fix grinding in sumcheck (#193)

Author: TomWambsgans

src/sumcheck/sumcheck_single.rs

@@ -174,8 +174,6 @@ where
         for _ in 0..folding_factor {
             let sumcheck_poly = self.compute_sumcheck_polynomial();
             prover_state.add_scalars(sumcheck_poly.evaluations())?;
-            let [folding_randomness] = prover_state.challenge_scalars()?;
-            res.push(folding_randomness);
 
             // Do PoW if needed
             if pow_bits > 0. {
@@ -184,6 +182,9 @@ where
                 prover_state.challenge_pow::<S>(pow_bits)?;
             }
 
+            let [folding_randomness] = prover_state.challenge_scalars()?;
+            res.push(folding_randomness);
+
             self.compress(F::ONE, &folding_randomness.into(), &sumcheck_poly);
         }
 
@@ -1179,12 +1180,12 @@ mod tests {
             // Absorb 3 field elements (evaluations of sumcheck polynomial)
             domsep = <DomainSeparator as FieldDomainSeparator<F>>::add_scalars(domsep, 3, "tag");
 
+            // Apply optional PoW grinding to ensure randomness
+            domsep = domsep.challenge_pow("tag");
+
             // Sample 1 challenge scalar from the Fiat-Shamir transcript
             domsep =
                 <DomainSeparator as FieldDomainSeparator<F>>::challenge_scalars(domsep, 1, "tag");
-
-            // Apply optional PoW grinding to ensure randomness
-            domsep = domsep.challenge_pow("tag");
         }
 
         // Convert the domain separator to a prover state
@@ -1230,12 +1231,12 @@ mod tests {
             // Absorb 3 field values (sumcheck evaluations at X = 0, 1, 2)
             domsep = <DomainSeparator as FieldDomainSeparator<F>>::add_scalars(domsep, 3, "tag");
 
+            // Apply challenge PoW (grinding) to enhance soundness
+            domsep = domsep.challenge_pow("tag");
+
             // Sample 1 field challenge (folding randomness)
             domsep =
                 <DomainSeparator as FieldDomainSeparator<F>>::challenge_scalars(domsep, 1, "tag");
-
-            // Apply challenge PoW (grinding) to enhance soundness
-            domsep = domsep.challenge_pow("tag");
         }
 
         // Convert the domain separator to a prover state

src/sumcheck/sumcheck_single_domainsep.rs

@@ -17,8 +17,8 @@ where
         for _ in 0..folding_factor {
             self = self
                 .add_scalars(3, "sumcheck_poly")
-                .challenge_scalars(1, "folding_randomness")
-                .pow(pow_bits);
+                .pow(pow_bits)
+                .challenge_scalars(1, "folding_randomness");
         }
         self
     }

src/whir/verifier.rs

@@ -247,15 +247,15 @@ where
                 return Err(ProofError::InvalidProof);
             }
 
+            // Proof of work per round
+            self.verify_proof_of_work(verifier_state, proof_of_work)?;
+
             // Receive folding randomness
             let [folding_randomness_single] = verifier_state.challenge_scalars()?;
             randomness.push(folding_randomness_single);
 
             // Update claimed sum using folding randomness
             *claimed_sum = sumcheck_poly.evaluate_at_point(&folding_randomness_single.into());
-
-            // Proof of work per round
-            self.verify_proof_of_work(verifier_state, proof_of_work)?;
         }
 
         randomness.reverse();