Documentation
¶
Overview ¶
Blob‑evaluation proof (EIP‑4844 / Proto‑Danksharding)
Proves in‑circuit that Y = P(Z)
where P is the polynomial that commits to the 4096‑cell “blob” and
(Z,Y) is a claimed evaluation point.
All arithmetic over BLS12‑381 Fr is emulated on top of the native BN254 scalar field
The heavy division dᵢ−Y
qᵢ = ───────────────
ωᵢ−Z
is carried out as a hint and then verified inside the circuit.
Rationale:
• For every index i either:
(dᵢ−Y) = qᵢ·(ωᵢ−Z) if ωᵢ ≠ Z
qᵢ = 0 if ωᵢ = Z
holds, so the circuit forces the quotient values produced by the hint.
• We additionally enforce
Σ qᵢ·ωᵢ ≡ 0 (mod r)
which is satisfied if Y = P(Z) for a poly of degree < N.
With the per‑index equations this single sum rule is already sufficient;
References:
- https://docs.sotazk.org/docs/zk_rollups_after_eip4844/#point-evaluation-precompile
- https://github.com/Consensys/gnark/blob/master/std/evmprecompiles/10-kzg_point_evaluation.go
Code generated; DO NOT EDIT.
Index ¶
- Constants
- func ComputeEvaluationPoint(processID, rootHashBefore *big.Int, commitment types.KZGCommitment) (*big.Int, error)
- func ComputeEvaluationPointInCircuit(api frontend.API, processID frontend.Variable, ...) (frontend.Variable, error)
- func EvaluateBarycentricNative(blob *types.Blob, z *big.Int, debug bool) (*big.Int, error)
- func GetBlobData1() (*types.Blob, error)
- func GetBlobData2() (*types.Blob, error)
- func InvalidTestData() testData
- func ProgressiveTestData(seed int) testData
- func UnmarshalKZGCommitment(api frontend.API, compressedLimbs [3]frontend.Variable) (*sw_bls12381.G1Affine, error)
- func UnmarshalKZGProof(api frontend.API, compressedLimbs [3]frontend.Variable) (*sw_bls12381.G1Affine, error)
- func ValidTestData1() testData
- func ValidTestData2() testData
- func VerifyBarycentricEvaluation(api frontend.API, z *emulated.Element[FE], y *emulated.Element[FE], ...) error
- func VerifyFullBlobEvaluationBN254(api frontend.API, processID frontend.Variable, ...) error
- func VerifyKZGProof(api frontend.API, commitment *sw_bls12381.G1Affine, ...) error
- type BlobEvalData
- type FE
Constants ¶
const (
N = 1 << 12 // 4096 evaluation points
)
Variables ¶
This section is empty.
Functions ¶
func ComputeEvaluationPoint ¶
func ComputeEvaluationPoint(processID, rootHashBefore *big.Int, commitment types.KZGCommitment) (*big.Int, error)
ComputeEvaluationPoint computes evaluation point z using Poseidon hash. z = Poseidon(processID | rootHashBefore | C) where C is the KZG commitment split into 3 × 16-byte limbs. Note: the blob itself is not hashed because the commitment C is binding to it under the KZG scheme.
func ComputeEvaluationPointInCircuit ¶
func ComputeEvaluationPointInCircuit( api frontend.API, processID frontend.Variable, rootHashBefore frontend.Variable, commitmentLimbs [3]frontend.Variable, ) (frontend.Variable, error)
ComputeEvaluationPointInCircuit computes the evaluation point z in-circuit using Poseidon hash. This is the Gnark circuit version of ComputeEvaluationPoint. z = Poseidon(processID | rootHashBefore | C | blob) where C is the KZG commitment represented as 3 × 16-byte limbs.
func EvaluateBarycentricNative ¶
EvaluateBarycentricNative evaluates a polynomial in evaluation form using the barycentric formula. It has been implemented in Go to match the circuit logic and to debug potential issues. This function computes the barycentric evaluation of a KZG blob at a given evaluation point z.
The function implements the barycentric evaluation formula:
y = (z^4096 - 1) / 4096 * Σᵢ (dᵢ * ωᵢ / (z - ωᵢ))
Where:
- dᵢ are the blob data values (polynomial evaluations at domain points)
- ωᵢ are the roots of unity forming the evaluation domain
- z is the evaluation point
func GetBlobData1 ¶
GetBlobData1 returns the first embedded test blob data
func GetBlobData2 ¶
GetBlobData2 returns the second embedded test blob data
func InvalidTestData ¶
func InvalidTestData() testData
InvalidTestData returns test data with an invalid proof
func ProgressiveTestData ¶
func ProgressiveTestData(seed int) testData
ProgressiveTestData generates test data for progressive complexity tests
func UnmarshalKZGCommitment ¶
func UnmarshalKZGCommitment( api frontend.API, compressedLimbs [3]frontend.Variable, ) (*sw_bls12381.G1Affine, error)
UnmarshalKZGCommitment decompresses a KZG commitment from three 16-byte limbs. The commitment is a compressed BLS12-381 G1 point (48 bytes total).
func UnmarshalKZGProof ¶
func UnmarshalKZGProof( api frontend.API, compressedLimbs [3]frontend.Variable, ) (*sw_bls12381.G1Affine, error)
UnmarshalKZGProof decompresses a KZG proof from three 16-byte limbs. The proof is a compressed BLS12-381 G1 point (48 bytes total).
func ValidTestData1 ¶
func ValidTestData1() testData
ValidTestData1 returns a valid KZG proof test case
func ValidTestData2 ¶
func ValidTestData2() testData
ValidTestData2 returns another valid KZG proof test case with different values
func VerifyBarycentricEvaluation ¶
func VerifyBarycentricEvaluation( api frontend.API, z *emulated.Element[FE], y *emulated.Element[FE], blob [N]emulated.Element[FE], ) error
VerifyBarycentricEvaluation performs the barycentric evaluation verification.
IMPORTANT: This function does NOT verify the KZG commitment or proof. It only checks that Y = P(Z) where P is the polynomial interpolating the blob data. For full KZG verification including commitment and proof, use VerifyBlobEvaluationBN254.
This function can be imported and used by circuits that only need to verify the polynomial evaluation without the cryptographic commitment.
Parameters:
- api: The frontend API for circuit operations
- z: The evaluation point Z (BLS12-381 Fr)
- y: The claimed evaluation result Y (BLS12-381 Fr)
- blob: The blob data (4096 BLS12-381 Fr elements)
func VerifyFullBlobEvaluationBN254 ¶
func VerifyFullBlobEvaluationBN254( api frontend.API, processID frontend.Variable, rootHashBefore frontend.Variable, commitmentLimbs [3]frontend.Variable, proofLimbs [3]frontend.Variable, y *emulated.Element[FE], blob [N]frontend.Variable, ) error
VerifyFullBlobEvaluationBN254 performs COMPLETE blob verification including:
- In-circuit computation of evaluation point Z from processID, rootHashBefore, and commitment
- Barycentric evaluation: Y = P(Z) where P interpolates the blob
- KZG commitment verification: proves the commitment matches the blob
- KZG opening proof verification: proves Y is the correct evaluation at Z
Parameters:
- api: The frontend API for circuit operations
- processID: The process ID (native BN254 scalar)
- rootHashBefore: The root hash before state transition (native BN254 scalar)
- commitmentLimbs: The KZG commitment as 3 × 16-byte limbs
- proofLimbs: The KZG opening proof as 3 × 16-byte limbs
- y: The claimed evaluation result Y (emulated BLS12-381 Fr)
- blob: The blob data (4096 native BN254 scalars)
Returns an error if any verification step fails.
func VerifyKZGProof ¶
func VerifyKZGProof( api frontend.API, commitment *sw_bls12381.G1Affine, proof *sw_bls12381.G1Affine, z emulated.Element[sw_bls12381.ScalarField], y emulated.Element[sw_bls12381.ScalarField], ) error
VerifyKZGProof verifies a KZG opening proof using the EIP-4844 SRS. It checks that the commitment C opens at evaluation point z to value y.
Parameters:
- api: The circuit API
- commitment: The KZG commitment point (G1)
- proof: The KZG opening proof point (G1)
- z: The evaluation point (BLS12-381 scalar field element)
- y: The claimed value at z (BLS12-381 scalar field element)
Types ¶
type BlobEvalData ¶
type BlobEvalData struct {
ForGnark struct {
CommitmentLimbs [3]frontend.Variable
ProofLimbs [3]frontend.Variable
Y emulated.Element[FE]
Blob [N]frontend.Variable // values within bn254 field
}
Commitment types.KZGCommitment
CommitmentLimbs [3]*big.Int
Z *big.Int
Y *big.Int
Ylimbs [4]*big.Int
Blob *types.Blob
OpeningProof types.KZGProof
ProofLimbs [3]*big.Int
// Cell proofs for EIP-7594 (Fusaka upgrade)
// Each blob has CellProofsPerBlob (128) cell proofs
CellProofs [types.CellProofsPerBlob]types.KZGProof
}
BlobEvalData holds the evaluation data for a blob. It is useful for preparing data for zk-SNARK proving and Ethereum transactions.
func (*BlobEvalData) Set ¶
func (b *BlobEvalData) Set(blob *types.Blob, z *big.Int) (*BlobEvalData, error)
Set initializes the BlobEvalData with the given blob, claim, and evaluation point z. Computes the KZG cell proofs (EIP-7594) and sets the relevant fields. It returns itself for chaining.
func (*BlobEvalData) TxSidecar ¶
func (b *BlobEvalData) TxSidecar() *types.BlobTxSidecar
TxSidecar returns a BlobTxSidecar with a single KZG blob, commitment, and 128 cell proofs. Returns a Version 1 sidecar with cell proofs for EIP-7594 (Fusaka upgrade).
Source Files