Why use circom circuits to generate solidity contracts, instead of directly writing the contract?

Question

I am not able to understand why write a circom circuit and then use it to generate a solidity contract to be deployed. Instead, why not write the code directly in solidity. Is it because zero knowledge proofs are hard to write and circom simplifies this? or is it because of some other reason?

Answer 1

There are two pieces in any ZK system: a prover and (at least one) verifier.

The prover's job is to take in all the inputs, verify certain stuff based on them and generate a proof that the input is what you claim it is.

The generated proof is then given to anyone who wants to verify it. The verification happens with a separate verifier program.

The prover program requires a lot of resources to run, and therefore it can't be done on-chain. The proof is always generated off-chain. Circom is one way how to write a circuit that can be used to generate a proof.

Once the proof is verified, you need a verifier program. This is often generated automatically, based on the used prover program. The generation target type depends on your needs; one typical option is to output a Solidity verifier. This Solidity verifier can then be deployed on-chain. But, if you want, you can possible output a verifier for some other architecture as well.

So Circom and Solidity are used for different things. Solidity is used so that we can get a verifier on-chain. Circom is used so we can generate a ZK proof.

In theory, one could write a prover program also in Solidity, but it would be super inefficient - Solidity is not meant for that kind of stuff. But one can't put Circom programs on EVM chains - you have to use Solidity (or something else that compiles into the right type of bytecode).