Zellic - Audit Reports

Universal outer circuit

The universal outer circuit is specified in detail in spec/circuits/universal_outer.md.

\begin{figure}[H] \begin{adjustwidth}{-5cm}{0cm} % adjust the L and R margins \centering \includegraphics[width=1\linewidth]{./universalouter_keygen.png} \caption{Overview of the universal outer circuit key gneration implementation.} \label{fig:universalouter_keygen} \end{adjustwidth} \end{figure}

\begin{figure}[H] \centering \includegraphics[width=0.4\linewidth]{./universalouter_prover.png} \caption{Overview of the universal outer circuit proving implementation.} \label{fig:universalouter_prover} \end{figure}

Entry points

In the file utils.rs, the gen_outer_pk function is the entry point for generating the proving key of the outer circuit, whereas prove_outer is the entry point for the outer circuit proof generation.

Description

The circuit UniversalOuterCircuit implements the aggregation circuit in its inner field. When built by the keygen function, it takes as inputs the universal batch configuration and the Keccak circuit configuration thought the OuterKeygenInputs structure. The method expose_final_digest_and_constrain of UniversalOuterCircuit calls the Halo2 circuit builder for the AggregationCircuit as described in the "Snark Verifier" section of the specification. The copy constraints are added with the constrain_equal chip from Halo2 as described in the "Copy Constraints" section. The final Keccak digest is exposed at the end of the function as described in the "Expose Instance" section. Finally, the verifying and proving key of the circuit are generated respectively by the Halo2 function keygen_vk and keygen_pk, and the instance size is checked.

The prove_outer function checks the circuit parameters and computes the outer circuit input instance, the KZG accumulator and the Keccak digest. Then, it calls the gen_evm_proof function from Axiom's SNARK Verifier crate to generate the outer proof.