Halo2 Solidity Verifier

⚠️ This repo has NOT been audited and is NOT intended for a production environment yet.

Solidity verifier generator for halo2 proof with KZG polynomial commitment scheme on BN254.

For audited solidity verifier generator and proof aggregation toolkits, please refer to snark-verifier.

Usage

Generate verifier and verifying key separately as 2 solidity contracts

let generator = SolidityGenerator::new(&params, &vk, Bdfg21, num_instances);
let (verifier_solidity, vk_solidity) = generator.render_separately().unwrap();

Check examples/separately.rs for more details.

Generate verifier and verifying key in a single solidity contract

let generator = SolidityGenerator::new(&params, &vk, Bdfg21, num_instances);
let verifier_solidity = generator.render().unwrap();

Encode proof into calldata to invoke verifyProof

let calldata = encode_calldata(vk_address, &proof, &instances);

Note that function selector is already included.

Limitations & Caveats

• It only allows circuit with less or equal than 1 instance column and no rotated query to this instance column.
• Currently even the configure is same, the selector compression might lead to different configuration when selector assignments are different. To avoid this, please use keygen_vk_custom with compress_selectors: false to do key generation without selector compression.

Compatibility

The Keccak256Transcript behaves exactly same as the EvmTranscript in snark-verifier.

Design Rationale

The current solidity verifier generator within snark-verifier faces a couple of issues:

• The generator receives only unoptimized, low-level operations, such as add or mul. As a result, it currently unrolls all assembly codes, making it susceptible to exceeding the contract size limit, even with a moderately sized circuit.
• The existing solution involves complex abstractions and APIs for consumers.

This repository is a ground-up rebuild, addressing these concerns while maintaining a focus on code size and readability. Remarkably, the gas cost is comparable, if not slightly lower, than the one generated by snark-verifier.

Acknowledgement

The template is heavily inspired by Aztec's BaseUltraVerifier.sol.