feat: add decryption share commitments to c6 and c7#1489
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughConsolidates C7 (DecryptedSharesAggregation) into a single circuit and wires per-party decryption-share commitments (d_commitment) from C6 into C7 as public inputs; updates configs, commitment helpers, circuit signatures, public-input layouts, verifier artifacts, and tests accordingly. Changes
Sequence Diagram(s)sequenceDiagram
participant Prover
participant C6 as ThresholdShareDecryption (C6)
participant C7 as DecryptedSharesAggregation (C7)
participant Tool as ProverTool
participant Verifier as SmartContract/Verifier
Prover ->> C6: run share-decryption circuit (witness)
C6 -->> Tool: emit d_commitment (public signal)
Tool ->> Prover: collect d_commitment(s) into public_inputs
Prover ->> C7: submit expected_d_commitments + aggregation inputs
C7 ->> C7: recompute commitments from witness decryption_shares and check vs expected_d_commitments
C7 -->> Tool: produce aggregated proof + public_signals
Tool ->> Verifier: submit proof + public_inputs (includes expected_d_commitments)
Verifier ->> Verifier: verify using updated VK (publicInputsSize = 120)
Verifier -->> Tool: accept/reject
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related issues
Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsTimed out fetching pipeline failures after 30000ms Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
0xjei
reviewed
Mar 26, 2026
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
circuits/lib/src/core/threshold/share_decryption.nr (1)
151-167:⚠️ Potential issue | 🔴 CriticalReassign
Vec::pushresults to fix transcript construction.Noir's
Vec::pushreturns a new vector and must be reassigned. Lines 155-156 and 167 drop the returned vectors, leaving the transcript incomplete. This meansgammais derived without the commitments and d_commitment, breaking the soundness argument.🛠️ Proposed fix
fn payload(self, d_commitment: Field) -> Vec<Field> { let mut inputs = Vec::new(); // Use commitments instead of full polynomials (saves constraints) - inputs.push(self.expected_sk_commitment); - inputs.push(self.expected_e_sm_commitment); + inputs = inputs.push(self.expected_sk_commitment); + inputs = inputs.push(self.expected_e_sm_commitment); // Flatten ciphertext components (public inputs) inputs = flatten::<_, _, BIT_CT>(inputs, self.ct0); inputs = flatten::<_, _, BIT_CT>(inputs, self.ct1); // Flatten quotient polynomials (secret witnesses) inputs = flatten::<_, _, BIT_R1>(inputs, self.r1); inputs = flatten::<_, _, BIT_R2>(inputs, self.r2); // Bind decryption share via prefix commitment (matches circuit 7) - inputs.push(d_commitment); + inputs = inputs.push(d_commitment); inputs }Additionally,
gammais derived from a commitment to only the firstMAX_MSG_NON_ZERO_COEFFScoefficients ofd, but the fullN-coefficient polynomial is later evaluated atgammainverify_decryption_share_computation. WhenMAX_MSG_NON_ZERO_COEFFS < N, the remaining coefficients lack Fiat-Shamir binding. Confirm this is intentional for the constraint-saving design.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@circuits/lib/src/core/threshold/share_decryption.nr` around lines 151 - 167, The payload construction drops the results of Noir's Vec::push (which returns a new Vec) for the initial commitments and d_commitment, so the transcript misses expected_sk_commitment, expected_e_sm_commitment and d_commitment; update the payload function (symbol: payload) to reassign the pushes (e.g., inputs = inputs.push(...)) for expected_sk_commitment, expected_e_sm_commitment and d_commitment so those fields are actually included, and keep the existing reassignments for flatten calls (symbols: flatten, ct0, ct1, r1, r2, BIT_CT, BIT_R1, BIT_R2); also double-check or document the Fiat–Shamir binding gap noted: gamma is created from only MAX_MSG_NON_ZERO_COEFFS coefficients of d while verify_decryption_share_computation evaluates the full N-coefficient polynomial—confirm this is intentional or extend the commitment to cover all N coefficients.
🧹 Nitpick comments (3)
crates/events/src/enclave_event/proof.rs (1)
195-202: Add a C6 extraction regression test.Since
ThresholdShareDecryptionmoved fromNonetoFixed, add a focused test for extractingd_commitmentto prevent layout regressions.🧪 Proposed test addition
#[cfg(test)] mod tests { use super::*; @@ fn extract_empty_signals() { let proof = make_proof(CircuitName::PkGeneration, &[]); assert!(proof.extract_output("pk_commitment").is_none()); } + + #[test] + fn extract_c6_d_commitment_after_pub_inputs() { + // C6: pub inputs (2 + 2*L*N fields) + 1 output (d_commitment at tail). + // Simulate with 2 pub fields + 1 output = 96 bytes total. + let mut signals = vec![0xAA; 96]; + signals[64..96].copy_from_slice(&[0xDD; 32]); + + let proof = make_proof(CircuitName::ThresholdShareDecryption, &signals); + assert_eq!(&*proof.extract_output("d_commitment").unwrap(), &[0xDD; 32]); + } }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@crates/events/src/enclave_event/proof.rs` around lines 195 - 202, Add a targeted regression test that verifies C6 extraction for the ThresholdShareDecryption layout now defined as CircuitOutputLayout::Fixed (referencing CircuitName::ThresholdShareDecryption and THRESHOLD_SHARE_DECRYPTION_OUTPUTS) and ensure the test specifically extracts and asserts the presence and correctness of the d_commitment field; place the test alongside other enclave_event/proof tests, call the same extraction function used in production (the C6 extraction helper) and construct inputs that exercise the Fixed layout so future changes to CircuitOutputLayout::Fixed or THRESHOLD_SHARE_DECRYPTION_OUTPUTS will fail the test if d_commitment is missing or mis-positioned.crates/zk-helpers/src/circuits/commitments.rs (1)
83-89: Add a direct unit test for truncated C6/C7 decryption-share commitments.This path is cross-circuit critical; a focused test will guard against drift in truncation/domain-separator behavior.
🧪 Proposed test addition
#[cfg(test)] mod tests { use super::*; @@ fn compute_pk_commitment_from_keyshare_roundtrip() { @@ assert_eq!(commitment, expected_padded); } + + #[test] + fn compute_threshold_decryption_share_commitment_truncates_coeffs() { + let d_share = CrtPolynomial::from_bigint_vectors(vec![ + vec![BigInt::from(1), BigInt::from(2), BigInt::from(3)], + vec![BigInt::from(4), BigInt::from(5), BigInt::from(6)], + ]); + let bit_d = 8; + let max_k = 2; + + let actual = compute_threshold_decryption_share_commitment(&d_share, bit_d, max_k); + + let truncated = CrtPolynomial::from_bigint_vectors(vec![ + vec![BigInt::from(1), BigInt::from(2)], + vec![BigInt::from(4), BigInt::from(5)], + ]); + let mut payload = Vec::new(); + payload = flatten(payload, &truncated.limbs, bit_d); + let io_pattern = [0x80000000 | payload.len() as u32, 1]; + let expected = field_to_bigint( + compute_commitments(payload, DS_THRESHOLD_DECRYPTION_SHARE, io_pattern)[0], + ); + + assert_eq!(actual, expected); + } }Also applies to: 486-516
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@crates/zk-helpers/src/circuits/commitments.rs` around lines 83 - 89, Add a focused unit test that verifies truncated C6/C7 decryption-share commitments use the DS_THRESHOLD_DECRYPTION_SHARE domain separator correctly: write a test that constructs the commitment input for a decryption share, computes the commitment using the same truncation/path logic as in the circuit code, and asserts that the produced commitment bytes (and/or hash preimage length) match the expected output when DS_THRESHOLD_DECRYPTION_SHARE (the 64-byte constant) is truncated/used; locate uses of DS_THRESHOLD_DECRYPTION_SHARE in commitments.rs and mirror the circuit truncation behavior in the test to catch regressions (also add equivalent coverage for the other constants referenced around lines 486-516).circuits/bin/recursive_aggregation/wrapper/threshold/decrypted_shares_aggregation/src/main.nr (1)
13-21: Avoid hard-coding the C7 signal count in another place.
N_PUBLIC_INPUTShere has to stay in lockstep with the inner C7 main signature andpackages/enclave-contracts/contracts/verifiers/bfv/honk/ThresholdDecryptedSharesAggregationVerifier.sol’sNUMBER_OF_PUBLIC_INPUTS(after subtracting pairing inputs). A shared constant or consistency test would make the next public-signal change much less brittle.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@circuits/bin/recursive_aggregation/wrapper/threshold/decrypted_shares_aggregation/src/main.nr` around lines 13 - 21, N_PUBLIC_INPUTS is hard-coded and must stay in sync with the C7 main signature and the Solidity verifier's NUMBER_OF_PUBLIC_INPUTS; update the code to remove the duplicated literal by sourcing a single canonical constant or deriving it programmatically: either import the shared public-inputs constant used by the C7/main signature into this module (replace pub global N_PUBLIC_INPUTS with that shared symbol) or compute N_PUBLIC_INPUTS from the same upstream symbols (e.g., keep the T and MAX_MSG_NON_ZERO_COEFFS expressions in sync) so the main(verification_key, proofs, public_inputs) signature always matches the verifier's NUMBER_OF_PUBLIC_INPUTS; ensure the symbol names referenced include N_PUBLIC_INPUTS and the main function signature and add a note or test to verify parity with the Solidity NUMBER_OF_PUBLIC_INPUTS.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@circuits/lib/src/core/threshold/share_decryption.nr`:
- Around line 115-127: The transcript currently only absorbs the truncated
prefix of self.d via get_truncated_polynomials(), allowing the tail coefficients
to be slack; modify the code so the full d witness (self.d including all N
coefficients) is still committed/absorbed into the Fiat–Shamir transcript (keep
the full-d absorption where verify_decryption_share_computation() evaluates
self.d[basis_idx]) while separately producing and returning the truncated-prefix
Polynomial array (from get_truncated_polynomials) or its commitment for use as
C7; ensure MAX_MSG_NON_ZERO_COEFFS truncation is used only to produce the C7
prefix, not to reduce the witness bound, and apply the same change for the other
occurrence referenced around the block corresponding to lines 172–193.
In
`@crates/zk-helpers/src/circuits/threshold/decrypted_shares_aggregation/computation.rs`:
- Around line 328-340: The code computes expected_d_commitments from the entire
decryption_shares vector but the circuit/interpolation only uses the first
threshold + 1 shares; clamp decryption_shares and associated party IDs to the
same reconstructing subset (first threshold + 1 entries) before both the
interpolation step and before calling
compute_threshold_decryption_share_commitment so expected_d_commitments, the
interpolation logic, and the Inputs struct all use the identical [T + 1] subset.
---
Outside diff comments:
In `@circuits/lib/src/core/threshold/share_decryption.nr`:
- Around line 151-167: The payload construction drops the results of Noir's
Vec::push (which returns a new Vec) for the initial commitments and
d_commitment, so the transcript misses expected_sk_commitment,
expected_e_sm_commitment and d_commitment; update the payload function (symbol:
payload) to reassign the pushes (e.g., inputs = inputs.push(...)) for
expected_sk_commitment, expected_e_sm_commitment and d_commitment so those
fields are actually included, and keep the existing reassignments for flatten
calls (symbols: flatten, ct0, ct1, r1, r2, BIT_CT, BIT_R1, BIT_R2); also
double-check or document the Fiat–Shamir binding gap noted: gamma is created
from only MAX_MSG_NON_ZERO_COEFFS coefficients of d while
verify_decryption_share_computation evaluates the full N-coefficient
polynomial—confirm this is intentional or extend the commitment to cover all N
coefficients.
---
Nitpick comments:
In
`@circuits/bin/recursive_aggregation/wrapper/threshold/decrypted_shares_aggregation/src/main.nr`:
- Around line 13-21: N_PUBLIC_INPUTS is hard-coded and must stay in sync with
the C7 main signature and the Solidity verifier's NUMBER_OF_PUBLIC_INPUTS;
update the code to remove the duplicated literal by sourcing a single canonical
constant or deriving it programmatically: either import the shared public-inputs
constant used by the C7/main signature into this module (replace pub global
N_PUBLIC_INPUTS with that shared symbol) or compute N_PUBLIC_INPUTS from the
same upstream symbols (e.g., keep the T and MAX_MSG_NON_ZERO_COEFFS expressions
in sync) so the main(verification_key, proofs, public_inputs) signature always
matches the verifier's NUMBER_OF_PUBLIC_INPUTS; ensure the symbol names
referenced include N_PUBLIC_INPUTS and the main function signature and add a
note or test to verify parity with the Solidity NUMBER_OF_PUBLIC_INPUTS.
In `@crates/events/src/enclave_event/proof.rs`:
- Around line 195-202: Add a targeted regression test that verifies C6
extraction for the ThresholdShareDecryption layout now defined as
CircuitOutputLayout::Fixed (referencing CircuitName::ThresholdShareDecryption
and THRESHOLD_SHARE_DECRYPTION_OUTPUTS) and ensure the test specifically
extracts and asserts the presence and correctness of the d_commitment field;
place the test alongside other enclave_event/proof tests, call the same
extraction function used in production (the C6 extraction helper) and construct
inputs that exercise the Fixed layout so future changes to
CircuitOutputLayout::Fixed or THRESHOLD_SHARE_DECRYPTION_OUTPUTS will fail the
test if d_commitment is missing or mis-positioned.
In `@crates/zk-helpers/src/circuits/commitments.rs`:
- Around line 83-89: Add a focused unit test that verifies truncated C6/C7
decryption-share commitments use the DS_THRESHOLD_DECRYPTION_SHARE domain
separator correctly: write a test that constructs the commitment input for a
decryption share, computes the commitment using the same truncation/path logic
as in the circuit code, and asserts that the produced commitment bytes (and/or
hash preimage length) match the expected output when
DS_THRESHOLD_DECRYPTION_SHARE (the 64-byte constant) is truncated/used; locate
uses of DS_THRESHOLD_DECRYPTION_SHARE in commitments.rs and mirror the circuit
truncation behavior in the test to catch regressions (also add equivalent
coverage for the other constants referenced around lines 486-516).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: ad38d6cc-196e-44c6-a97d-641085e0e25b
📒 Files selected for processing (21)
agent/flow-trace/00_INDEX.mdagent/flow-trace/04_DKG_AND_COMPUTATION.mdagent/flow-trace/05_FAILURE_REFUND_SLASHING.mdcircuits/bin/recursive_aggregation/wrapper/threshold/decrypted_shares_aggregation/src/main.nrcircuits/bin/recursive_aggregation/wrapper/threshold/share_decryption/src/main.nrcircuits/bin/threshold/decrypted_shares_aggregation/src/main.nrcircuits/bin/threshold/share_decryption/src/main.nrcircuits/lib/src/configs/insecure/threshold.nrcircuits/lib/src/configs/secure/threshold.nrcircuits/lib/src/core/threshold/decrypted_shares_aggregation.nrcircuits/lib/src/core/threshold/share_decryption.nrcircuits/lib/src/math/commitments.nrcrates/events/src/enclave_event/compute_request/zk.rscrates/events/src/enclave_event/proof.rscrates/zk-helpers/src/circuits/commitments.rscrates/zk-helpers/src/circuits/output_layout.rscrates/zk-helpers/src/circuits/threshold/decrypted_shares_aggregation/codegen.rscrates/zk-helpers/src/circuits/threshold/decrypted_shares_aggregation/computation.rscrates/zk-helpers/src/circuits/threshold/decrypted_shares_aggregation/mod.rscrates/zk-prover/tests/local_e2e_tests.rspackages/enclave-contracts/contracts/verifiers/bfv/honk/ThresholdDecryptedSharesAggregationVerifier.sol
cedoor
force-pushed
the
refactor/c6-c7-commitments
branch
from
3375c82 to
32e1a7d
Compare
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (2)
crates/zk-helpers/src/circuits/threshold/decrypted_shares_aggregation/computation.rs (1)
216-246:⚠️ Potential issue | 🟡 MinorClamp all emitted vectors to the same
threshold + 1subset.Lines 257-263 only interpolate
0..=threshold, butdecryption_shares,party_ids, andexpected_d_commitmentsare still built from the full input vectors.circuits/lib/src/core/threshold/decrypted_shares_aggregation.nrexpects[T + 1]-shaped arrays, so any extra reconstructing shares will make the serialized inputs disagree with the circuit arity and fail proof generation.Also applies to: 328-341
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@crates/zk-helpers/src/circuits/threshold/decrypted_shares_aggregation/computation.rs` around lines 216 - 246, The generated vectors decryption_shares, party_ids, and expected_d_commitments must be trimmed to exactly threshold + 1 elements to match the circuit arity; update the construction of d_share_polys -> decryption_shares (CrtPolynomial::from_fhe_polynomial), party_ids (BigInt::from) and expected_d_commitments to only iterate over the same 0..=threshold subset (or take(&[..threshold+1])/slice) used by the interpolation, ensuring each produced Vec has length threshold + 1; apply the same clamping fix to the analogous code block referenced around the 328-341 region so all emitted arrays match [T + 1].circuits/lib/src/core/threshold/share_decryption.nr (1)
186-193:⚠️ Potential issue | 🔴 CriticalKeep the full
dwitness bound to Fiat–Shamir.Even after fixing the
push, Lines 186-193 derivegammafrom a commitment to only the firstMAX_MSG_NON_ZERO_COEFFScoefficients, whileverify_decryption_share_computation()still evaluates the fullself.d[basis_idx]. The tail coefficients then become slack variables that can satisfy the single-point check without matching the committed prefix. Keep the truncatedd_commitmentas the C7 output, but absorb the fulld(or a full-length commitment to it) into the C6 transcript.Based on learnings, the sparse
MAX_MSG_NON_ZERO_COEFFShandling incircuits/lib/src/core/trbfv_dec_shares_agg.nris only intended for C7 padding/decoding.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@circuits/lib/src/core/threshold/share_decryption.nr` around lines 186 - 193, The Fiat–Shamir challenge (gamma) is currently derived from a commitment to only the truncated coefficients (d_truncated) which lets the tail of self.d be unconstrained; instead, keep d_commitment (from compute_threshold_decryption_share_commitment::<MAX_MSG_NON_ZERO_COEFFS, L, BIT_D>) as the C7 output but include the full-length d witness (or a full-length commitment derived from self.d) into the C6 transcript used by generate_challenge so verify_decryption_share_computation() (which reads self.d[basis_idx]) is bound to the same values; update the code path around get_truncated_polynomials(), compute_threshold_decryption_share_commitment, and generate_challenge to pass/commit the full d (or its full-length commitment) into generate_challenge while still returning the truncated d_commitment for C7, and preserve MAX_MSG_NON_ZERO_COEFFS usage only for C7 padding/decoding.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@circuits/lib/src/core/threshold/share_decryption.nr`:
- Around line 186-193: The Fiat–Shamir challenge (gamma) is currently derived
from a commitment to only the truncated coefficients (d_truncated) which lets
the tail of self.d be unconstrained; instead, keep d_commitment (from
compute_threshold_decryption_share_commitment::<MAX_MSG_NON_ZERO_COEFFS, L,
BIT_D>) as the C7 output but include the full-length d witness (or a full-length
commitment derived from self.d) into the C6 transcript used by
generate_challenge so verify_decryption_share_computation() (which reads
self.d[basis_idx]) is bound to the same values; update the code path around
get_truncated_polynomials(), compute_threshold_decryption_share_commitment, and
generate_challenge to pass/commit the full d (or its full-length commitment)
into generate_challenge while still returning the truncated d_commitment for C7,
and preserve MAX_MSG_NON_ZERO_COEFFS usage only for C7 padding/decoding.
In
`@crates/zk-helpers/src/circuits/threshold/decrypted_shares_aggregation/computation.rs`:
- Around line 216-246: The generated vectors decryption_shares, party_ids, and
expected_d_commitments must be trimmed to exactly threshold + 1 elements to
match the circuit arity; update the construction of d_share_polys ->
decryption_shares (CrtPolynomial::from_fhe_polynomial), party_ids (BigInt::from)
and expected_d_commitments to only iterate over the same 0..=threshold subset
(or take(&[..threshold+1])/slice) used by the interpolation, ensuring each
produced Vec has length threshold + 1; apply the same clamping fix to the
analogous code block referenced around the 328-341 region so all emitted arrays
match [T + 1].
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 72f01bf6-aa8f-4028-ad5e-dd4a6a0a2a30
📒 Files selected for processing (21)
agent/flow-trace/00_INDEX.mdagent/flow-trace/04_DKG_AND_COMPUTATION.mdagent/flow-trace/05_FAILURE_REFUND_SLASHING.mdcircuits/bin/recursive_aggregation/wrapper/threshold/decrypted_shares_aggregation/src/main.nrcircuits/bin/recursive_aggregation/wrapper/threshold/share_decryption/src/main.nrcircuits/bin/threshold/decrypted_shares_aggregation/src/main.nrcircuits/bin/threshold/share_decryption/src/main.nrcircuits/lib/src/configs/insecure/threshold.nrcircuits/lib/src/configs/secure/threshold.nrcircuits/lib/src/core/threshold/decrypted_shares_aggregation.nrcircuits/lib/src/core/threshold/share_decryption.nrcircuits/lib/src/math/commitments.nrcrates/events/src/enclave_event/compute_request/zk.rscrates/events/src/enclave_event/proof.rscrates/zk-helpers/src/circuits/commitments.rscrates/zk-helpers/src/circuits/output_layout.rscrates/zk-helpers/src/circuits/threshold/decrypted_shares_aggregation/codegen.rscrates/zk-helpers/src/circuits/threshold/decrypted_shares_aggregation/computation.rscrates/zk-helpers/src/circuits/threshold/decrypted_shares_aggregation/mod.rscrates/zk-prover/tests/local_e2e_tests.rspackages/enclave-contracts/contracts/verifiers/bfv/honk/ThresholdDecryptedSharesAggregationVerifier.sol
✅ Files skipped from review due to trivial changes (4)
- agent/flow-trace/05_FAILURE_REFUND_SLASHING.md
- crates/events/src/enclave_event/compute_request/zk.rs
- circuits/lib/src/configs/secure/threshold.nr
- agent/flow-trace/04_DKG_AND_COMPUTATION.md
🚧 Files skipped from review as they are similar to previous changes (10)
- agent/flow-trace/00_INDEX.md
- crates/events/src/enclave_event/proof.rs
- circuits/lib/src/configs/insecure/threshold.nr
- crates/zk-helpers/src/circuits/threshold/decrypted_shares_aggregation/codegen.rs
- crates/zk-helpers/src/circuits/threshold/decrypted_shares_aggregation/mod.rs
- crates/zk-helpers/src/circuits/output_layout.rs
- circuits/bin/threshold/share_decryption/src/main.nr
- circuits/bin/recursive_aggregation/wrapper/threshold/share_decryption/src/main.nr
- circuits/lib/src/math/commitments.nr
- crates/zk-prover/tests/local_e2e_tests.rs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Documentation
Refactor
Tests
Chores