research: Poseidon2 vs Poseidon at Veil's actual arities — REJECT - #44
Open
alexandre-mrt wants to merge 1 commit into
Open
research: Poseidon2 vs Poseidon at Veil's actual arities — REJECT#44alexandre-mrt wants to merge 1 commit into
alexandre-mrt wants to merge 1 commit into
Conversation
Queue item #2 for tonight's research loop. Built 8 isolated single-hash-call circuits comparing circomlib's Poseidon(n) (what transfer/withdraw/compliance circuits call today) against @taceo/circom-lib's audited-lineage Poseidon2Sponge, at n=2,3,4,5 (Veil's real call arities), plus a domain-separation sanity check. Real Groth16 setups and 10-run proving-time benchmarks for each, via a reusable scripts/bench/ harness. Finding: the off-the-shelf Poseidon2 library only ships round constants for state sizes t in {2,3,4,8,12,16} — no t=5/6 — so Veil's two heaviest arities (n=4, n=5) must over-provision to t=8, costing +927/+828 constraints per call versus +63/+247 for n=2/n=3 (which have exact-width support and measurably prove faster). A computed projection onto the production circuits shows transfer.circom and withdraw.circom would likely cross a Groth16 domain-size doubling under a naive swap — the opposite of the intended win. No production circuit changed. Verdict: REJECT the off-the-shelf swap; PARKed a custom-round-constants follow-up in EXPERIMENTS.md. Re-checked on-chain gas (queue #1) first — still blocked, now confirmed as an org egress-policy denial rather than a toolchain gap. Full suite green: 108 circuit + 109 converter + 19 frontend tests pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019kWTZvNUFZxTk9XjrEJPzi
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Poseidon(n)(circomlib) for Poseidon2 (@taceo/circom-lib, audited-lineage) reduces R1CS constraints / Groth16 proving time at Veil's real call arities (n=2,3,4,5). Built 8 isolated single-hash-call benchmark circuits + a domain-separation sanity check undercircuits/bench-poseidon2/, with a reusablescripts/bench/harness (real Groth16 setups, 10-run proving-time benchmarks, raw command output in the report).@taceo/circom-lib's Poseidon2 only ships round constants for state sizes t ∈ {2,3,4,8,12,16} — no t=5/6. Veil's two heaviest arities (n=4: transfer/withdraw commitment+nullifier hashes; n=5: compliance credential leaf) must over-provision to t=8, costing +927/+828 constraints per call, vs. +63/+247 for n=2/n=3 (exact-width support, measurably faster proving). A computed (not measured, clearly labeled) projection onto the production circuits showstransfer.circomandwithdraw.circomwould likely cross a Groth16 QAP domain-size doubling under a naive swap — working against the goal.BASELINE.mdunchanged (nothing to KEEP). A narrower, security-sensitive follow-up (generating custom t=5/t=6 round constants) is queued rather than attempted tonight.github.com/MystenLabs/sui/releasesandfullnode.testnet.sui.io), not a toolchain gap. Did not retry further per proxy policy.circom2(npm, WASM build of the circom compiler) reproducestransfer.circom's exact documented constraint counts with no build step and no GitHub access — a simpler alternative to last night's cargo-build-from-a-clone workaround, if the native-build path keeps needing blocked GitHub access.Full writeup:
docs/research/2026-08-26-poseidon2-arity-gap.mdTest plan
node --experimental-vm-modules test/{transfer,compliance,withdraw}.test.mjs— 108/108 passcd scripts && bun run src/test-converter.ts— 109/109 passcd frontend && bun run test— 19/19 passsui move test— not run,suiCLI unavailable in this sandbox (unchanged blocker, no Move code touched)docs/research/LEDGER.mdappended,docs/research/EXPERIMENTS.mdre-ranked (item feat: Tier 3 — KYC compliance circuit + ElGamal auditor pattern #2 settled REJECT, item feat: Veil privacy payment protocol — full stack MVP #1 refined with the confirmed policy-denial detail, two new follow-ups queued)Generated by Claude Code