1#![allow(non_snake_case)]
  2#![allow(non_upper_case_globals)]
  3#![allow(non_camel_case_types)]
  4#![allow(clippy::upper_case_acronyms)]
  5
  6use ark_ec::{pairing::Pairing, CurveGroup};
  7use ark_ff::PrimeField;
  8use ark_std::rand::CryptoRng;
  9use ark_std::{fmt::Debug, rand::RngCore};
 10use thiserror::Error;
 11
 12use crate::frontend::FCircuit;
 13
 14pub mod ccs;
 15pub mod commitment;
 16pub mod constants;
 17pub mod folding;
 18pub mod frontend;
 19pub mod transcript;
 20pub mod utils;
 21
 22#[derive(Debug, Error)]
 23pub enum Error {
 24    // Wrappers on top of other errors
 25    #[error("ark_relations::r1cs::SynthesisError")]
 26    SynthesisError(#[from] ark_relations::r1cs::SynthesisError),
 27    #[error("ark_serialize::SerializationError")]
 28    SerializationError(#[from] ark_serialize::SerializationError),
 29    #[error("ark_poly_commit::Error")]
 30    PolyCommitError(#[from] ark_poly_commit::Error),
 31    #[error("crate::utils::espresso::virtual_polynomial::ArithErrors")]
 32    ArithError(#[from] utils::espresso::virtual_polynomial::ArithErrors),
 33    #[error(transparent)]
 34    ProtoGalaxy(folding::protogalaxy::ProtoGalaxyError),
 35    #[error("std::io::Error")]
 36    IOError(#[from] std::io::Error),
 37
 38    // Relation errors
 39    #[error("Relation not satisfied")]
 40    NotSatisfied,
 41    #[error("SNARK verification failed")]
 42    SNARKVerificationFail,
 43    #[error("IVC verification failed")]
 44    IVCVerificationFail,
 45    #[error("R1CS instance is expected to not be relaxed")]
 46    R1CSUnrelaxedFail,
 47    #[error("Could not find the inner ConstraintSystem")]
 48    NoInnerConstraintSystem,
 49    #[error("Sum-check prove failed: {0}")]
 50    SumCheckProveError(String),
 51    #[error("Sum-check verify failed: {0}")]
 52    SumCheckVerifyError(String),
 53
 54    // Comparators errors
 55    #[error("Not equal")]
 56    NotEqual,
 57    #[error("Vectors should have the same length ({0}: {1}, {2}: {3})")]
 58    NotSameLength(String, usize, String, usize),
 59    #[error("Vector's length ({0}) is not the expected ({1})")]
 60    NotExpectedLength(usize, usize),
 61    #[error("Vector ({0}) length ({1}) is not a power of two")]
 62    NotPowerOfTwo(String, usize),
 63    #[error("Can not be empty")]
 64    Empty,
 65    #[error("Value out of bounds")]
 66    OutOfBounds,
 67    #[error("Could not construct the Evaluation Domain")]
 68    NewDomainFail,
 69    #[error("The number of folded steps must be greater than 1")]
 70    NotEnoughSteps,
 71
 72    // Commitment errors
 73    #[error("Pedersen parameters length is not sufficient (generators.len={0} < vector.len={1} unsatisfied)")]
 74    PedersenParamsLen(usize, usize),
 75    #[error("Blinding factor not 0 for Commitment without hiding")]
 76    BlindingNotZero,
 77    #[error("Commitment verification failed")]
 78    CommitmentVerificationFail,
 79
 80    // Other
 81    #[error("{0}")]
 82    Other(String),
 83    #[error("Randomness for blinding not found")]
 84    MissingRandomness,
 85    #[error("Missing value: {0}")]
 86    MissingValue(String),
 87    #[error("Feature '{0}' not supported yet")]
 88    NotSupportedYet(String),
 89    #[error("Feature '{0}' is not supported and it will not be")]
 90    NotSupported(String),
 91    #[error("max i-th step reached (usize limit reached)")]
 92    MaxStep,
 93    #[error("Circom Witness calculation error: {0}")]
 94    WitnessCalculationError(String),
 95    #[error("BigInt to PrimeField conversion error: {0}")]
 96    BigIntConversionError(String),
 97}
 98
 99/// FoldingScheme defines trait that is implemented by the diverse folding schemes. It is defined
100/// over a cycle of curves (C1, C2), where:
101/// - C1 is the main curve, which ScalarField we use as our F for all the field operations
102/// - C2 is the auxiliary curve, which we use for the commitments, whose BaseField (for point
103/// coordinates) are in the C1::ScalarField.
104/// In other words, C1.Fq == C2.Fr, and C1.Fr == C2.Fq.
105pub trait FoldingScheme<C1: CurveGroup, C2: CurveGroup, FC>: Clone + Debug
106where
107    C1: CurveGroup<BaseField = C2::ScalarField, ScalarField = C2::BaseField>,
108    C2::BaseField: PrimeField,
109    FC: FCircuit<C1::ScalarField>,
110{
111    type PreprocessorParam: Debug;
112    type ProverParam: Debug;
113    type VerifierParam: Debug;
114    type CommittedInstanceWithWitness: Debug;
115    type CFCommittedInstanceWithWitness: Debug; // CycleFold CommittedInstance & Witness
116
117    fn preprocess(
118        prep_param: &Self::PreprocessorParam,
119    ) -> Result<(Self::ProverParam, Self::VerifierParam), Error>;
120
121    fn init(
122        pp: &Self::ProverParam,
123        step_circuit: FC,
124        z_0: Vec<C1::ScalarField>, // initial state
125    ) -> Result<Self, Error>;
126
127    fn prove_step(&mut self, external_inputs: Vec<C1::ScalarField>) -> Result<(), Error>;
128
129    // returns the state at the current step
130    fn state(&self) -> Vec<C1::ScalarField>;
131
132    // returns the instances at the current step, in the following order:
133    // (running_instance, incoming_instance, cyclefold_instance)
134    fn instances(
135        &self,
136    ) -> (
137        Self::CommittedInstanceWithWitness,
138        Self::CommittedInstanceWithWitness,
139        Self::CFCommittedInstanceWithWitness,
140    );
141
142    fn verify(
143        vp: Self::VerifierParam,
144        z_0: Vec<C1::ScalarField>, // initial state
145        z_i: Vec<C1::ScalarField>, // last state
146        // number of steps between the initial state and the last state
147        num_steps: C1::ScalarField,
148        running_instance: Self::CommittedInstanceWithWitness,
149        incoming_instance: Self::CommittedInstanceWithWitness,
150        cyclefold_instance: Self::CFCommittedInstanceWithWitness,
151    ) -> Result<(), Error>;
152}
153
154pub trait Decider<
155    C1: CurveGroup,
156    C2: CurveGroup,
157    FC: FCircuit<C1::ScalarField>,
158    FS: FoldingScheme<C1, C2, FC>,
159> where
160    C1: CurveGroup<BaseField = C2::ScalarField, ScalarField = C2::BaseField>,
161    C2::BaseField: PrimeField,
162{
163    type ProverParam: Clone;
164    type Proof;
165    type VerifierParam;
166    type PublicInput: Debug;
167    type CommittedInstanceWithWitness: Debug;
168    type CommittedInstance: Clone + Debug;
169
170    fn prove(
171        pp: Self::ProverParam,
172        rng: impl RngCore + CryptoRng,
173        folding_scheme: FS,
174    ) -> Result<Self::Proof, Error>;
175
176    fn verify(
177        vp: Self::VerifierParam,
178        i: C1::ScalarField,
179        z_0: Vec<C1::ScalarField>,
180        z_i: Vec<C1::ScalarField>,
181        running_instance: &Self::CommittedInstance,
182        incoming_instance: &Self::CommittedInstance,
183        proof: &Self::Proof,
184        // returns `Result<bool, Error>` to differentiate between an error occurred while performing
185        // the verification steps, and the verification logic of the scheme not passing.
186    ) -> Result<bool, Error>;
187}
188
189/// DeciderOnchain extends the Decider into preparing the calldata
190pub trait DeciderOnchain<E: Pairing, C1: CurveGroup, C2: CurveGroup>
191where
192    C1: CurveGroup<BaseField = C2::ScalarField, ScalarField = C2::BaseField>,
193    C2::BaseField: PrimeField,
194{
195    type Proof;
196    type CommittedInstance: Clone + Debug;
197
198    fn prepare_calldata(
199        i: C1::ScalarField,
200        z_0: Vec<C1::ScalarField>,
201        z_i: Vec<C1::ScalarField>,
202        running_instance: &Self::CommittedInstance,
203        incoming_instance: &Self::CommittedInstance,
204        proof: Self::Proof,
205    ) -> Result<Vec<u8>, Error>;
206}