Small fixes (#147)

* Tighten MC fold guard and verify bounds

- Restrict the truncated step fold to zero-rest witnesses; fall back to
  the full fold otherwise.
- Reject degree-0 rounds in sumcheck verify before decompress.
- Require an exact row count in Hyrax verify.

* Mirror verify-bound fixes in Python reference

- Reject degree-0 rounds in sumcheck verify.
- Require an exact row count in Hyrax verify.

Author: srinathsetty

reference/pyvega/hyrax.py

@@ -76,9 +76,9 @@ def pcs_verify(vk, ck_eval, transcript, comm, point, comm_eval, arg):
   num_rows = mathutil.div_ceil(n, num_cols)
   num_vars_rows = mathutil.log2(num_rows)
 
-  if len(comm) < num_rows:
+  if len(comm) != num_rows:
     raise ValueError(
-      f"Hyrax verify: commitment has {len(comm)} rows, fewer than {num_rows} required"
+      f"Hyrax verify: commitment has {len(comm)} rows, expected exactly {num_rows}"
     )
   if len(comm_eval) == 0:
     raise ValueError("Hyrax verify: evaluation commitment is empty")

reference/pyvega/sumcheck.py

@@ -28,6 +28,9 @@ def sumcheck_verify(compressed_polys, claim, num_rounds, degree_bound, transcrip
       raise ValueError(
         f"InvalidSumcheckProof: round {i} degree {len(cp)} != {degree_bound}"
       )
+    # decompress reads the first stored coefficient; a degree-0 round has none.
+    if degree_bound == 0:
+      raise ValueError("InvalidSumcheckProof: degree_bound must be >= 1")
     coeffs = unipoly_decompress(cp, e)
     transcript.absorb_unipoly(b"p", cp)
     r_i = transcript.squeeze(b"c")

src/provider/pcs/hyrax_pc.rs

@@ -498,12 +498,12 @@ where
 
     let (num_vars_rows, _num_vars_cols) = (num_rows.log_2(), num_cols.log_2());
 
-    // The commitment must have enough rows to open at this point, and the
-    // evaluation commitment must be non-empty.
-    if comm.comm.len() < num_rows {
+    // The commitment must have exactly the number of rows implied by the opening
+    // point, and the evaluation commitment must be non-empty.
+    if comm.comm.len() != num_rows {
       return Err(VegaError::InvalidCommitmentLength {
         reason: format!(
-          "Hyrax verify: commitment has {} rows, fewer than the {} required",
+          "Hyrax verify: commitment has {} rows, expected exactly {}",
           comm.comm.len(),
           num_rows
         ),

src/sumcheck.rs

@@ -88,6 +88,11 @@ impl<E: Engine> SumcheckProof<E> {
         return Err(VegaError::InvalidSumcheckProof);
       }
 
+      // decompress reads the first stored coefficient; a degree-0 round has none.
+      if degree_bound == 0 {
+        return Err(VegaError::InvalidSumcheckProof);
+      }
+
       let poly = self.compressed_polys[i].decompress(&e);
 
       // we do not need to check if poly(0) + poly(1) = e, as

src/vega_mc_zkp.rs

@@ -1204,12 +1204,11 @@ where
     let _ =
       SatisfyingAssignment::<E>::process_round(vc_state, vc_shape, vc_ck, vc, ell_b, transcript)?;
 
-    // Truncate witness W vectors to skip zero rest portion before folding.
-    // The rest portion (indices effective_len..) is all zero for step circuits,
-    // so the folded result there is also zero. We resize back after folding.
-    // Only apply when shared+precommitted > 0 (otherwise truncation would zero everything).
+    // Fast path: when the rest witness is pure padding (num_rest_unpadded == 0) and the
+    // shared+precommitted prefix is nonempty, fold only that prefix and rebuild the zero
+    // rest rows from the folded blind. Otherwise fold the full witness and commitment.
     let effective_len = S.num_shared + S.num_precommitted;
-    let use_truncated_fold = effective_len > 0;
+    let use_truncated_fold = effective_len > 0 && S.num_rest_unpadded == 0;
     if use_truncated_fold {
       for w in Ws.iter_mut() {
         w.W.truncate(effective_len);