Impossible to verify proof on-chain about bulletproofjs HOT 6 OPEN

from bulletproofjs.

Hi!

I tried merging @shamatar's JS Bulletproof creation and @solidblu1992's smart contracts since @shamatar's proof verification on-chain does not work as it costs too much gas for some reason and @solidblu1992's does not have a way to create proofs in JavaScript so his implementation cannot be used in a web or mobile apps. Being able to merge both would actually result in an usable implementation of Confidential transactions.

Sadly, it doesn't work on this specific line in BulletproofVerifiy.sol:

v.Y2 = ecMath.MultiExp(bp[0].V, v.vpz, 0, 0);
The code reverts as this requirement fails in ECMath.sol:

require(P.length == 2*s.length);
where bp[0].V = P and v.vpz = s here.

I'm pretty sure that I serialize the parameters correctly following @solidblu1992's guideline. The code to test this can be found on this repo. Checking the file test/bulletproofs.js.

Any ideas? Would be nice to actually have a working prototype instead of just PoCs for Confidential transactions.

from bulletproofjs.

Hello @darioAnongba

I'm working on a draft of serialization format + relayers fee for transaction, I hope that we can start a work of merging tomorrow. Let me finish with a work and I'll get back to you with this problem :)

The main problem we will have to solve is whether using a block hash as a source of random number to save 50% of gas on verification is acceptable and secure.

Sincerely, Alex

from bulletproofjs.

Hi, ok I understand.

Let me know if I can be of any help.

Also concerning the debugging with ganache-cli, going down to 32 bits still reverts. It works with 16 bits costing 4291783 gas. Also, I coulnd't figure out what the N parameter was and what to set as you don't use it to generate or verify proofs on-chain. I kept it at 6.

Cheers,
Dario

from bulletproofjs.

from bulletproofjs.

Oh I see.
So I tested with M = 16, N = 4 and it cost 4171917 gas to verify 4 Pedersen commitments.

from bulletproofjs.