research: Poseidon2 vs Poseidon (queue item #2) — REJECT

[alexandre-mrt]

Summary

Nightly research-loop run. Queue item #2: does swapping circomlib's Poseidon for Poseidon2 move
Veil's constraint count and proving time in the direction the Poseidon2 literature suggests, for
Veil's actual hash workload (not a synthetic benchmark)?

Verdict: REJECT. Full writeup: docs/research/2026-08-21-poseidon2-hash.md.

• Built three shadow circuits (transfer2/compliance2/withdraw2.circom) mirroring the
  production circuits 1:1, using @taceo/circom-lib's Poseidon2 templates. Not wired into the
  deployed protocol — pool.move, compliance.move, verifier.move, the frontend prover, and
  the existing trusted-setup ceremony are all untouched.
• Independently cross-validated the Poseidon2 hash construction (sponge + compression mode)
  against a from-scratch JS re-implementation built directly on the raw permutation, before
  trusting the circuit — both matched bit-for-bit.
• Non-linear constraints dropped ~9-10% per circuit, as the Poseidon2 literature suggests. But
  linear constraints grew more (+4.7% to +28.2%), and measured Node proving time got slower for
  all three circuits by a similar margin (transfer +13.8%, compliance +14.5%, withdraw +12.0%,
  mean of 10 runs, real Groth16 fullProve) — the hypothesis's own number moved the wrong way.
• 7/7 negative tests confirm the replacement circuits still reject a forged domain tag, a
  tampered Merkle sibling, a non-boolean path selector, and a forged credential leaf/context
  binding. One of those tests (N7) exists because I caught and fixed a real missing
  pathIndices boolean check in an early draft of merkle_proof2.circom before finalizing any
  numbers — documented in the report as a caution about hand-mirroring circuits.
• Re-attempted queue item feat: Veil privacy payment protocol — full stack MVP #1 (on-chain gas) first: reconfirmed BLOCKED, and now for a clearer
  reason than last time — this session's outbound proxy denies github.com, crates.io, and the
  Sui testnet fullnode with a policy-level 403, not a missed attempt.
• Re-ranked EXPERIMENTS.md: item feat: Tier 3 — KYC compliance circuit + ElGamal auditor pattern #2 replaced with a narrower wide-arity Poseidon2 follow-up
  (tonight's data suggests Poseidon2 could still win once amortized over more absorbed elements
  per permutation — untested here). BASELINE.md is unchanged (verdict is REJECT, not KEEP).

Test plan

• circuits/test/poseidon2-kat/kat_check.mjs — independent cross-validation, both constructions match
• circuits/test/poseidon2.test.mjs — 10/10 pass (3 positive controls + 7 negative tests)
• Production circuits (untouched) recompiled fresh and re-tested in full-proof mode:
  transfer.test.mjs 43/43, withdraw.test.mjs 35/35, compliance.test.mjs 30/30
• scripts/src/test-converter.ts 109/109, scripts/src/test-compliance-utils.ts 67/67
• frontend vitest 19/19
• sui move test (124 tests) — still blocked, no sui CLI / network access this session (see report)

---

Generated by Claude Code