VerifierPublicInputGammaDelta.sol.template

// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.9;

contract PairingTest {

    uint256 constant Q =
        21888242871839275222246405745257275088696311157297823662689037894645226208583;

    struct G1Point {
        uint256 x;
        uint256 y;
    }

    struct G2Point {
        uint256 x1;
        uint256 x2;
        uint256 y1;
        uint256 y2;
    }

    struct Proof {
        G1Point A;
        G2Point B;
        G1Point C;
    }

    struct VerifierKey {
        G1Point alpha;
        G2Point beta;
        G2Point gamma;
        G2Point delta;
        G1Point IC0;
        G1Point IC1;
    }

    // proof has to be supplied by the user, but for demo purposes we just hardcode it
    function proof() public pure returns (Proof memory p) {
        p = Proof(
            G1Point($aG1_x, $aG1_y),
            G2Point($bG2_x1, $bG2_x2, $bG2_y1, $bG2_y2),
            G1Point($cG1_x, $cG1_y)
        );
    }

    function input() public pure returns (uint256[2] memory _input) {
        _input[0] = $one;
        _input[1] = $out;
    }

    function verifierKey() public pure returns (VerifierKey memory vk) {
        vk = VerifierKey(
            G1Point($alphaG1_x, $alphaG1_y),
            G2Point($betaG2_x1, $betaG2_x2, $betaG2_y1, $betaG2_y2),
            G2Point($gammaG2_x1, $gammaG2_x2, $gammaG2_y1, $gammaG2_y2),
            G2Point($deltaG2_x1, $deltaG2_x2, $deltaG2_y1, $deltaG2_y2),
            G1Point($k1G1_x, $k1G1_y),
            G1Point($k2G1_x, $k2G1_y)
        );
    }

    function add(
        G1Point memory p1,
        G1Point memory p2
    ) public view returns (G1Point memory r) {
        (bool ok, bytes memory result) = address(6).staticcall(
            abi.encode(p1.x, p1.y, p2.x, p2.y)
        );
        require(ok, "g1add failed");
        (uint256 x, uint256 y) = abi.decode(result, (uint256, uint256));
        r = G1Point(x, y);
    }

    function mul(
        G1Point memory p,
        uint256 scalar
    ) public view returns (G1Point memory r) {
        (bool ok, bytes memory result) = address(7).staticcall(
            abi.encode(p.x, p.y, scalar)
        );
        require(ok, "g1mul failed");
        (uint256 x, uint256 y) = abi.decode(result, (uint256, uint256));
        r = G1Point(x, y);
    }

    function negate(G1Point memory p) internal pure returns (G1Point memory) {
        // The prime q in the base field F_q for G1
        if (p.x == 0 && p.y == 0) return G1Point(0, 0);
        return G1Point(p.x, Q - (p.y % Q));
    }

    function run(bytes memory _input) public view returns (bool) {
        // optional, the precompile checks this too and reverts (with no error) if false, this helps narrow down possible errors
        if (_input.length % 192 != 0) revert("Points must be a multiple of 6");
        (bool success, bytes memory data) = address(0x08).staticcall(_input);
        if (success) return abi.decode(data, (bool));
        revert("Wrong pairing");
    }

    function emulate() public view returns(bool) {
        return verify(proof().A, proof().B, proof().C, input());
    }

    function verify(G1Point memory A, G2Point memory B, G1Point memory C, uint256[2] memory _input) public view returns (bool) {
        G1Point memory k1 = mul(verifierKey().IC0, _input[0]);
        G1Point memory k2 = mul(verifierKey().IC1, _input[1]);
        G1Point memory K = add(k1, k2);

        // -A * B + alpha * beta + C * delta + K * gamma = 0
        bytes memory points1 = abi.encode(
            A.x,
            negate(A).y,
            B.x2,
            B.x1,
            B.y2,
            B.y1,
            verifierKey().alpha.x,
            verifierKey().alpha.y,
            verifierKey().beta.x2,
            verifierKey().beta.x1,
            verifierKey().beta.y2,
            verifierKey().beta.y1
        );

        bytes memory points2 = abi.encode(
            C.x,
            C.y,
            verifierKey().delta.x2,
            verifierKey().delta.x1,
            verifierKey().delta.y2,
            verifierKey().delta.y1,
            K.x,
            K.y,
            verifierKey().gamma.x2,
            verifierKey().gamma.x1,
            verifierKey().gamma.y2,
            verifierKey().gamma.y1
        );

        bytes memory points = abi.encodePacked(points1, points2);
        return run(points);
    }
}