chonk.test.cpp

Go to the documentation of this file.

#include "barretenberg/chonk/chonk.hpp"
#include "barretenberg/chonk/mock_circuit_producer.hpp"
#include "barretenberg/chonk/test_bench_shared.hpp"
#include "barretenberg/common/assert.hpp"
#include "barretenberg/common/mem.hpp"
#include "barretenberg/common/test.hpp"
#include "barretenberg/ecc/curves/grumpkin/grumpkin.hpp"
#include "barretenberg/goblin/goblin.hpp"
#include "barretenberg/goblin/mock_circuits.hpp"
#include "barretenberg/serialize/msgpack_impl.hpp"
#include "barretenberg/stdlib_circuit_builders/mega_circuit_builder.hpp"
#include "barretenberg/stdlib_circuit_builders/ultra_circuit_builder.hpp"
#include "gtest/gtest.h"
 
using namespace bb;
 
static constexpr size_t SMALL_LOG_2_NUM_GATES = 5;
 
class ChonkTests : public ::testing::Test {
  protected:
    static void SetUpTestSuite() { bb::srs::init_file_crs_factory(bb::srs::bb_crs_path()); }
 
    using Flavor = Chonk::Flavor;
    using FF = typename Flavor::FF;
    using Commitment = Flavor::Commitment;
    using VerificationKey = Flavor::VerificationKey;
    using Builder = Chonk::ClientCircuit;
    using ProverInstance = Chonk::ProverInstance;
    using VerifierInstance = Chonk::VerifierInstance;
    using DeciderProver = Chonk::DeciderProver;
    using CircuitProducer = PrivateFunctionExecutionMockCircuitProducer;
 
  public:
    static void tamper_with_proof(HonkProof& proof, size_t public_inputs_offset)
    {
        // Tamper with the commitment in the proof
        Commitment commitment = FrCodec::deserialize_from_fields<Commitment>(
            std::span{ proof }.subspan(public_inputs_offset, FrCodec::template calc_num_fields<Commitment>()));
        commitment = commitment + Commitment::one();
        auto commitment_frs = FrCodec::serialize_to_fields<Commitment>(commitment);
        for (size_t idx = 0; idx < 4; ++idx) {
            proof[public_inputs_offset + idx] = commitment_frs[idx];
        }
    }
 
    static std::pair<Chonk::Proof, Chonk::VerificationKey> accumulate_and_prove_ivc(size_t num_app_circuits,
                                                                                    TestSettings settings = {},
                                                                                    bool check_circuit_sizes = false)
    {
        CircuitProducer circuit_producer(num_app_circuits);
        const size_t num_circuits = circuit_producer.total_num_circuits;
        Chonk ivc{ num_circuits };
 
        for (size_t j = 0; j < num_circuits; ++j) {
            circuit_producer.construct_and_accumulate_next_circuit(ivc, settings, check_circuit_sizes);
        }
        return { ivc.prove(), ivc.get_vk() };
    };
};
 
TEST_F(ChonkTests, TestCircuitSizes)
{
    const size_t NUM_APP_CIRCUITS = 2;
 
    // Check circuit sizes when no settings are passed
    {
        auto [proof, vk] = accumulate_and_prove_ivc(NUM_APP_CIRCUITS, {}, true);
        EXPECT_TRUE(Chonk::verify(proof, vk));
    }
 
    // Check circuit sizes when no settings are passed
    {
        auto [proof, vk] =
            accumulate_and_prove_ivc(NUM_APP_CIRCUITS, { .log2_num_gates = SMALL_LOG_2_NUM_GATES }, true);
        EXPECT_TRUE(Chonk::verify(proof, vk));
    }
};
 
TEST_F(ChonkTests, Basic)
{
    const size_t NUM_APP_CIRCUITS = 2;
    auto [proof, vk] = accumulate_and_prove_ivc(NUM_APP_CIRCUITS);
 
    EXPECT_TRUE(Chonk::verify(proof, vk));
};
 
TEST_F(ChonkTests, BadProofFailure)
{
    BB_DISABLE_ASSERTS(); // Disable assert in HN prover
 
    const size_t NUM_APP_CIRCUITS = 2;
    // Confirm that the IVC verifies if nothing is tampered with
    {
 
        CircuitProducer circuit_producer(NUM_APP_CIRCUITS);
        const size_t NUM_CIRCUITS = circuit_producer.total_num_circuits;
        Chonk ivc{ NUM_CIRCUITS };
        TestSettings settings{ .log2_num_gates = SMALL_LOG_2_NUM_GATES };
 
        // Construct and accumulate a set of mocked private function execution circuits
        for (size_t idx = 0; idx < NUM_CIRCUITS; ++idx) {
            circuit_producer.construct_and_accumulate_next_circuit(ivc, settings);
        }
        auto proof = ivc.prove();
        EXPECT_TRUE(Chonk::verify(proof, ivc.get_vk()));
    }
 
    // The IVC throws an exception if the FIRST fold proof is tampered with
    {
        CircuitProducer circuit_producer(NUM_APP_CIRCUITS);
        const size_t NUM_CIRCUITS = circuit_producer.total_num_circuits;
        Chonk ivc{ NUM_CIRCUITS };
 
        size_t num_public_inputs = 0;
 
        // Construct and accumulate a set of mocked private function execution circuits
        for (size_t idx = 0; idx < NUM_CIRCUITS; ++idx) {
            auto [circuit, vk] =
                circuit_producer.create_next_circuit_and_vk(ivc, { .log2_num_gates = SMALL_LOG_2_NUM_GATES });
            ivc.accumulate(circuit, vk);
 
            if (idx == 1) {
                num_public_inputs = circuit.num_public_inputs();
            }
 
            if (idx == 2) {
                EXPECT_EQ(ivc.verification_queue.size(), 2); // two proofs after 3 calls to accumulation
                tamper_with_proof(ivc.verification_queue[0].proof,
                                  num_public_inputs); // tamper with first proof
            }
        }
        auto proof = ivc.prove();
        EXPECT_FALSE(Chonk::verify(proof, ivc.get_vk()));
    }
 
    // The IVC fails if the SECOND fold proof is tampered with
    {
        CircuitProducer circuit_producer(NUM_APP_CIRCUITS);
        const size_t NUM_CIRCUITS = circuit_producer.total_num_circuits;
        Chonk ivc{ NUM_CIRCUITS };
 
        // Construct and accumulate a set of mocked private function execution circuits
        for (size_t idx = 0; idx < NUM_CIRCUITS; ++idx) {
            auto [circuit, vk] =
                circuit_producer.create_next_circuit_and_vk(ivc, { .log2_num_gates = SMALL_LOG_2_NUM_GATES });
            ivc.accumulate(circuit, vk);
 
            if (idx == 2) {
                EXPECT_EQ(ivc.verification_queue.size(), 2); // two proofs after 3 calls to accumulation
                tamper_with_proof(ivc.verification_queue[1].proof,
                                  circuit.num_public_inputs()); // tamper with second proof
            }
        }
        auto proof = ivc.prove();
        EXPECT_FALSE(Chonk::verify(proof, ivc.get_vk()));
    }
 
    // The IVC fails if the calldata of the Hiding Kernel is different from the return data of the Tail Kernels
    {
        CircuitProducer circuit_producer(NUM_APP_CIRCUITS);
        const size_t NUM_CIRCUITS = circuit_producer.total_num_circuits;
        Chonk ivc{ NUM_CIRCUITS };
 
        // Construct and accumulate a set of mocked private function execution circuits
        for (size_t idx = 0; idx < NUM_CIRCUITS; ++idx) {
            auto [circuit, vk] =
                circuit_producer.create_next_circuit_and_vk(ivc, { .log2_num_gates = SMALL_LOG_2_NUM_GATES });
            ivc.accumulate(circuit, vk);
        }
        auto proof = ivc.prove();
 
        // The public input after the PairingPoints is the commitment to the return data of the Tail kernel.
        tamper_with_proof(proof.mega_proof, PAIRING_POINTS_SIZE);
        EXPECT_FALSE(Chonk::verify(proof, ivc.get_vk()));
    }
 
    EXPECT_TRUE(true);
};
 
TEST_F(ChonkTests, WrongProofComponentFailure)
{
    // Produce two valid proofs
    auto [chonk_proof_1, chonk_vk_1] = accumulate_and_prove_ivc(/*num_app_circuits=*/1);
    {
        EXPECT_TRUE(Chonk::verify(chonk_proof_1, chonk_vk_1));
    }
 
    auto [chonk_proof_2, chonk_vk_2] = accumulate_and_prove_ivc(/*num_app_circuits=*/1);
    {
        EXPECT_TRUE(Chonk::verify(chonk_proof_2, chonk_vk_2));
    }
 
    {
        // Replace Merge proof
        Chonk::Proof tampered_proof = chonk_proof_1;
 
        tampered_proof.goblin_proof.merge_proof = chonk_proof_2.goblin_proof.merge_proof;
 
        EXPECT_THROW_OR_ABORT(Chonk::verify(tampered_proof, chonk_vk_1), ".*IPA verification fails.*");
    }
 
    {
        // Replace Hiding kernel proof
        Chonk::Proof tampered_proof = chonk_proof_1;
 
        tampered_proof.mega_proof = chonk_proof_2.mega_proof;
 
        EXPECT_THROW_OR_ABORT(Chonk::verify(tampered_proof, chonk_vk_1), ".*IPA verification fails.*");
    }
 
    {
        // Replace ECCVM proof
        Chonk::Proof tampered_proof = chonk_proof_1;
 
        tampered_proof.goblin_proof.eccvm_proof = chonk_proof_2.goblin_proof.eccvm_proof;
 
        EXPECT_THROW_OR_ABORT(Chonk::verify(tampered_proof, chonk_vk_1), ".*IPA verification fails.*");
    }
 
    {
        // Replace Translator proof
        Chonk::Proof tampered_proof = chonk_proof_1;
 
        tampered_proof.goblin_proof.translator_proof = chonk_proof_2.goblin_proof.translator_proof;
 
        EXPECT_FALSE(Chonk::verify(tampered_proof, chonk_vk_1));
    }
};
 
TEST_F(ChonkTests, VKIndependenceFromNumberOfCircuits)
{
    const TestSettings settings{ .log2_num_gates = SMALL_LOG_2_NUM_GATES };
 
    auto [unused_1, chonk_vk_1] = accumulate_and_prove_ivc(/*num_app_circuits=*/1, settings);
    auto [unused_2, chonk_vk_2] = accumulate_and_prove_ivc(/*num_app_circuits=*/3, settings);
 
    // Check the equality of the Mega components of the Chonk VKeys.
    EXPECT_EQ(*chonk_vk_1.mega.get(), *chonk_vk_2.mega.get());
 
    // Check the equality of the ECCVM components of the Chonk VKeys.
    EXPECT_EQ(*chonk_vk_1.eccvm.get(), *chonk_vk_2.eccvm.get());
 
    // Check the equality of the Translator components of the Chonk VKeys.
    EXPECT_EQ(*chonk_vk_1.translator.get(), *chonk_vk_2.translator.get());
};
 
TEST_F(ChonkTests, VKIndependenceFromCircuitSize)
{
    // Run IVC for two sets of circuits
    const size_t NUM_APP_CIRCUITS = 1;
    const size_t log2_num_gates_small = 5;
    const size_t log2_num_gates_big = 18;
 
    const TestSettings settings_1{ .log2_num_gates = log2_num_gates_small };
    const TestSettings settings_2{ .log2_num_gates = log2_num_gates_big };
 
    auto [unused_1, chonk_vk_1] = accumulate_and_prove_ivc(NUM_APP_CIRCUITS, settings_1);
    auto [unused_2, chonk_vk_2] = accumulate_and_prove_ivc(NUM_APP_CIRCUITS, settings_2);
 
    // Check the equality of the Mega components of the Chonk VKeys.
    EXPECT_EQ(*chonk_vk_1.mega.get(), *chonk_vk_2.mega.get());
 
    // Check the equality of the ECCVM components of the Chonk VKeys.
    EXPECT_EQ(*chonk_vk_1.eccvm.get(), *chonk_vk_2.eccvm.get());
 
    // Check the equality of the Translator components of the Chonk VKeys.
    EXPECT_EQ(*chonk_vk_1.translator.get(), *chonk_vk_2.translator.get());
};
 
HEAVY_TEST(ChonkKernelCapacity, MaxCapacityPassing)
{
    bb::srs::init_file_crs_factory(bb::srs::bb_crs_path());
 
    const size_t NUM_APP_CIRCUITS = 17;
    auto [proof, vk] = ChonkTests::accumulate_and_prove_ivc(NUM_APP_CIRCUITS);
 
    bool verified = Chonk::verify(proof, vk);
    EXPECT_TRUE(verified);
};
 
TEST_F(ChonkTests, MsgpackProofFromFileOrBuffer)
{
    // Generate an arbitrary valid CICV proof
    TestSettings settings{ .log2_num_gates = SMALL_LOG_2_NUM_GATES };
    auto [proof, vk] = accumulate_and_prove_ivc(/*num_app_circuits=*/1, settings);
 
    { // Serialize/deserialize the proof to/from a file, check that it verifies
        const std::string filename = "proof.msgpack";
        proof.to_file_msgpack(filename);
        auto proof_deserialized = Chonk::Proof::from_file_msgpack(filename);
 
        EXPECT_TRUE(Chonk::verify(proof_deserialized, vk));
    }
 
    { // Serialize/deserialize proof to/from a heap buffer, check that it verifies
        uint8_t* buffer = proof.to_msgpack_heap_buffer();
        auto uint8_buffer = from_buffer<std::vector<uint8_t>>(buffer);
        uint8_t const* uint8_ptr = uint8_buffer.data();
        auto proof_deserialized = Chonk::Proof::from_msgpack_buffer(uint8_ptr);
 
        EXPECT_TRUE(Chonk::verify(proof_deserialized, vk));
    }
 
    { // Check that attempting to deserialize a proof from a buffer with random bytes fails gracefully
        msgpack::sbuffer buffer = proof.to_msgpack_buffer();
        auto proof_deserialized = Chonk::Proof::from_msgpack_buffer(buffer);
        EXPECT_TRUE(Chonk::verify(proof_deserialized, vk));
 
        std::vector<uint8_t> random_bytes(buffer.size());
        std::generate(random_bytes.begin(), random_bytes.end(), []() { return static_cast<uint8_t>(rand() % 256); });
        std::copy(random_bytes.begin(), random_bytes.end(), buffer.data());
 
        // Expect deserialization to fail with error msgpack::v1::type_error with description "std::bad_cast"
        EXPECT_THROW(Chonk::Proof::from_msgpack_buffer(buffer), msgpack::v1::type_error);
    }
};
 
TEST_F(ChonkTests, DatabusFailure)
{
    BB_DISABLE_ASSERTS(); // Disable assert in HN prover
 
    PrivateFunctionExecutionMockCircuitProducer circuit_producer{ /*num_app_circuits=*/1 };
    const size_t NUM_CIRCUITS = circuit_producer.total_num_circuits;
    Chonk ivc{ NUM_CIRCUITS };
 
    // Construct and accumulate a series of mocked private function execution circuits
    for (size_t idx = 0; idx < NUM_CIRCUITS; ++idx) {
        auto [circuit, vk] = circuit_producer.create_next_circuit_and_vk(ivc);
 
        // Tamper with the return data of the app circuit before it is processed as input to the next kernel
        if (idx == 0) {
            circuit_producer.tamper_with_databus();
        }
 
        ivc.accumulate(circuit, vk);
    }
 
    auto proof = ivc.prove();
    EXPECT_FALSE(Chonk::verify(proof, ivc.get_vk()));
};