Propsal PP public inputs

[krlosMata]

These are two proposals to slightly change the PP public inputs in order to save gas consumption when the proof is settled on L1.

Join all inputs into a single one

• hash all the theoretical public inputs into a single one such as:

keccak256(
    abi.encodePacked(
                msg.sender,
                oldStateRoot,
                oldAccInputHash,
                initNumBatch,
                rollup.chainID,
                rollup.forkID,
                newStateRoot,
                newAccInputHash,
                newLocalExitRoot,
                finalNewBatch
            );
)

The trade-off is:

• every public input in the groth16 SC Verifier increases its cost. This technique saves GAS when verifying the proof on L1
• it adds cycles in the proof since a keccak256 hash is needed

Join LBR & nullifierRoot into a single one

• This will just store a single 32bytes in the SC for every rollup instead of two. So, it saves writing one storage slot. 20K GAS if it is new one or 5K GAS if is rewritten
• It obfuscates data in L1 sine the roots will not be directly available on L1. but the hash of them
• it adds cycles in the proof since a keccak256 is needed

cc: @HarryTmetic @hadjiszs @pgebheim

[bpfarmer]

It obfuscates data in L1 sine the roots will not be directly available on L1. but the hash of them
it adds cycles in the proof since a keccak256 is needed

I think that this is fine - there shouldn't be any reason for L1 to access LBR or NullifierSetRoot so I think that combining the two is fine, and also using Poseidon (though keccak shouldn't add that many cycles) is also fine.

[krlosMata]

great !! From the SC perspective we will just only store the newStatePP, which is statePP = poseidon(LBR, NullifierSetRoot)
Then the theoretical inputs will be hashed and passed as a single input to the verifier.
Provisional single input:

keccak256(
    abi.encodePacked(
         oldLER,
        oldStatePP,
        hashBridgeExits, // maybe something else
        hashImportedBridgeExits, // maybe something else
        selectedGER; // or L1InfoTreeRoot
        pubclicKey, 
        newLER,
        newStatePP,
)

[krlosMata]

follow up: SP1 already joins all public inputs into a single one by default using sha256: https://github.com/succinctlabs/sp1-contracts/blob/main/contracts/src/v1.0.8-testnet/SP1Verifier.sol#L30

[krlosMata]

• Current public inputs SC:

abi.encodePacked(
                rollup.lastLocalExitRoot,
                rollup.lastPessimisticRoot,
                selectedGlobalExitRoot,
                rollupID,
                consensusHash,
                newLocalExitRoot,
                newPessimisticRoot
            );

• Adding additional public inputs (such as commitment(importedBridgesExits)) is straightforward on the SC side. Once public inputs are final, we will chnage the Sc accordingly
  @bpfarmer @hadjiszs @HarryTmetic

[krlosMata]

update: added networkID(aka rollupID)