[Tabaie]

This PR changes the wire format of the GKR proof by sending the polynomial $f\coloneqq c_0 + c_1X + \cdots + c_dX^d$ as $[c_1, \cdots, c_d]$ rather than $[f(1), \cdots, f(d)]$. Interpolation thus falls on the prover rather than the verifier, which instead only computes $c_0$ and applies Horner to the completed polynomial at the round challenge point.

Benchmarked on an M5 laptop, native effects are minimal for $2^{20}$ Poseidon2 compressions over Koalabear:

	baseline	HEAD	change
Prover, runs (s)	9.51, 9.54, 9.95	10.00, 9.73, 9.87	within noise (mean 9.67 → 9.87)
Verifier, runs (ms)	3.706, 3.747, 3.820	3.576, 3.622, 3.658	−3.7% (mean 3.76 → 3.62)
Proof	2916 elements	2916 elements	unchanged
Prover TotalAlloc	6.7–6.8 GB	6.7–6.8 GB	unchanged

The projected recursive verifier savings are significant, however. A verifier that defers its hash computations, performs about $1040n$ extension-extension multiplications, where the number of instances is $2^n$. This PR saves about $400n$ of that, roughly 38%. $6n$ divisions are also removed.

This is a breaking change as the proof is interpreted incompatibly with master.

Some of the documentation has been improved: equation superscripts are turned into unicode subscripts when possible.

Depends on a Consensys-Incorporated/gnark-crypto#938 pin.

---

Note

High Risk
Breaking proof wire semantics in the GKR sumcheck core affects soundness if prover/verifier math diverge; changes touch all curve implementations and verification paths.

Overview
Breaking change: GKR sumcheck rounds now serialize each round polynomial as coefficients c₁…c_d (constant c₀ is derived on both sides), instead of point values f(1)…f(d). Proof.Flatten / deserialization order is unchanged; only the meaning of those field elements changes.

The prover runs InterpolateOnRange after building full round data via a new evaluationAtZero hook on sumcheckClaims, then absorbs c₁…c_d into the Fiat–Shamir transcript. The verifier recovers c₀ from the round sum constraint and advances the claim with Horner-style evaluation on the coefficient slice, avoiding per-round interpolation on the verify path.

foldClaims centralizes batching (folding coefficient squeeze + claimed sum from r.proof) for prove and verify; resources.proof replaces threading Proof through level helpers. Single-source zero-check paths use the same coefficient representation and updated c₀ math with stored evaluation point q.

The same logic is mirrored across all curve packages and generator templates; gnark-crypto is bumped in go.mod.

^{Reviewed by Cursor Bugbot for commit a626294. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​consensys/​gnark-crypto@​v0.22.1-0.20261103155519-1a9aede5b1c3 ⏵ v0.22.1-0.20261105032453-23c660cd7688

View full report