How is circuit integrity of ZK-rollups checked by the L1 contract?

Question

TL;DR: what prevents an evil party forge a new evil operation (say mint 100 ETH for some account) and prove that the evil operation is executed correctly to the Layer 1 verifier contract?

---

I am reading the code of a ZK rollup's implementation called zkSync. There are several Layer 2 operations like Transfer, Withdraw and so on. They use PLONK as the zkSNARK backend, which generates a universal SRS and can be used to check any circuit up to length n. However, because of this flexibility, any circuit may be built and verified, not only the honest ones like Transfer defined by the original developers.

If I understand it correctly, with the PLONK protocol, the verifier (i.e. Layer 1 contract) is able to verify that some circuit is executed correctly, namely the input x and witness w satisfies specified constraints (e.g. after a series of operations contained in w, the state merkle tree root matches new_root contained in x). But it cannot check whether the circuit is constructed honestly. In order to get polylog(n) complexity in verification time, the prover cannot list all operations done in the circuit, which may contain an evil operation. So why cannot one create a new operation and cheat?

Answer 1

After reading the PLONK paper again, I noticed that $q_m$, $q_l$, $q_r$ etc are preprocessed and fixed as input to the verifier, which specify the circuit. That is to say, the circuit is not provided by the prover, but pre-computed by the verifier. So it is secure.

I haven't checked the source code, but I guess these circuit specification polynomials (actually their commitments) are hard-coded in the solidity program on contract setup.