[Contract Verification] <The zkp verify verification fails. Procedure>

[linyoufa]

Environment

Testnet

Issue Type

• Plugin
• Block Explorer

Contract Address

0x3F981a3c4840e2E3b101763613E857c778E0A4Bb

Compiler Type

Single file

zkSolc Version

1.3.16

Solc Version

0.8.21

Contract Name

Groth16Verifier

Contract Code

// SPDX-License-Identifier: GPL-3.0
/*
Copyright 2021 0KIMS association.

This file is generated with [snarkJS](https://github.com/iden3/snarkjs).

snarkJS is a free software: you can redistribute it and/or modify it
under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

snarkJS is distributed in the hope that it will be useful, but WITHOUT
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
License for more details.

You should have received a copy of the GNU General Public License
along with snarkJS. If not, see <https://www.gnu.org/licenses/>.

*/

pragma solidity >=0.7.0 <0.9.0;

contract Groth16Verifier {
// Scalar field size
uint256 constant r = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
// Base field size
uint256 constant q = 21888242871839275222246405745257275088696311157297823662689037894645226208583;

// Verification Key data
uint256 constant alphax  = 20491192805390485299153009773594534940189261866228447918068658471970481763042;
uint256 constant alphay  = 9383485363053290200918347156157836566562967994039712273449902621266178545958;
uint256 constant betax1  = 4252822878758300859123897981450591353533073413197771768651442665752259397132;
uint256 constant betax2  = 6375614351688725206403948262868962793625744043794305715222011528459656738731;
uint256 constant betay1  = 21847035105528745403288232691147584728191162732299865338377159692350059136679;
uint256 constant betay2  = 10505242626370262277552901082094356697409835680220590971873171140371331206856;
uint256 constant gammax1 = 11559732032986387107991004021392285783925812861821192530917403151452391805634;
uint256 constant gammax2 = 10857046999023057135944570762232829481370756359578518086990519993285655852781;
uint256 constant gammay1 = 4082367875863433681332203403145435568316851327593401208105741076214120093531;
uint256 constant gammay2 = 8495653923123431417604973247489272438418190587263600148770280649306958101930;
uint256 constant deltax1 = 19301718125788177289359057038155992011617420598318383933989338261372595098008;
uint256 constant deltax2 = 21678067987862082773324907900864583665481704973108402827754971075776600652017;
uint256 constant deltay1 = 9299757637290746480298824648012639995869180331470315771344423756455999336097;
uint256 constant deltay2 = 21747240198805717818156693836321798361422396852985566894642293770726721136074;


uint256 constant IC0x = 14801473274876370275171811026844501759480175579782327993025658766239309405494;
uint256 constant IC0y = 21204293731432057926335125676961809555917275686059058193661051557218908911472;

uint256 constant IC1x = 3817954621529185832843941115848659263477690857429567561045030420289721495229;
uint256 constant IC1y = 9377449058685894634591683423399035896779863068644258623398841787971156163625;

uint256 constant IC2x = 17855172876806932911947971644767270989354093280587012996052869138618321657759;
uint256 constant IC2y = 6450551523733213877240597323873997024559862717301423940088769135786352873184;


// Memory data
uint16 constant pVk = 0;
uint16 constant pPairing = 128;

uint16 constant pLastMem = 896;

function verifyProof(uint[2] calldata _pA, uint[2][2] calldata _pB, uint[2] calldata _pC, uint[2] calldata _pubSignals) public view returns (bool) {
    assembly {
        function checkField(v) {
            if iszero(lt(v, q)) {
                mstore(0, 0)
                return(0, 0x20)
            }
        }
        
        // G1 function to multiply a G1 value(x,y) to value in an address
        function g1_mulAccC(pR, x, y, s) {
            let success
            let mIn := mload(0x40)
            mstore(mIn, x)
            mstore(add(mIn, 32), y)
            mstore(add(mIn, 64), s)

            success := staticcall(sub(gas(), 2000), 7, mIn, 96, mIn, 64)

            if iszero(success) {
                mstore(0, 0)
                return(0, 0x20)
            }

            mstore(add(mIn, 64), mload(pR))
            mstore(add(mIn, 96), mload(add(pR, 32)))

            success := staticcall(sub(gas(), 2000), 6, mIn, 128, pR, 64)

            if iszero(success) {
                mstore(0, 0)
                return(0, 0x20)
            }
        }

        function checkPairing(pA, pB, pC, pubSignals, pMem) -> isOk {
            let _pPairing := add(pMem, pPairing)
            let _pVk := add(pMem, pVk)

            mstore(_pVk, IC0x)
            mstore(add(_pVk, 32), IC0y)

            // Compute the linear combination vk_x
            
            g1_mulAccC(_pVk, IC1x, IC1y, calldataload(add(pubSignals, 0)))
            
            g1_mulAccC(_pVk, IC2x, IC2y, calldataload(add(pubSignals, 32)))
            

            // -A
            mstore(_pPairing, calldataload(pA))
            mstore(add(_pPairing, 32), mod(sub(q, calldataload(add(pA, 32))), q))

            // B
            mstore(add(_pPairing, 64), calldataload(pB))
            mstore(add(_pPairing, 96), calldataload(add(pB, 32)))
            mstore(add(_pPairing, 128), calldataload(add(pB, 64)))
            mstore(add(_pPairing, 160), calldataload(add(pB, 96)))

            // alpha1
            mstore(add(_pPairing, 192), alphax)
            mstore(add(_pPairing, 224), alphay)

            // beta2
            mstore(add(_pPairing, 256), betax1)
            mstore(add(_pPairing, 288), betax2)
            mstore(add(_pPairing, 320), betay1)
            mstore(add(_pPairing, 352), betay2)

            // vk_x
            mstore(add(_pPairing, 384), mload(add(pMem, pVk)))
            mstore(add(_pPairing, 416), mload(add(pMem, add(pVk, 32))))


            // gamma2
            mstore(add(_pPairing, 448), gammax1)
            mstore(add(_pPairing, 480), gammax2)
            mstore(add(_pPairing, 512), gammay1)
            mstore(add(_pPairing, 544), gammay2)

            // C
            mstore(add(_pPairing, 576), calldataload(pC))
            mstore(add(_pPairing, 608), calldataload(add(pC, 32)))

            // delta2
            mstore(add(_pPairing, 640), deltax1)
            mstore(add(_pPairing, 672), deltax2)
            mstore(add(_pPairing, 704), deltay1)
            mstore(add(_pPairing, 736), deltay2)


            let success := staticcall(sub(gas(), 2000), 8, _pPairing, 768, _pPairing, 0x20)

            isOk := and(success, mload(_pPairing))
        }

        let pMem := mload(0x40)
        mstore(0x40, add(pMem, pLastMem))

        // Validate that all evaluations ? F
        
        checkField(calldataload(add(_pubSignals, 0)))
        
        checkField(calldataload(add(_pubSignals, 32)))
        
        checkField(calldataload(add(_pubSignals, 64)))
        

        // Validate all evaluations
        let isValid := checkPairing(_pA, _pB, _pC, _pubSignals, pMem)

        mstore(0, isValid)
         return(0, 0x20)
     }
 }

}

Constructor Arguments

none

Hardhat Verify Plugin Version

No response

Repo Link (Optional)

No response

Additional Details

_pA = ["0x033fffaeee702a355bcc900985fc034308055027a0cb9998fd4bbcf166b2e824",
"0x03c1accd8014d24cb1cbf9745baaffc5e6f6e008e2e306de7cccafff1fb0acf5"]
_pB = [["0x1c1e4c4bf387cb9235f5d04d555f943d3d97892ee1e55613289362e029f7909f",
"0x1ae845d574cb2bdcf86f7fdba3057a7efd4676098e21c71ebe33cf27624bac76"],
["0x0af4eb3524c6c95227ffeff54eacac35c48be9ca8c8cab27d5de23dd60d44f03",
"0x1482f81c4c907e4b83d6174656b2d20e2efdfa4f495837df34ef65b785fa8400"]]
_pC = ["0x1554bc398fa398239988160bc287afe712f2afcd09a2ae84de5001662c04c09c",
"0x1b3660eacf71ff609e1c1d14bf405d7431395841a66c0e14de11de74b7f13b4b"]
_pubSignals = ["0x00000000000000000000000000000000000000000000000000000000000010b8",
"0x0000000000000000000000000000000000000000000000000000000000000172"]

[linyoufa]

In addition to the question, the same code in Ethereum can be called normally and return true

[Romsters]

Hi @linyoufa, answered here

[vibern0]

I'm not sure what does this mean exactly. Using the same versions, I'm having the same problem, failing during hardhat test. Although, it does work on remix.

[bxpana]

@obernardovieira if you're still having issues with this you can open up another post so we can get all the necessary info to help.