-
Notifications
You must be signed in to change notification settings - Fork 526
Description
Problem Statement
Doing a batch_mul()
with a point whose abscissa is a witness and the ordinate is a constant value is crashing because the point, being not constant (due to x), is assumed to have witnesses for both abscissa and ordinate.
This can be seen in _unconditional_add_or_subtract()
:
Constantness is true only if all are constants:
is_constant() const { return x.is_constant() && y.is_constant() && _is_infinity.is_constant(); }
But it if is false, the code uses both witness index:
// Both points are witnesses - create result witness and construct ECC add constraint
result = cycle_group(witness_t(context, x3), witness_t(context, y3), /*is_infinity=*/false);
context->create_ecc_add_gate(bb::ecc_add_gate_<bb::fr>{
.x1 = x.get_witness_index(),
.y1 = y.get_witness_index(),
.x2 = other.x.get_witness_index(),
.y2 = other.y.get_witness_index(),
.x3 = result.x.get_witness_index(),
.y3 = result.y.get_witness_index(),
.sign_coefficient = is_addition ? 1 : -1,
});
Proposed Solution
This case should only be taken if ! x.is_constant() && !y.is_constant()
, and the mixed cases need to be taken into account.
Example Use Case
Run the TestMSM unit test from #16663, but change this value:
msm_constrain.points[0].value = fr(0); // bad input
(right after having defining msm_constrain.points)
This will cause the 'valid_point' (computed inside create_multi_scalar_mul_constraint()
) to have x as a witness and as a constant.
Alternative Solutions
No response
Additional Context
No response