diff --git a/barretenberg/cpp/src/barretenberg/commitment_schemes/commitment_key.hpp b/barretenberg/cpp/src/barretenberg/commitment_schemes/commitment_key.hpp index 1d107e822965..4108a072d72c 100644 --- a/barretenberg/cpp/src/barretenberg/commitment_schemes/commitment_key.hpp +++ b/barretenberg/cpp/src/barretenberg/commitment_schemes/commitment_key.hpp @@ -77,6 +77,7 @@ template class CommitmentKey { CommitmentKey(const size_t num_points, std::shared_ptr> prover_crs) : pippenger_runtime_state(num_points) , srs(prover_crs) + , dyadic_size(get_num_needed_srs_points(num_points)) {} /** @@ -90,6 +91,7 @@ template class CommitmentKey { PROFILE_THIS_NAME("commit"); // We must have a power-of-2 SRS points *after* subtracting by start_index. size_t dyadic_poly_size = numeric::round_up_power_2(polynomial.size()); + ASSERT(dyadic_poly_size <= dyadic_size && "Polynomial size exceeds commitment key size."); // Because pippenger prefers a power-of-2 size, we must choose a starting index for the points so that we don't // exceed the dyadic_circuit_size. The actual start index of the points will be the smallest it can be so that // the window of points is a power of 2 and still contains the scalars. The best we can do is pick a start index @@ -211,6 +213,7 @@ template class CommitmentKey { { PROFILE_THIS_NAME("commit_structured"); ASSERT(polynomial.end_index() <= srs->get_monomial_size()); + ASSERT(polynomial.end_index() <= dyadic_size && "Polynomial size exceeds commitment key size."); // Percentage of nonzero coefficients beyond which we resort to the conventional commit method constexpr size_t NONZERO_THRESHOLD = 75; diff --git a/barretenberg/cpp/src/barretenberg/commitment_schemes/small_subgroup_ipa/small_subgroup_ipa.hpp b/barretenberg/cpp/src/barretenberg/commitment_schemes/small_subgroup_ipa/small_subgroup_ipa.hpp index 54af7999a2ab..9ca4c61dc979 100644 --- a/barretenberg/cpp/src/barretenberg/commitment_schemes/small_subgroup_ipa/small_subgroup_ipa.hpp +++ b/barretenberg/cpp/src/barretenberg/commitment_schemes/small_subgroup_ipa/small_subgroup_ipa.hpp @@ -123,7 +123,7 @@ template class SmallSubgroupIPAProver { const std::vector& multivariate_challenge, const FF claimed_ipa_eval, std::shared_ptr transcript, - std::shared_ptr commitment_key) + std::shared_ptr& commitment_key) : interpolation_domain(zk_sumcheck_data.interpolation_domain) , concatenated_polynomial(zk_sumcheck_data.libra_concatenated_monomial_form) , libra_concatenated_lagrange_form(zk_sumcheck_data.libra_concatenated_lagrange_form) @@ -135,6 +135,11 @@ template class SmallSubgroupIPAProver { , batched_quotient(QUOTIENT_LENGTH) { + // Reallocate the commitment key if necessary. This is an edge case with SmallSubgroupIPA since it has + // polynomials that may exceed the circuit size. + if (commitment_key->dyadic_size < SUBGROUP_SIZE + 3) { + commitment_key = std::make_shared(SUBGROUP_SIZE + 3); + } // Extract the evaluation domain computed by ZKSumcheckData if constexpr (std::is_same_v) { bn_evaluation_domain = std::move(zk_sumcheck_data.bn_evaluation_domain); diff --git a/barretenberg/cpp/src/barretenberg/ecc/scalar_multiplication/scalar_multiplication.cpp b/barretenberg/cpp/src/barretenberg/ecc/scalar_multiplication/scalar_multiplication.cpp index 37995a15401a..08fc0b266e4a 100644 --- a/barretenberg/cpp/src/barretenberg/ecc/scalar_multiplication/scalar_multiplication.cpp +++ b/barretenberg/cpp/src/barretenberg/ecc/scalar_multiplication/scalar_multiplication.cpp @@ -905,6 +905,9 @@ typename Curve::Element pippenger_internal(std::span(state.point_schedule, state.skew_table, state.round_counts, scalars, num_initial_points); organize_buckets(state.point_schedule, num_initial_points * 2); @@ -923,6 +926,9 @@ typename Curve::Element pippenger(PolynomialSpan points, pippenger_runtime_state& state) { + ASSERT(scalars.start_index + scalars.size() <= state.num_points / 2 && + "Pippenger runtime state is too small to support this many points"); return pippenger(scalars, points, state, false); } @@ -1030,6 +1041,8 @@ typename Curve::Element pippenger_without_endomorphism_basis_points( // TODO(https://github.com/AztecProtocol/barretenberg/issues/1135): We don't need start_index more scalars here. std::vector G_mod((scalars.start_index + scalars.size()) * 2); ASSERT(scalars.start_index + scalars.size() <= points.size()); + ASSERT(scalars.start_index + scalars.size() <= state.num_points / 2 && + "Pippenger runtime state is too small to support this many points"); bb::scalar_multiplication::generate_pippenger_point_table( points.data(), &G_mod[0], scalars.start_index + scalars.size()); return pippenger(scalars, G_mod, state, false);