Repository navigation
Moonlight point pair no identity flag - #17
Merged
Merged
Conversation
jtcoolen
reviewed
Oct 28, 2026
jtcoolen
left a comment
jtcoolen
left a comment
There was a problem hiding this comment.
Left a few inline comments: one on the Moonlight branch that the demo docs and run_team_demo.sh still pin, plus some nits, mostly about comment accuracy in the new point-pair branch of AccumulatorHelpers.yul.
jtcoolen
approved these changes
Oct 28, 2026
…ty flags Moonlight's WrapCircuit now constrains both points of its fully collapsed (lhs, rhs) accumulator to be non-identity and exposes only their x and y coordinates, dropping the trailing is_id word from each point. AccumulatorEncoding::point_pair now matches that layout: each point is 2 * coord_words public-input words, POINT_PAIR_PUBLIC_INPUT_WORDS is 8, and the generated verifier always decodes both coordinates and rejects a point that decodes to the EIP-2537 identity encoding (0, 0). The point-and-scalar (IVC) layout keeps its identity-flag decoding, and its rendered Solidity, like that of verifiers without an accumulator, is byte-identical to before. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Prove Moonlight-style point-pair public inputs with a circuit that binds arbitrary instance words, and check that the rendered verifier accepts a valid non-identity accumulator, rejects a swapped pair, and rejects identity points encoded as zero coordinates. The identity pair satisfies the accumulator pairing, so its rejection comes from the decoder itself. Rename IdentityAccumulatorCircuit to PublicWordsCircuit now that it is used for non-identity accumulators as well. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The moonlight-wrap contracts were deployed once, on 2026-05-19, from a synthetic wrap benchmark with a seeded test SRS, and have not been redeployed since. Note that they no longer match current generator output or Moonlight wrap proofs, and that the files are an exact record of what is on-chain. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
SolidityGenerator::try_new only checked that the accumulator payload fit in num_instances. A point-pair encoding with trailing words, such as the old flagged 10-word Moonlight layout, was accepted and then panicked during rendering where lowering expects the tail check to have passed. Run fixed_scalar_count in try_new so those layouts return a typed UnsupportedAccumulatorEncoding error up front, and test the 18/19/21-word boundary at Moonlight's offset of 11. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The team demo's default Moonlight branch, codex/wrap-bench-cherry-picks, predates #15 (dedicated foreign-point identity-flag words) and EYBlockchain/Moonlight#91 (flagless, non-identity wrap accumulator), so its wrap bench no longer runs against current Midfall. Note this in TEAM_DEMO_SETUP.md and in run_team_demo.sh, and point users at --skip-moonlight until the branch is rebased onto Moonlight master. Updating the pin is deferred to a follow-up. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
For point-and-scalar accumulators, try_new accepted any fixed-base scalar tail length, but lowering maps a non-empty tail onto -G and every fixed and permutation commitment of the verified VK. A tail no longer than the permutation count panicked during rendering, other short tails mapped scalars onto a prefix of the fixed commitments, and long tails read base pointers past the fixed-commitment region, rendering a verifier that checked the accumulator against the wrong bases. fixed_bases(vk) always holds exactly 1 + #fixed + #permutation entries, so require a non-empty tail to have that length and return UnsupportedAccumulatorEncoding otherwise. Valid configurations, including the fully collapsed IVC accumulator, are unaffected. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Michael-EY
force-pushed
the
moonlight-point-pair-no-identity-flag
branch
from
November 2, 2026 13:47
3ff53a4 to
0908995
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Moonlight's wrap circuit (EYBlockchain/Moonlight#91) now constrains both accumulator points to be non-identity and no longer exposes their
is_idflags (wrap instances 21 → 19). This updates the Solidity verifier to match:AccumulatorEncoding::point_pairis now 8 words (lhs.x, lhs.y, rhs.x, rhs.y) with no identity flags; the generated decoder always decodes both points and rejects(0,0).SolidityGenerator::try_newrejects point-pair layouts with extra words (e.g. the old 10-word layout) with a typed error instead of panicking at render.AccumulatorEncoding::new) and no-accumulator verifiers render byte-identical tomain.moonlight-wrapdeployment as historical.