Why check public signals less than `q` instead of `r` in generated solidity code? about snarkjs HOT 4 CLOSED

bn254 is defined over the numbers 0-q, you can check the definition of q in that file corresponds to the size of the prime for BN254 in i.e. https://hackmd.io/@jpw/bn254 . It seems the public inputs should be checked against the size of the scalar field, not the base field, so I agree with this note.

But you're right that tornado cash checks those same public inputs against the scalar prime: https://github.com/tornadocash/tornado-core/blob/1ef6a263ac6a0e476d063fcb269a9df65a1bd56a/contracts/Verifier.sol#L199

from snarkjs.

More context: https://github.com/tornadocash/tornado-core/blob/master/contracts/Verifier.sol#L216
tornado's implementation

from snarkjs.

I'm leaning more towards the possibility that it's a bug now, since I found that the templates for fflonk and plonk are accurately checking against the scalar field size.

from snarkjs.

Although I think it is neither a security issue or causing any trouble on production, but still created a PR to fix it: #480

from snarkjs.