Why check public signals less than q instead of r in generated solidity code?

[Stumble]

Hey team,

If i understand correctly, in the following solidity proof verification contract template, it checks that all the public signals are less than q to make sure that signals are not "aliases".

snarkjs/templates/verifier_groth16.sol.ejs

Line 59 in e44656d

if iszero(lt(v, q)) {

I'm a bit confused about why it checks v < q instead of v < r. Isn't r the default prime for the finite field in circom?

[Divide-By-0]

bn254 is defined over the numbers 0-q, you can check the definition of q in that file corresponds to the size of the prime for BN254 in i.e. https://hackmd.io/@jpw/bn254 . It seems the public inputs should be checked against the size of the scalar field, not the base field, so I agree with this note.

But you're right that tornado cash checks those same public inputs against the scalar prime: https://github.com/tornadocash/tornado-core/blob/1ef6a263ac6a0e476d063fcb269a9df65a1bd56a/contracts/Verifier.sol#L199

[Stumble]

More context: https://github.com/tornadocash/tornado-core/blob/master/contracts/Verifier.sol#L216
tornado's implementation

[Stumble]

I'm leaning more towards the possibility that it's a bug now, since I found that the templates for fflonk and plonk are accurately checking against the scalar field size.

[Stumble]

Although I think it is neither a security issue or causing any trouble on production, but still created a PR to fix it: #480