk.SizeInv)
-	tmp.Exp(zeta, big.NewInt(int64(vk.Size))).Sub(&tmp, &one)
-	l.Mul(&l, &tmp)
+	l.Sub(&zeta, &one)
+	if l.IsZero() {
+		l.SetOne()
+	} else {
+		l.Inverse(&l).Mul(&l, &vk.SizeInv)
+		tmp.Exp(zeta, big.NewInt(int64(vk.Size))).Sub(&tmp, &one)
+		l.Mul(&l, &tmp)
+	}
 
+	// use L_i+1 = w*Li*(X-z**i)/(X-z**i+1)
 	for i := 0; i < len(publicWitness); i++ {
 
 		tmp.Mul(&l, &publicWitness[i])
@@ -375,7 +383,14 @@ func completeQk(publicWitness bls12_381witness.Witness, vk *VerifyingKey, zeta f
 		l.Mul(&l, &tmp).Mul(&l, &vk.Generator)
 		acc.Mul(&acc, &vk.Generator)
 		tmp.Sub(&zeta, &acc)
-		l.Div(&l, &tmp)
+		// if tmp==0, then zeta=vk.Generator**i, so l_i(zeta)=1. We need
+		// to manually set the value to 1, exacty as in the case l_0 before
+		// the loop, otherwise the generic formula leads to a division by zero.
+		if tmp.IsZero() {
+			l.SetOne()
+		} else {
+			l.Div(&l, &tmp)
+		}
 	}
 
 	return res
diff --git a/internal/backend/bls24-315/plonkfri/prove.go b/internal/backend/bls24-315/plonkfri/prove.go
index d875a0f7c1..6174f6756a 100644
--- a/internal/backend/bls24-315/plonkfri/prove.go
+++ b/internal/backend/bls24-315/plonkfri/prove.go
@@ -231,9 +231,6 @@ func Prove(spr *cs.SparseR1CS, pk *ProvingKey, fullWitness bls24_315witness.Witn
 	bOpeningPosition.SetBytes(frOpeningPosition.Marshal()).Mod(&bOpeningPosition, &bFriSize)
 	openingPosition := bOpeningPosition.Uint64()
 
-	// derive a query position, which is 0<=i<domain[1].Size
-	// openingPosition := uint64(2)
-
 	// ql, qr, qm, qo, qkIncomplete
 	proof.OpeningsQlQrQmQoQkincompletemp[0], err = pk.Vk.Iopp.Open(pk.CQl, openingPosition)
 	if err != nil {
diff --git a/internal/backend/bls24-315/plonkfri/verify.go b/internal/backend/bls24-315/plonkfri/verify.go
index 12be5675c3..c94a9f29ba 100644
--- a/internal/backend/bls24-315/plonkfri/verify.go
+++ b/internal/backend/bls24-315/plonkfri/verify.go
@@ -358,14 +358,22 @@ func completeQk(publicWitness bls24_315witness.Witness, vk *VerifyingKey, zeta f
 
 	var res fr.Element
 
-	// use L_i+1 = w*Li*(X-z**i)/(X-z**i+1)
+	// compute l1(zeta). Exceptional case: if zeta=1, then l1(zeta)=1,
+	// we need to manually initialise l to this value otherwise there
+	// is a denominator equal to zero in the formula.
 	var l, tmp, acc, one fr.Element
 	one.SetOne()
 	acc.SetOne()
-	l.Sub(&zeta, &one).Inverse(&l).Mul(&l, &vk.SizeInv)
-	tmp.Exp(zeta, big.NewInt(int64(vk.Size))).Sub(&tmp, &one)
-	l.Mul(&l, &tmp)
+	l.Sub(&zeta, &one)
+	if l.IsZero() {
+		l.SetOne()
+	} else {
+		l.Inverse(&l).Mul(&l, &vk.SizeInv)
+		tmp.Exp(zeta, big.NewInt(int64(vk.Size))).Sub(&tmp, &one)
+		l.Mul(&l, &tmp)
+	}
 
+	// use L_i+1 = w*Li*(X-z**i)/(X-z**i+1)
 	for i := 0; i < len(publicWitness); i++ {
 
 		tmp.Mul(&l, &publicWitness[i])
@@ -375,7 +383,14 @@ func completeQk(publicWitness bls24_315witness.Witness, vk *VerifyingKey, zeta f
 		l.Mul(&l, &tmp).Mul(&l, &vk.Generator)
 		acc.Mul(&acc, &vk.Generator)
 		tmp.Sub(&zeta, &acc)
-		l.Div(&l, &tmp)
+		// if tmp==0, then zeta=vk.Generator**i, so l_i(zeta)=1. We need
+		// to manually set the value to 1, exacty as in the case l_0 before
+		// the loop, otherwise the generic formula leads to a division by zero.
+		if tmp.IsZero() {
+			l.SetOne()
+		} else {
+			l.Div(&l, &tmp)
+		}
 	}
 
 	return res
diff --git a/internal/backend/bls24-317/plonkfri/prove.go b/internal/backend/bls24-317/plonkfri/prove.go
index 9969f200f2..f4dce8d0ec 100644
--- a/internal/backend/bls24-317/plonkfri/prove.go
+++ b/internal/backend/bls24-317/plonkfri/prove.go
@@ -231,9 +231,6 @@ func Prove(spr *cs.SparseR1CS, pk *ProvingKey, fullWitness bls24_317witness.Witn
 	bOpeningPosition.SetBytes(frOpeningPosition.Marshal()).Mod(&bOpeningPosition, &bFriSize)
 	openingPosition := bOpeningPosition.Uint64()
 
-	// derive a query position, which is 0<=i<domain[1].Size
-	// openingPosition := uint64(2)
-
 	// ql, qr, qm, qo, qkIncomplete
 	proof.OpeningsQlQrQmQoQkincompletemp[0], err = pk.Vk.Iopp.Open(pk.CQl, openingPosition)
 	if err != nil {
diff --git a/internal/backend/bls24-317/plonkfri/verify.go b/internal/backend/bls24-317/plonkfri/verify.go
index f4d32e9f4b..c5a249b182 100644
--- a/internal/backend/bls24-317/plonkfri/verify.go
+++ b/internal/backend/bls24-317/plonkfri/verify.go
@@ -358,14 +358,22 @@ func completeQk(publicWitness bls24_317witness.Witness, vk *VerifyingKey, zeta f
 
 	var res fr.Element
 
-	// use L_i+1 = w*Li*(X-z**i)/(X-z**i+1)
+	// compute l1(zeta). Exceptional case: if zeta=1, then l1(zeta)=1,
+	// we need to manually initialise l to this value otherwise there
+	// is a denominator equal to zero in the formula.
 	var l, tmp, acc, one fr.Element
 	one.SetOne()
 	acc.SetOne()
-	l.Sub(&zeta, &one).Inverse(&l).Mul(&l, &vk.SizeInv)
-	tmp.Exp(zeta, big.NewInt(int64(vk.Size))).Sub(&tmp, &one)
-	l.Mul(&l, &tmp)
+	l.Sub(&zeta, &one)
+	if l.IsZero() {
+		l.SetOne()
+	} else {
+		l.Inverse(&l).Mul(&l, &vk.SizeInv)
+		tmp.Exp(zeta, big.NewInt(int64(vk.Size))).Sub(&tmp, &one)
+		l.Mul(&l, &tmp)
+	}
 
+	// use L_i+1 = w*Li*(X-z**i)/(X-z**i+1)
 	for i := 0; i < len(publicWitness); i++ {
 
 		tmp.Mul(&l, &publicWitness[i])
@@ -375,7 +383,14 @@ func completeQk(publicWitness bls24_317witness.Witness, vk *VerifyingKey, zeta f
 		l.Mul(&l, &tmp).Mul(&l, &vk.Generator)
 		acc.Mul(&acc, &vk.Generator)
 		tmp.Sub(&zeta, &acc)
-		l.Div(&l, &tmp)
+		// if tmp==0, then zeta=vk.Generator**i, so l_i(zeta)=1. We need
+		// to manually set the value to 1, exacty as in the case l_0 before
+		// the loop, otherwise the generic formula leads to a division by zero.
+		if tmp.IsZero() {
+			l.SetOne()
+		} else {
+			l.Div(&l, &tmp)
+		}
 	}
 
 	return res
diff --git a/internal/backend/bn254/plonkfri/prove.go b/internal/backend/bn254/plonkfri/prove.go
index 5c04f11dde..7804234565 100644
--- a/internal/backend/bn254/plonkfri/prove.go
+++ b/internal/backend/bn254/plonkfri/prove.go
@@ -231,9 +231,6 @@ func Prove(spr *cs.SparseR1CS, pk *ProvingKey, fullWitness bn254witness.Witness,
 	bOpeningPosition.SetBytes(frOpeningPosition.Marshal()).Mod(&bOpeningPosition, &bFriSize)
 	openingPosition := bOpeningPosition.Uint64()
 
-	// derive a query position, which is 0<=i<domain[1].Size
-	// openingPosition := uint64(2)
-
 	// ql, qr, qm, qo, qkIncomplete
 	proof.OpeningsQlQrQmQoQkincompletemp[0], err = pk.Vk.Iopp.Open(pk.CQl, openingPosition)
 	if err != nil {
diff --git a/internal/backend/bn254/plonkfri/verify.go b/internal/backend/bn254/plonkfri/verify.go
index 6fd70e3389..acf25a37d9 100644
--- a/internal/backend/bn254/plonkfri/verify.go
+++ b/internal/backend/bn254/plonkfri/verify.go
@@ -358,14 +358,22 @@ func completeQk(publicWitness bn254witness.Witness, vk *VerifyingKey, zeta fr.El
 
 	var res fr.Element
 
-	// use L_i+1 = w*Li*(X-z**i)/(X-z**i+1)
+	// compute l1(zeta). Exceptional case: if zeta=1, then l1(zeta)=1,
+	// we need to manually initialise l to this value otherwise there
+	// is a denominator equal to zero in the formula.
 	var l, tmp, acc, one fr.Element
 	one.SetOne()
 	acc.SetOne()
-	l.Sub(&zeta, &one).Inverse(&l).Mul(&l, &vk.SizeInv)
-	tmp.Exp(zeta, big.NewInt(int64(vk.Size))).Sub(&tmp, &one)
-	l.Mul(&l, &tmp)
+	l.Sub(&zeta, &one)
+	if l.IsZero() {
+		l.SetOne()
+	} else {
+		l.Inverse(&l).Mul(&l, &vk.SizeInv)
+		tmp.Exp(zeta, big.NewInt(int64(vk.Size))).Sub(&tmp, &one)
+		l.Mul(&l, &tmp)
+	}
 
+	// use L_i+1 = w*Li*(X-z**i)/(X-z**i+1)
 	for i := 0; i < len(publicWitness); i++ {
 
 		tmp.Mul(&l, &publicWitness[i])
@@ -375,7 +383,14 @@ func completeQk(publicWitness bn254witness.Witness, vk *VerifyingKey, zeta fr.El
 		l.Mul(&l, &tmp).Mul(&l, &vk.Generator)
 		acc.Mul(&acc, &vk.Generator)
 		tmp.Sub(&zeta, &acc)
-		l.Div(&l, &tmp)
+		// if tmp==0, then zeta=vk.Generator**i, so l_i(zeta)=1. We need
+		// to manually set the value to 1, exacty as in the case l_0 before
+		// the loop, otherwise the generic formula leads to a division by zero.
+		if tmp.IsZero() {
+			l.SetOne()
+		} else {
+			l.Div(&l, &tmp)
+		}
 	}
 
 	return res
diff --git a/internal/backend/bw6-633/plonkfri/prove.go b/internal/backend/bw6-633/plonkfri/prove.go
index 41809c6149..456a7c7b25 100644
--- a/internal/backend/bw6-633/plonkfri/prove.go
+++ b/internal/backend/bw6-633/plonkfri/prove.go
@@ -231,9 +231,6 @@ func Prove(spr *cs.SparseR1CS, pk *ProvingKey, fullWitness bw6_633witness.Witnes
 	bOpeningPosition.SetBytes(frOpeningPosition.Marshal()).Mod(&bOpeningPosition, &bFriSize)
 	openingPosition := bOpeningPosition.Uint64()
 
-	// derive a query position, which is 0<=i<domain[1].Size
-	// openingPosition := uint64(2)
-
 	// ql, qr, qm, qo, qkIncomplete
 	proof.OpeningsQlQrQmQoQkincompletemp[0], err = pk.Vk.Iopp.Open(pk.CQl, openingPosition)
 	if err != nil {
diff --git a/internal/backend/bw6-633/plonkfri/verify.go b/internal/backend/bw6-633/plonkfri/verify.go
index ffad60e316..f14acbf3f1 100644
--- a/internal/backend/bw6-633/plonkfri/verify.go
+++ b/internal/backend/bw6-633/plonkfri/verify.go
@@ -358,14 +358,22 @@ func completeQk(publicWitness bw6_633witness.Witness, vk *VerifyingKey, zeta fr.
 
 	var res fr.Element
 
-	// use L_i+1 = w*Li*(X-z**i)/(X-z**i+1)
+	// compute l1(zeta). Exceptional case: if zeta=1, then l1(zeta)=1,
+	// we need to manually initialise l to this value otherwise there
+	// is a denominator equal to zero in the formula.
 	var l, tmp, acc, one fr.Element
 	one.SetOne()
 	acc.SetOne()
-	l.Sub(&zeta, &one).Inverse(&l).Mul(&l, &vk.SizeInv)
-	tmp.Exp(zeta, big.NewInt(int64(vk.Size))).Sub(&tmp, &one)
-	l.Mul(&l, &tmp)
+	l.Sub(&zeta, &one)
+	if l.IsZero() {
+		l.SetOne()
+	} else {
+		l.Inverse(&l).Mul(&l, &vk.SizeInv)
+		tmp.Exp(zeta, big.NewInt(int64(vk.Size))).Sub(&tmp, &one)
+		l.Mul(&l, &tmp)
+	}
 
+	// use L_i+1 = w*Li*(X-z**i)/(X-z**i+1)
 	for i := 0; i < len(publicWitness); i++ {
 
 		tmp.Mul(&l, &publicWitness[i])
@@ -375,7 +383,14 @@ func completeQk(publicWitness bw6_633witness.Witness, vk *VerifyingKey, zeta fr.
 		l.Mul(&l, &tmp).Mul(&l, &vk.Generator)
 		acc.Mul(&acc, &vk.Generator)
 		tmp.Sub(&zeta, &acc)
-		l.Div(&l, &tmp)
+		// if tmp==0, then zeta=vk.Generator**i, so l_i(zeta)=1. We need
+		// to manually set the value to 1, exacty as in the case l_0 before
+		// the loop, otherwise the generic formula leads to a division by zero.
+		if tmp.IsZero() {
+			l.SetOne()
+		} else {
+			l.Div(&l, &tmp)
+		}
 	}
 
 	return res
diff --git a/internal/backend/bw6-761/plonkfri/prove.go b/internal/backend/bw6-761/plonkfri/prove.go
index b1f8f40677..d0656a4b3f 100644
--- a/internal/backend/bw6-761/plonkfri/prove.go
+++ b/internal/backend/bw6-761/plonkfri/prove.go
@@ -231,9 +231,6 @@ func Prove(spr *cs.SparseR1CS, pk *ProvingKey, fullWitness bw6_761witness.Witnes
 	bOpeningPosition.SetBytes(frOpeningPosition.Marshal()).Mod(&bOpeningPosition, &bFriSize)
 	openingPosition := bOpeningPosition.Uint64()
 
-	// derive a query position, which is 0<=i<domain[1].Size
-	// openingPosition := uint64(2)
-
 	// ql, qr, qm, qo, qkIncomplete
 	proof.OpeningsQlQrQmQoQkincompletemp[0], err = pk.Vk.Iopp.Open(pk.CQl, openingPosition)
 	if err != nil {
diff --git a/internal/backend/bw6-761/plonkfri/verify.go b/internal/backend/bw6-761/plonkfri/verify.go
index 0470f63e8d..bd26a59a8f 100644
--- a/internal/backend/bw6-761/plonkfri/verify.go
+++ b/internal/backend/bw6-761/plonkfri/verify.go
@@ -358,14 +358,22 @@ func completeQk(publicWitness bw6_761witness.Witness, vk *VerifyingKey, zeta fr.
 
 	var res fr.Element
 
-	// use L_i+1 = w*Li*(X-z**i)/(X-z**i+1)
+	// compute l1(zeta). Exceptional case: if zeta=1, then l1(zeta)=1,
+	// we need to manually initialise l to this value otherwise there
+	// is a denominator equal to zero in the formula.
 	var l, tmp, acc, one fr.Element
 	one.SetOne()
 	acc.SetOne()
-	l.Sub(&zeta, &one).Inverse(&l).Mul(&l, &vk.SizeInv)
-	tmp.Exp(zeta, big.NewInt(int64(vk.Size))).Sub(&tmp, &one)
-	l.Mul(&l, &tmp)
+	l.Sub(&zeta, &one)
+	if l.IsZero() {
+		l.SetOne()
+	} else {
+		l.Inverse(&l).Mul(&l, &vk.SizeInv)
+		tmp.Exp(zeta, big.NewInt(int64(vk.Size))).Sub(&tmp, &one)
+		l.Mul(&l, &tmp)
+	}
 
+	// use L_i+1 = w*Li*(X-z**i)/(X-z**i+1)
 	for i := 0; i < len(publicWitness); i++ {
 
 		tmp.Mul(&l, &publicWitness[i])
@@ -375,7 +383,14 @@ func completeQk(publicWitness bw6_761witness.Witness, vk *VerifyingKey, zeta fr.
 		l.Mul(&l, &tmp).Mul(&l, &vk.Generator)
 		acc.Mul(&acc, &vk.Generator)
 		tmp.Sub(&zeta, &acc)
-		l.Div(&l, &tmp)
+		// if tmp==0, then zeta=vk.Generator**i, so l_i(zeta)=1. We need
+		// to manually set the value to 1, exacty as in the case l_0 before
+		// the loop, otherwise the generic formula leads to a division by zero.
+		if tmp.IsZero() {
+			l.SetOne()
+		} else {
+			l.Div(&l, &tmp)
+		}
 	}
 
 	return res
diff --git a/internal/generator/backend/template/zkpschemes/plonkfri/plonk.prove.go.tmpl b/internal/generator/backend/template/zkpschemes/plonkfri/plonk.prove.go.tmpl
index 2c731605bf..b8144f549b 100644
--- a/internal/generator/backend/template/zkpschemes/plonkfri/plonk.prove.go.tmpl
+++ b/internal/generator/backend/template/zkpschemes/plonkfri/plonk.prove.go.tmpl
@@ -209,9 +209,6 @@ func Prove(spr *cs.SparseR1CS, pk *ProvingKey, fullWitness {{ toLower .CurveID }
 	bOpeningPosition.SetBytes(frOpeningPosition.Marshal()).Mod(&bOpeningPosition, &bFriSize)
 	openingPosition := bOpeningPosition.Uint64()
 
-	// derive a query position, which is 0<=i<domain[1].Size
-	// openingPosition := uint64(2)
-
 	// ql, qr, qm, qo, qkIncomplete
 	proof.OpeningsQlQrQmQoQkincompletemp[0], err = pk.Vk.Iopp.Open(pk.CQl, openingPosition)
 	if err != nil {
diff --git a/internal/generator/backend/template/zkpschemes/plonkfri/plonk.verify.go.tmpl b/internal/generator/backend/template/zkpschemes/plonkfri/plonk.verify.go.tmpl
index 3ad83940ec..73342ebfe0 100644
--- a/internal/generator/backend/template/zkpschemes/plonkfri/plonk.verify.go.tmpl
+++ b/internal/generator/backend/template/zkpschemes/plonkfri/plonk.verify.go.tmpl
@@ -340,14 +340,22 @@ func completeQk(publicWitness {{ toLower .CurveID }}witness.Witness, vk *Verifyi
 
 	var res fr.Element
 
-	// use L_i+1 = w*Li*(X-z**i)/(X-z**i+1)
+	// compute l1(zeta). Exceptional case: if zeta=1, then l1(zeta)=1,
+	// we need to manually initialise l to this value otherwise there
+	// is a denominator equal to zero in the formula.
 	var l, tmp, acc, one fr.Element
 	one.SetOne()
 	acc.SetOne()
-	l.Sub(&zeta, &one).Inverse(&l).Mul(&l, &vk.SizeInv)
-	tmp.Exp(zeta, big.NewInt(int64(vk.Size))).Sub(&tmp, &one)
-	l.Mul(&l, &tmp)
+	l.Sub(&zeta, &one)
+	if l.IsZero() {
+		l.SetOne()
+	} else {
+		l.Inverse(&l).Mul(&l, &vk.SizeInv)
+		tmp.Exp(zeta, big.NewInt(int64(vk.Size))).Sub(&tmp, &one)
+		l.Mul(&l, &tmp)
+	}
 
+	// use L_i+1 = w*Li*(X-z**i)/(X-z**i+1)
 	for i := 0; i < len(publicWitness); i++ {
 
 		tmp.Mul(&l, &publicWitness[i])
@@ -357,8 +365,15 @@ func completeQk(publicWitness {{ toLower .CurveID }}witness.Witness, vk *Verifyi
 		l.Mul(&l, &tmp).Mul(&l, &vk.Generator)
 		acc.Mul(&acc, &vk.Generator)
 		tmp.Sub(&zeta, &acc)
-		l.Div(&l, &tmp)
+		// if tmp==0, then zeta=vk.Generator**i, so l_i(zeta)=1. We need
+		// to manually set the value to 1, exacty as in the case l_0 before
+		// the loop, otherwise the generic formula leads to a division by zero.
+		if tmp.IsZero() {
+			l.SetOne()
+		} else {
+			l.Div(&l, &tmp)
+		}
 	}
 
 	return res
-}
+}
\ No newline at end of file
diff --git a/test/assert.go b/test/assert.go
index 1bd0f2de5e..d63cf9d025 100644
--- a/test/assert.go
+++ b/test/assert.go
@@ -164,7 +164,6 @@ func (assert *Assert) ProverSucceeded(circuit frontend.Circuit, validAssignment
 					checkError(err)
 
 				case backend.PLONKFRI:
-
 					pk, vk, err := plonkfri.Setup(ccs)
 					checkError(err)