3

I'm trying to test a very simple example in Zokrates. so I used the very first example in the documentation, which is:

// This is an example from https://zokrates.github.io/gettingstarted.html
def main(private field a, field b) -> (field):
field result = if a * a == b then 1 else 0 fi
return result  

And after deployment of verifier smart contract, I tried to test different number for proofing that. for example, a=2 and b=4 and I get this message 0:bool: r true correctly.

But the problem is, I get the same response for any wrong proof same as correct proofs. For example a=3 and b=19 I get 0:bool: r true again.

why wrong proofs have a true response?

4

When you generate a proof in ZoKrates, it is always valid. You might be confusing the program returning 0/1 and the proof being valid/invalid. You can invalidate the proof by fiddling with it (changing the proof points or elements in the inputs field).

Let me give you an example:

If you compute a witness for the program with arguments a = 2 and b = 4, the output would be 1. When you generate a proof using the computed witness, you get something like this:

{
  "proof": {
    "a": [
      "0x11ceea6848d6f4bb17fbe01e2f37a7f50aa5ea4da8aa6e4e364c3202dbb35deb",
      "0x04991e94bc0ae3718a464aecd3c351cadb9c779d8acf9601ac87245b7a5cec76"
    ],
    "b": [
      [
        "0x099a674ea974d7421b96a617635ac38939775ce47916487edaf5d384ddd401bf",
        "0x18b754e9665ee861740aa1ccb4def4ed4eb945d0f26be1dced2656004ea59111"
      ],
      [
        "0x022b35cca41f73cee44819184e9c0054e1553f3a31310e53581d90e526c93073",
        "0x22450d6b21830786c87e94131fbaaf9f6eaa93e6d526a827b42b706bee7654ff"
      ]
    ],
    "c": [
      "0x07405e6618cd88e94e44ceeade27f44d9dc362cf8f4de882b0d8905906d3daea",
      "0x1c8e8f412dfab3243f232fa9da9b1705bf99b05952819160d69c64ede0794fab"
    ]
  },
  "inputs": [
    "0x0000000000000000000000000000000000000000000000000000000000000004",
    "0x0000000000000000000000000000000000000000000000000000000000000001"
  ]
}

If you examine the inputs field in the proof, it contains the public parameters of the program (in this case the value of b which was 4) and the output of the program (which was 1).

If you verify this proof, the contract would return { "0": "bool: r true" }. If you were to change something in the proof eg. change the first element in the inputs array to be 0x0000000000000000000000000000000000000000000000000000000000000003 and run the verification again, the proof would be invalid and therefore the verifier output would be { "0": "bool: r false" }. You can also try changing the values in a, b or c groups, this would make the proof invalid as well.

In other words, passing the inputs in the computation step that will make the program result in a 0 would still generate a valid proof, because in that case you are verifying that the program resulted in a 0.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.