You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I believe the sum var is underconstrained. Roughly my logic is that sum is a key component of the state machine and it is currently formed purely through "witness" construction. Notably on line 103 we transition the state machine with mask out.
There are constraints that guarantee the inputs have a certain characteristic, but not constraints on the sum.
My mental model on circom is a bit weak, but in halo I think of the witness & extended witness. The extended witness is the thing generated from all the logic of the circuit. In this case, sum, in your extended witness is computed as a sum, but there are no constraints on that trace cell.
Extended Witess:
[a,b,c,d,sum ]
[1,0,1,0, ?? ]
In my mental model, this sum field does exist in the extended witness and is key to a valid proof generation. However, a malicious prover could populate this value with any value and the proof would still generate.
The text was updated successfully, but these errors were encountered:
Quoting from @devloper in #11:
The text was updated successfully, but these errors were encountered: