On-chain verification fails for recursive proofs

[signorecello]

Aim

I tried to verify on-chain a proof that verifies another proof

Expected Behavior

Verification behavior of recursive proofs should be consistent across off-chain and on-chain verifications.

Bug

Verification passes off chain, but resulted in PROOF_FAILURE on chain.

To Reproduce

1. git clone https://github.com/noir-lang/noir-examples.git
2. cd recursion
3. yarn && yarn test

It compiles noir program code, receiving circuit bytes and abi object.
    Normal flow
      Proof generation
        ✔ Should generate a final proof (333ms)
      Proof verification
        ✔ Should verify off-chain
        ✔ Should verify on-chain (568ms)
    Recursive flow
      Proof generation
        ✔ Should generate an intermediate proof (390ms)
        ✔ Should generate a final proof with a recursive input (22377ms)
      Proof verification
        ✔ Should verify off-chain (10392ms)
        1) Should verify on-chain


  6 passing (38s)
  1 failing

  1) It compiles noir program code, receiving circuit bytes and abi object.
       Recursive flow
         Proof verification
           Should verify on-chain:
     Error: call revert exception [ See: https://links.ethers.org/v5-errors-CALL_EXCEPTION ] (method="verify(bytes,bytes32[])", data="0x0711fcec", errorArgs=[], errorName="PROOF_FAILURE", errorSignature="PROOF_FAILURE()", reason=null, code=CALL_EXCEPTION, version=abi/5.7.0)
      at Logger.makeError (node_modules/@ethersproject/logger/src.ts/index.ts:269:28)
      at Logger.throwError (node_modules/@ethersproject/logger/src.ts/index.ts:281:20)
      at Interface.decodeFunctionResult (node_modules/@ethersproject/abi/src.ts/interface.ts:427:23)
      at Contract.<anonymous> (node_modules/@ethersproject/contracts/src.ts/index.ts:400:44)
      at step (node_modules/@ethersproject/contracts/lib/index.js:48:23)
      at Object.next (node_modules/@ethersproject/contracts/lib/index.js:29:53)
      at fulfilled (node_modules/@ethersproject/contracts/lib/index.js:20:58)
      at processTicksAndRejections (node:internal/process/task_queues:95:5)
      at runNextTicks (node:internal/process/task_queues:64:3)
      at listOnTimeout (node:internal/timers:538:9)

Noir JS Package Versions

Manually updated the dependencies to:

"@noir-lang/backend_barretenberg": "^0.18.0",
"@noir-lang/noir_js": "^0.18.0",
"@noir-lang/noir_wasm": "^0.18.0",
"@noir-lang/source-resolver": "^0.18.0",
"@noir-lang/types": "^0.18.0",

but the problem still persists.

Would you like to submit a PR for this Issue?

No

Support Needs

No response

[vezenovm]

Could you provide more versioning information? How did you generate the proof etc.? Did you regenerate the solidity verifier? There has been changes to UP recently that would require the contract to be regenerated.

[Savio-Sou]

Assigning P-HIGH to this Issue, as this blocks E2E use of recursion, hence recursion's public release, hence Noir Beta's public release.

[Savio-Sou]

@TomAFrench advised:

I've tested taking a recursive proof which has been generated in Rust over to JS and it verifies inside a SC from there. That should mean that the issue is somewhere in how we generate recursive proofs inside JS. This is a bit weird though as we'd need two bugs in that case as proof verification in JS succeeds so we'd need to be reporting an invalid proof as true.

I've checked and JS and Rust agree on the vk, vkhash and public inputs so the only difference would be in the proof itself (randomness makes this hard to debug however)

Labeling this with js as it could be related to problem with how NoirJS generates its proofs, similar to #3524.

[Savio-Sou]

With AztecProtocol/aztec-packages#3161 and AztecProtocol/aztec-packages#3425, the issue is now resolved.

Noir JS packages >=v0.19.4 contain the fixes.

Example: https://github.com/noir-lang/noir-examples/tree/kw/update-to-0-19-4/recursion