diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..aefc189
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,38 @@
+name: Unit Test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+env:
+  FOUNDRY_PROFILE: ci
+
+jobs:
+  sol:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Install Foundry
+        uses: "foundry-rs/foundry-toolchain@v1"
+
+      - name: Build the contracts and print their size
+        working-directory: ./contracts
+        run: forge build --sizes
+
+      - name: Ensure files are the same as forge fmt
+        working-directory: ./contracts
+        run: forge fmt --check
+
+      - name: Run the tests
+        working-directory: ./contracts
+        run: forge test
+
+      - name: Add test summary
+        run: |
+          echo "## Tests result" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Passed" >> $GITHUB_STEP_SUMMARY
diff --git a/.gitmodules b/.gitmodules
index c65a596..2d097fb 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +1,8 @@
 [submodule "contracts/lib/forge-std"]
 	path = contracts/lib/forge-std
 	url = https://github.com/foundry-rs/forge-std
+	tag = v1.8.2
+[submodule "contracts/lib/openzeppelin-contracts"]
+	path = contracts/lib/openzeppelin-contracts
+	url = https://github.com/openzeppelin/openzeppelin-contracts
+	tag = v5.0.2
\ No newline at end of file
diff --git a/contracts/.github/workflows/test.yml b/contracts/.github/workflows/test.yml
deleted file mode 100644
index 9282e82..0000000
--- a/contracts/.github/workflows/test.yml
+++ /dev/null
@@ -1,34 +0,0 @@
-name: test
-
-on: workflow_dispatch
-
-env:
-  FOUNDRY_PROFILE: ci
-
-jobs:
-  check:
-    strategy:
-      fail-fast: true
-
-    name: Foundry project
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
-        with:
-          version: nightly
-
-      - name: Run Forge build
-        run: |
-          forge --version
-          forge build --sizes
-        id: build
-
-      - name: Run Forge tests
-        run: |
-          forge test -vvv
-        id: test
diff --git a/contracts/.solhint.json b/contracts/.solhint.json
new file mode 100644
index 0000000..c85b329
--- /dev/null
+++ b/contracts/.solhint.json
@@ -0,0 +1,21 @@
+{
+	"extends": "solhint:recommended",
+	"rules": {
+		"code-complexity": [
+			"error",
+			18
+		],
+		"compiler-version": [
+			"error",
+			">=0.8.20"
+		],
+		"max-line-length": [
+			"off",
+			100
+		],
+		"no-console": "off",
+		"var-name-mixedcase": "off",
+		"func-name-mixedcase": "off",
+		"avoid-low-level-calls": "off"
+	}
+}
\ No newline at end of file
diff --git a/contracts/foundry.toml b/contracts/foundry.toml
index 25b918f..598af94 100644
--- a/contracts/foundry.toml
+++ b/contracts/foundry.toml
@@ -2,5 +2,12 @@
 src = "src"
 out = "out"
 libs = ["lib"]
+solc = '0.8.20'
 
-# See more config options https://github.com/foundry-rs/foundry/blob/master/crates/config/README.md#all-options
+[fmt]
+line_length = 100
+tab_width = 4
+func_attrs_with_params_multiline = true
+ignore = ["lib/**"]
+
+# See more config options https://github.com/foundry-rs/foundry/blob/master/crates/config/README.md#all-options
\ No newline at end of file
diff --git a/contracts/lib/openzeppelin-contracts b/contracts/lib/openzeppelin-contracts
new file mode 160000
index 0000000..dbb6104
--- /dev/null
+++ b/contracts/lib/openzeppelin-contracts
@@ -0,0 +1 @@
+Subproject commit dbb6104ce834628e473d2173bbc9d47f81a9eec3
diff --git a/contracts/script/SP1Verifier.s.sol b/contracts/script/SP1Verifier.s.sol
index 1a33c49..6bf7f50 100644
--- a/contracts/script/SP1Verifier.s.sol
+++ b/contracts/script/SP1Verifier.s.sol
@@ -1,5 +1,5 @@
-// SPDX-License-Identifier: UNLICENSED
-pragma solidity ^0.8.13;
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
 
 import {Script, console} from "forge-std/Script.sol";
 
diff --git a/contracts/src/ISP1Verifier.sol b/contracts/src/ISP1Verifier.sol
index 1ea8727..21eb13d 100644
--- a/contracts/src/ISP1Verifier.sol
+++ b/contracts/src/ISP1Verifier.sol
@@ -1,23 +1,24 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.19;
+pragma solidity ^0.8.20;
 
 /// @title SP1 Verifier Interface
 /// @author Succinct Labs
 /// @notice This contract is the interface for the SP1 Verifier.
 interface ISP1Verifier {
-    /// @notice Returns the version of SP1 this verifier corresponds to.
-    function VERSION() external pure returns (string memory);
-
-    /// @notice Returns the hash of the verification key.
-    function VKEY_HASH() external pure returns (bytes32);
-
     /// @notice Verifies a proof with given public values and vkey.
-    /// @param vkey The verification key for the RISC-V program.
+    /// @dev It is expected that the first 4 bytes of proofBytes must match the first 4 bytes of
+    /// target verifier's VERIFIER_HASH.
+    /// @param programVKey The verification key for the RISC-V program.
     /// @param publicValues The public values encoded as bytes.
     /// @param proofBytes The proof of the program execution the SP1 zkVM encoded as bytes.
     function verifyProof(
-        bytes32 vkey,
+        bytes32 programVKey,
         bytes calldata publicValues,
         bytes calldata proofBytes
     ) external view;
 }
+
+interface ISP1VerifierWithHash is ISP1Verifier {
+    /// @notice Returns the hash of the verifier.
+    function VERIFIER_HASH() external pure returns (bytes32);
+}
diff --git a/contracts/src/ISP1VerifierGateway.sol b/contracts/src/ISP1VerifierGateway.sol
new file mode 100644
index 0000000..5d869c7
--- /dev/null
+++ b/contracts/src/ISP1VerifierGateway.sol
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {ISP1Verifier} from "./ISP1Verifier.sol";
+
+/// @dev A struct containing the address of a verifier and whether the verifier is frozen. A
+/// frozen verifier cannot be routed to.
+struct VerifierRoute {
+    address verifier;
+    bool frozen;
+}
+
+interface ISP1VerifierGatewayEvents {
+    /// @notice Emitted when a verifier route is added.
+    /// @param selector The verifier selector that was added.
+    /// @param verifier The address of the verifier contract.
+    event RouteAdded(bytes4 selector, address verifier);
+
+    /// @notice Emitted when a verifier route is frozen.
+    /// @param selector The verifier selector that was frozen.
+    /// @param verifier The address of the verifier contract.
+    event RouteFrozen(bytes4 selector, address verifier);
+}
+
+interface ISP1VerifierGatewayErrors {
+    /// @notice Thrown when the verifier route is not found.
+    /// @param selector The verifier selector that was specified.
+    error RouteNotFound(bytes4 selector);
+
+    /// @notice Thrown when the verifier route is found, but is frozen.
+    /// @param selector The verifier selector that was specified.
+    error RouteIsFrozen(bytes4 selector);
+
+    /// @notice Thrown when adding a verifier route and the selector already contains a route.
+    /// @param verifier The address of the verifier contract in the existing route.
+    error RouteAlreadyExists(address verifier);
+
+    /// @notice Thrown when adding a verifier route and the selector returned by the verifier is
+    /// zero.
+    error SelectorCannotBeZero();
+}
+
+/// @title SP1 Verifier Gateway Interface
+/// @author Succinct Labs
+/// @notice This contract is the interface for the SP1 Verifier Gateway.
+interface ISP1VerifierGateway is
+    ISP1VerifierGatewayEvents,
+    ISP1VerifierGatewayErrors,
+    ISP1Verifier
+{
+    /// @notice Mapping of 4-byte verifier selectors to verifier routes.
+    /// @dev Only one verifier route can be added for each selector.
+    /// @param selector The verifier selector, which is both the first 4 bytes of the VERIFIER_HASH
+    /// and the first 4 bytes of the proofs designed for that verifier.
+    /// @return verifier The address of the verifier contract.
+    /// @return frozen Whether the verifier is frozen.
+    function routes(bytes4 selector) external view returns (address verifier, bool frozen);
+
+    /// @notice Adds a verifier route. This enable proofs to be routed to this verifier.
+    /// @dev Only callable by the owner. The owner is responsible for ensuring that the specified
+    /// verifier is correct with a valid VERIFIER_HASH. Once a route to a verifier is added, it
+    /// cannot be removed.
+    /// @param verifier The address of the verifier contract. This verifier MUST implement the
+    /// ISP1VerifierWithHash interface.
+    function addRoute(address verifier) external;
+
+    /// @notice Freezes a verifier route. This prevents proofs from being routed to this verifier.
+    /// @dev Only callable by the owner. Once a route to a verifier is frozen, it cannot be
+    /// unfrozen.
+    /// @param selector The verifier selector to freeze.
+    function freezeRoute(bytes4 selector) external;
+}
diff --git a/contracts/src/PlonkVerifier.sol b/contracts/src/PlonkVerifier.sol
deleted file mode 100644
index ef8f701..0000000
--- a/contracts/src/PlonkVerifier.sol
+++ /dev/null
@@ -1,1332 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-
-// Copyright 2023 Consensys Software Inc.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Code generated by gnark DO NOT EDIT
-
-pragma solidity ^0.8.19;
-
-contract PlonkVerifier {
-
-  uint256 private constant R_MOD = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-  uint256 private constant R_MOD_MINUS_ONE = 21888242871839275222246405745257275088548364400416034343698204186575808495616;
-  uint256 private constant P_MOD = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-  
-  uint256 private constant G2_SRS_0_X_0 = 11559732032986387107991004021392285783925812861821192530917403151452391805634;
-  uint256 private constant G2_SRS_0_X_1 = 10857046999023057135944570762232829481370756359578518086990519993285655852781;
-  uint256 private constant G2_SRS_0_Y_0 = 4082367875863433681332203403145435568316851327593401208105741076214120093531;
-  uint256 private constant G2_SRS_0_Y_1 = 8495653923123431417604973247489272438418190587263600148770280649306958101930;
-  
-  uint256 private constant G2_SRS_1_X_0 = 15805639136721018565402881920352193254830339253282065586954346329754995870280;
-  uint256 private constant G2_SRS_1_X_1 = 19089565590083334368588890253123139704298730990782503769911324779715431555531;
-  uint256 private constant G2_SRS_1_Y_0 = 9779648407879205346559610309258181044130619080926897934572699915909528404984;
-  uint256 private constant G2_SRS_1_Y_1 = 6779728121489434657638426458390319301070371227460768374343986326751507916979;
-  
-  uint256 private constant G1_SRS_X = 14312776538779914388377568895031746459131577658076416373430523308756343304251;
-  uint256 private constant G1_SRS_Y = 11763105256161367503191792604679297387056316997144156930871823008787082098465;
-
-  // ----------------------- vk ---------------------
-  uint256 private constant VK_NB_PUBLIC_INPUTS = 2;
-  uint256 private constant VK_DOMAIN_SIZE = 67108864;
-  uint256 private constant VK_INV_DOMAIN_SIZE = 21888242545679039938882419398440172875981108180010270949818755658014750055173;
-  uint256 private constant VK_OMEGA = 7419588552507395652481651088034484897579724952953562618697845598160172257810;
-  uint256 private constant VK_QL_COM_X = 2510865836342267429164163502598759509233852557614588061522341500382391532005;
-  uint256 private constant VK_QL_COM_Y = 15126192188192629774065132265780112999140142830433564320449141735872321728630;
-  uint256 private constant VK_QR_COM_X = 9333652959929076130675473782051903816259917465603863191457122028934650097457;
-  uint256 private constant VK_QR_COM_Y = 2313370322493955964357872255577010408876655837557938852207734814532131060361;
-  uint256 private constant VK_QM_COM_X = 9695457198608976564938847790280162275205746283048408216283499672902690859636;
-  uint256 private constant VK_QM_COM_Y = 2863222446359988991116462236914508045597262668919200556923697932352945902094;
-  uint256 private constant VK_QO_COM_X = 17143802559384719837929824985685699892440981030866765423035114092186969346839;
-  uint256 private constant VK_QO_COM_Y = 7035954688092870566772269661940626992719825409924783939927782818192065440004;
-  uint256 private constant VK_QK_COM_X = 21445645220242675557007054864075083862767574532736843083792911169558332021092;
-  uint256 private constant VK_QK_COM_Y = 15253869392669919290219800592812754879649859828328995608623647268881615845194;
-  
-  uint256 private constant VK_S1_COM_X = 21060316691690652216900052151773860810138987313309957676007513966927821347831;
-  uint256 private constant VK_S1_COM_Y = 19256351951337671769199565809385521104102167502963443186067549090409440417696;
-  
-  uint256 private constant VK_S2_COM_X = 12407785672743756788481704158638509568132154189030236015878537159964718545787;
-  uint256 private constant VK_S2_COM_Y = 11224677738210739259642063251131968487382105453016414942600495075901339030055;
-  
-  uint256 private constant VK_S3_COM_X = 21872545519839958987912275906732152426354809332288401338845764466421833288920;
-  uint256 private constant VK_S3_COM_Y = 12847692498097562704188864683633196071506587648307456692644131497300644533735;
-  
-  uint256 private constant VK_COSET_SHIFT = 5;
-  
-  
-  uint256 private constant VK_QCP_0_X = 3924710379213476882172010215773914137297360196327858615369966568647879502209;
-  uint256 private constant VK_QCP_0_Y = 7151069519516975683787976500213788273069269794747379876269151195768245484982;
-  
-  
-  uint256 private constant VK_INDEX_COMMIT_API_0 = 32440226;
-  uint256 private constant VK_NB_CUSTOM_GATES = 1;
-
-  // ------------------------------------------------
-
-  // offset proof
-  
-  uint256 private constant PROOF_L_COM_X = 0x0;
-  uint256 private constant PROOF_L_COM_Y = 0x20;
-  uint256 private constant PROOF_R_COM_X = 0x40;
-  uint256 private constant PROOF_R_COM_Y = 0x60;
-  uint256 private constant PROOF_O_COM_X = 0x80;
-  uint256 private constant PROOF_O_COM_Y = 0xa0;
-
-  // h = h_0 + x^{n+2}h_1 + x^{2(n+2)}h_2
-  uint256 private constant PROOF_H_0_X = 0xc0;
-  uint256 private constant PROOF_H_0_Y = 0xe0;
-  uint256 private constant PROOF_H_1_X = 0x100;
-  uint256 private constant PROOF_H_1_Y = 0x120;
-  uint256 private constant PROOF_H_2_X = 0x140;
-  uint256 private constant PROOF_H_2_Y = 0x160;
-
-  // wire values at zeta
-  uint256 private constant PROOF_L_AT_ZETA = 0x180;
-  uint256 private constant PROOF_R_AT_ZETA = 0x1a0;
-  uint256 private constant PROOF_O_AT_ZETA = 0x1c0;
-
-  // S1(zeta),S2(zeta)
-  uint256 private constant PROOF_S1_AT_ZETA = 0x1e0; // Sσ1(zeta)
-  uint256 private constant PROOF_S2_AT_ZETA = 0x200; // Sσ2(zeta)
-
-  // [Z]
-  uint256 private constant PROOF_GRAND_PRODUCT_COMMITMENT_X = 0x220;
-  uint256 private constant PROOF_GRAND_PRODUCT_COMMITMENT_Y = 0x240;
-
-  uint256 private constant PROOF_GRAND_PRODUCT_AT_ZETA_OMEGA = 0x260; // z(w*zeta)
-
-  // Folded proof for the opening of linearised poly, l, r, o, s_1, s_2, qcp
-  uint256 private constant PROOF_BATCH_OPENING_AT_ZETA_X = 0x280;
-  uint256 private constant PROOF_BATCH_OPENING_AT_ZETA_Y = 0x2a0;
-
-  uint256 private constant PROOF_OPENING_AT_ZETA_OMEGA_X = 0x2c0;
-  uint256 private constant PROOF_OPENING_AT_ZETA_OMEGA_Y = 0x2e0;
-
-  uint256 private constant PROOF_OPENING_QCP_AT_ZETA = 0x300;
-  uint256 private constant PROOF_BSB_COMMITMENTS = 0x320;
-
-  // -> next part of proof is
-  // [ openings_selector_commits || commitments_wires_commit_api]
-
-  // -------- offset state
-
-  // challenges to check the claimed quotient
-  
-  uint256 private constant STATE_ALPHA = 0x0;
-  uint256 private constant STATE_BETA = 0x20;
-  uint256 private constant STATE_GAMMA = 0x40;
-  uint256 private constant STATE_ZETA = 0x60;
-  uint256 private constant STATE_ALPHA_SQUARE_LAGRANGE_0 = 0x80;
-  uint256 private constant STATE_FOLDED_H_X = 0xa0;
-  uint256 private constant STATE_FOLDED_H_Y = 0xc0;
-  uint256 private constant STATE_LINEARISED_POLYNOMIAL_X = 0xe0;
-  uint256 private constant STATE_LINEARISED_POLYNOMIAL_Y = 0x100;
-  uint256 private constant STATE_OPENING_LINEARISED_POLYNOMIAL_ZETA = 0x120;
-  uint256 private constant STATE_FOLDED_CLAIMED_VALUES = 0x140; // Folded proof for the opening of H, linearised poly, l, r, o, s_1, s_2, qcp
-  uint256 private constant STATE_FOLDED_DIGESTS_X = 0x160; // folded digests of H, linearised poly, l, r, o, s_1, s_2, qcp
-  uint256 private constant STATE_FOLDED_DIGESTS_Y = 0x180;
-  uint256 private constant STATE_PI = 0x1a0;
-  uint256 private constant STATE_ZETA_POWER_N_MINUS_ONE = 0x1c0;
-  uint256 private constant STATE_GAMMA_KZG = 0x1e0;
-  uint256 private constant STATE_SUCCESS = 0x200;
-  uint256 private constant STATE_CHECK_VAR = 0x220; // /!\ this slot is used for debugging only
-  uint256 private constant STATE_LAST_MEM = 0x240;
-
-  // -------- utils (for Fiat Shamir)
-  uint256 private constant FS_ALPHA = 0x616C706861; // "alpha"
-  uint256 private constant FS_BETA = 0x62657461; // "beta"
-  uint256 private constant FS_GAMMA = 0x67616d6d61; // "gamma"
-  uint256 private constant FS_ZETA = 0x7a657461; // "zeta"
-  uint256 private constant FS_GAMMA_KZG = 0x67616d6d61; // "gamma"
-
-  // -------- errors
-  uint256 private constant ERROR_STRING_ID = 0x08c379a000000000000000000000000000000000000000000000000000000000; // selector for function Error(string)
-
-  
-  // -------- utils (for hash_fr)
-	uint256 private constant HASH_FR_BB = 340282366920938463463374607431768211456; // 2**128
-	uint256 private constant HASH_FR_ZERO_UINT256 = 0;
-	uint8 private constant HASH_FR_LEN_IN_BYTES = 48;
-	uint8 private constant HASH_FR_SIZE_DOMAIN = 11;
-	uint8 private constant HASH_FR_ONE = 1;
-	uint8 private constant HASH_FR_TWO = 2;
-  
-
-  // -------- precompiles
-  uint8 private constant MOD_EXP = 0x5;
-  uint8 private constant EC_ADD = 0x6;
-  uint8 private constant EC_MUL = 0x7;
-  uint8 private constant EC_PAIR = 0x8;
-  
-  /// Verify a Plonk proof.
-  /// Reverts if the proof or the public inputs are malformed.
-  /// @param proof serialised plonk proof (using gnark's MarshalSolidity)
-  /// @param public_inputs (must be reduced)
-  /// @return success true if the proof passes false otherwise
-  function Verify(bytes calldata proof, uint256[] calldata public_inputs) 
-  public view returns(bool success) {
-
-    assembly {
-
-      let mem := mload(0x40)
-      let freeMem := add(mem, STATE_LAST_MEM)
-
-      // sanity checks
-      check_number_of_public_inputs(public_inputs.length)
-      check_inputs_size(public_inputs.length, public_inputs.offset)
-      check_proof_size(proof.length)
-      check_proof_openings_size(proof.offset)
-
-      // compute the challenges
-      let prev_challenge_non_reduced
-      prev_challenge_non_reduced := derive_gamma(proof.offset, public_inputs.length, public_inputs.offset)
-      prev_challenge_non_reduced := derive_beta(prev_challenge_non_reduced)
-      prev_challenge_non_reduced := derive_alpha(proof.offset, prev_challenge_non_reduced)
-      derive_zeta(proof.offset, prev_challenge_non_reduced)
-
-      // evaluation of Z=Xⁿ-1 at ζ, we save this value
-      let zeta := mload(add(mem, STATE_ZETA))
-      let zeta_power_n_minus_one := addmod(pow(zeta, VK_DOMAIN_SIZE, freeMem), sub(R_MOD, 1), R_MOD)
-      mstore(add(mem, STATE_ZETA_POWER_N_MINUS_ONE), zeta_power_n_minus_one)
-
-      // public inputs contribution
-      let l_pi := sum_pi_wo_api_commit(public_inputs.offset, public_inputs.length, freeMem)
-      let l_pi_commit := sum_pi_commit(proof.offset, public_inputs.length, freeMem)
-      l_pi := addmod(l_pi_commit, l_pi, R_MOD)
-      mstore(add(mem, STATE_PI), l_pi)
-
-      compute_alpha_square_lagrange_0()
-      verify_opening_linearised_polynomial(proof.offset)
-      fold_h(proof.offset)
-      compute_commitment_linearised_polynomial(proof.offset)
-      compute_gamma_kzg(proof.offset)
-      fold_state(proof.offset)
-      batch_verify_multi_points(proof.offset)
-
-      success := mload(add(mem, STATE_SUCCESS))
-
-      // Beginning errors -------------------------------------------------
-
-      function error_nb_public_inputs() {
-        let ptError := mload(0x40)
-        mstore(ptError, ERROR_STRING_ID) // selector for function Error(string)
-        mstore(add(ptError, 0x4), 0x20)
-        mstore(add(ptError, 0x24), 0x1d)
-        mstore(add(ptError, 0x44), "wrong number of public inputs")
-        revert(ptError, 0x64)
-      }
-
-      /// Called when an operation on Bn254 fails
-      /// @dev for instance when calling EcMul on a point not on Bn254.
-      function error_ec_op() {
-        let ptError := mload(0x40)
-        mstore(ptError, ERROR_STRING_ID) // selector for function Error(string)
-        mstore(add(ptError, 0x4), 0x20)
-        mstore(add(ptError, 0x24), 0x12)
-        mstore(add(ptError, 0x44), "error ec operation")
-        revert(ptError, 0x64)
-      }
-
-      /// Called when one of the public inputs is not reduced.
-      function error_inputs_size() {
-        let ptError := mload(0x40)
-        mstore(ptError, ERROR_STRING_ID) // selector for function Error(string)
-        mstore(add(ptError, 0x4), 0x20)
-        mstore(add(ptError, 0x24), 0x18)
-        mstore(add(ptError, 0x44), "inputs are bigger than r")
-        revert(ptError, 0x64)
-      }
-
-      /// Called when the size proof is not as expected
-      /// @dev to avoid overflow attack for instance
-      function error_proof_size() {
-        let ptError := mload(0x40)
-        mstore(ptError, ERROR_STRING_ID) // selector for function Error(string)
-        mstore(add(ptError, 0x4), 0x20)
-        mstore(add(ptError, 0x24), 0x10)
-        mstore(add(ptError, 0x44), "wrong proof size")
-        revert(ptError, 0x64)
-      }
-
-      /// Called when one the openings is bigger than r
-      /// The openings are the claimed evalutions of a polynomial
-      /// in a Kzg proof.
-      function error_proof_openings_size() {
-        let ptError := mload(0x40)
-        mstore(ptError, ERROR_STRING_ID) // selector for function Error(string)
-        mstore(add(ptError, 0x4), 0x20)
-        mstore(add(ptError, 0x24), 0x16)
-        mstore(add(ptError, 0x44), "openings bigger than r")
-        revert(ptError, 0x64)
-      }
-
-      function error_pairing() {
-        let ptError := mload(0x40)
-        mstore(ptError, ERROR_STRING_ID) // selector for function Error(string)
-        mstore(add(ptError, 0x4), 0x20)
-        mstore(add(ptError, 0x24), 0xd)
-        mstore(add(ptError, 0x44), "error pairing")
-        revert(ptError, 0x64)
-      }
-
-      function error_verify() {
-        let ptError := mload(0x40)
-        mstore(ptError, ERROR_STRING_ID) // selector for function Error(string)
-        mstore(add(ptError, 0x4), 0x20)
-        mstore(add(ptError, 0x24), 0xc)
-        mstore(add(ptError, 0x44), "error verify")
-        revert(ptError, 0x64)
-      }
-
-      function error_random_generation() {
-        let ptError := mload(0x40)
-        mstore(ptError, ERROR_STRING_ID) // selector for function Error(string)
-        mstore(add(ptError, 0x4), 0x20)
-        mstore(add(ptError, 0x24), 0x14)
-        mstore(add(ptError, 0x44), "error random gen kzg")
-        revert(ptError, 0x64)
-      }
-      // end errors -------------------------------------------------
-
-      // Beginning checks -------------------------------------------------
-      
-      /// @param s actual number of public inputs
-      function check_number_of_public_inputs(s) {
-        if iszero(eq(s, VK_NB_PUBLIC_INPUTS)) {
-          error_nb_public_inputs()
-        }
-      }
-    
-      /// Checks that the public inputs are < R_MOD.
-      /// @param s number of public inputs
-      /// @param p pointer to the public inputs array
-      function check_inputs_size(s, p) {
-        for {let i} lt(i, s) {i:=add(i,1)}
-        {
-          if gt(calldataload(p), R_MOD_MINUS_ONE) {
-            error_inputs_size()
-          }
-          p := add(p, 0x20)
-        }
-      }
-
-      /// Checks if the proof is of the correct size
-      /// @param actual_proof_size size of the proof (not the expected size)
-      function check_proof_size(actual_proof_size) {
-        let expected_proof_size := add(0x300, mul(VK_NB_CUSTOM_GATES,0x60))
-        if iszero(eq(actual_proof_size, expected_proof_size)) {
-         error_proof_size() 
-        }
-      }
-    
-      /// Checks if the multiple openings of the polynomials are < R_MOD.
-      /// @param aproof pointer to the beginning of the proof
-      /// @dev the 'a' prepending proof is to have a local name
-      function check_proof_openings_size(aproof) {
-        
-        // PROOF_L_AT_ZETA
-        let p := add(aproof, PROOF_L_AT_ZETA)
-        if gt(calldataload(p), R_MOD_MINUS_ONE) {
-          error_proof_openings_size()
-        }
-
-        // PROOF_R_AT_ZETA
-        p := add(aproof, PROOF_R_AT_ZETA)
-        if gt(calldataload(p), R_MOD_MINUS_ONE) {
-          error_proof_openings_size()
-        }
-
-        // PROOF_O_AT_ZETA
-        p := add(aproof, PROOF_O_AT_ZETA)
-        if gt(calldataload(p), R_MOD_MINUS_ONE) {
-          error_proof_openings_size()
-        }
-
-        // PROOF_S1_AT_ZETA
-        p := add(aproof, PROOF_S1_AT_ZETA)
-        if gt(calldataload(p), R_MOD_MINUS_ONE) {
-          error_proof_openings_size()
-        }
-        
-        // PROOF_S2_AT_ZETA
-        p := add(aproof, PROOF_S2_AT_ZETA)
-        if gt(calldataload(p), R_MOD_MINUS_ONE) {
-          error_proof_openings_size()
-        }
-
-        // PROOF_GRAND_PRODUCT_AT_ZETA_OMEGA
-        p := add(aproof, PROOF_GRAND_PRODUCT_AT_ZETA_OMEGA)
-        if gt(calldataload(p), R_MOD_MINUS_ONE) {
-          error_proof_openings_size()
-        }
-
-        // PROOF_OPENING_QCP_AT_ZETA
-        
-        p := add(aproof, PROOF_OPENING_QCP_AT_ZETA)
-        for {let i:=0} lt(i, VK_NB_CUSTOM_GATES) {i:=add(i,1)}
-        {
-          if gt(calldataload(p), R_MOD_MINUS_ONE) {
-            error_proof_openings_size()
-          }
-          p := add(p, 0x20)
-        }
-
-      }
-      // end checks -------------------------------------------------
-
-      // Beginning challenges -------------------------------------------------
-
-      /// Derive gamma as Sha256(<transcript>)
-      /// @param aproof pointer to the proof
-      /// @param nb_pi number of public inputs
-      /// @param pi pointer to the array of public inputs
-      /// @return the challenge gamma, not reduced
-      /// @notice The transcript is the concatenation (in this order) of:
-      /// * the word "gamma" in ascii, equal to [0x67,0x61,0x6d, 0x6d, 0x61] and encoded as a uint256.
-      /// * the commitments to the permutation polynomials S1, S2, S3, where we concatenate the coordinates of those points
-      /// * the commitments of Ql, Qr, Qm, Qo, Qk
-      /// * the public inputs
-      /// * the commitments of the wires related to the custom gates (commitments_wires_commit_api)
-      /// * commitments to L, R, O (proof_<l,r,o>_com_<x,y>)
-      /// The data described above is written starting at mPtr. "gamma" lies on 5 bytes,
-      /// and is encoded as a uint256 number n. In basis b = 256, the number looks like this
-      /// [0 0 0 .. 0x67 0x61 0x6d, 0x6d, 0x61]. The first non zero entry is at position 27=0x1b
-      /// Gamma reduced (the actual challenge) is stored at add(state, state_gamma)
-      function derive_gamma(aproof, nb_pi, pi)->gamma_not_reduced {
-        
-        let state := mload(0x40)
-        let mPtr := add(state, STATE_LAST_MEM)
-
-        // gamma
-        // gamma in ascii is [0x67,0x61,0x6d, 0x6d, 0x61]
-        // (same for alpha, beta, zeta)
-        mstore(mPtr, FS_GAMMA) // "gamma"
-
-        mstore(add(mPtr, 0x20), VK_S1_COM_X)
-        mstore(add(mPtr, 0x40), VK_S1_COM_Y)
-        mstore(add(mPtr, 0x60), VK_S2_COM_X)
-        mstore(add(mPtr, 0x80), VK_S2_COM_Y)
-        mstore(add(mPtr, 0xa0), VK_S3_COM_X)
-        mstore(add(mPtr, 0xc0), VK_S3_COM_Y)
-        mstore(add(mPtr, 0xe0), VK_QL_COM_X)
-        mstore(add(mPtr, 0x100), VK_QL_COM_Y)
-        mstore(add(mPtr, 0x120), VK_QR_COM_X)
-        mstore(add(mPtr, 0x140), VK_QR_COM_Y)
-        mstore(add(mPtr, 0x160), VK_QM_COM_X)
-        mstore(add(mPtr, 0x180), VK_QM_COM_Y)
-        mstore(add(mPtr, 0x1a0), VK_QO_COM_X)
-        mstore(add(mPtr, 0x1c0), VK_QO_COM_Y)
-        mstore(add(mPtr, 0x1e0), VK_QK_COM_X)
-        mstore(add(mPtr, 0x200), VK_QK_COM_Y)
-        
-        mstore(add(mPtr, 0x220), VK_QCP_0_X)
-        mstore(add(mPtr, 0x240), VK_QCP_0_Y)
-        
-        // public inputs
-        let _mPtr := add(mPtr, 0x260)
-        let size_pi_in_bytes := mul(nb_pi, 0x20)
-        calldatacopy(_mPtr, pi, size_pi_in_bytes)
-        _mPtr := add(_mPtr, size_pi_in_bytes)
-
-        // commitments to l, r, o
-        let size_commitments_lro_in_bytes := 0xc0
-        calldatacopy(_mPtr, aproof, size_commitments_lro_in_bytes)
-        _mPtr := add(_mPtr, size_commitments_lro_in_bytes)
-
-        // total size is :
-        // sizegamma(=0x5) + 11*64(=0x2c0)
-        // + nb_public_inputs*0x20
-        // + nb_custom gates*0x40
-        let size := add(0x2c5, size_pi_in_bytes)
-        
-        size := add(size, mul(VK_NB_CUSTOM_GATES, 0x40))
-        let l_success := staticcall(gas(), 0x2, add(mPtr, 0x1b), size, mPtr, 0x20) //0x1b -> 000.."gamma"
-        if iszero(l_success) {
-          error_verify()
-        }
-        gamma_not_reduced := mload(mPtr)
-        mstore(add(state, STATE_GAMMA), mod(gamma_not_reduced, R_MOD))
-      }
-
-      /// derive beta as Sha256<transcript>
-      /// @param gamma_not_reduced the previous challenge (gamma) not reduced
-      /// @return beta_not_reduced the next challenge, beta, not reduced
-      /// @notice the transcript consists of the previous challenge only.
-      /// The reduced version of beta is stored at add(state, state_beta)
-      function derive_beta(gamma_not_reduced)->beta_not_reduced{
-        
-        let state := mload(0x40)
-        let mPtr := add(mload(0x40), STATE_LAST_MEM)
-
-        // beta
-        mstore(mPtr, FS_BETA) // "beta"
-        mstore(add(mPtr, 0x20), gamma_not_reduced)
-        let l_success := staticcall(gas(), 0x2, add(mPtr, 0x1c), 0x24, mPtr, 0x20) //0x1b -> 000.."gamma"
-        if iszero(l_success) {
-          error_verify()
-        }
-        beta_not_reduced := mload(mPtr)
-        mstore(add(state, STATE_BETA), mod(beta_not_reduced, R_MOD))
-      }
-
-      /// derive alpha as sha256<transcript>
-      /// @param aproof pointer to the proof object
-      /// @param beta_not_reduced the previous challenge (beta) not reduced
-      /// @return alpha_not_reduced the next challenge, alpha, not reduced
-      /// @notice the transcript consists of the previous challenge (beta)
-      /// not reduced, the commitments to the wires associated to the QCP_i,
-      /// and the commitment to the grand product polynomial 
-      function derive_alpha(aproof, beta_not_reduced)->alpha_not_reduced {
-        
-        let state := mload(0x40)
-        let mPtr := add(mload(0x40), STATE_LAST_MEM)
-        let full_size := 0x65 // size("alpha") + 0x20 (previous challenge)
-
-        // alpha
-        mstore(mPtr, FS_ALPHA) // "alpha"
-        let _mPtr := add(mPtr, 0x20)
-        mstore(_mPtr, beta_not_reduced)
-        _mPtr := add(_mPtr, 0x20)
-        
-        // Bsb22Commitments
-        let proof_bsb_commitments := add(aproof, PROOF_BSB_COMMITMENTS)
-        let size_bsb_commitments := mul(0x40, VK_NB_CUSTOM_GATES)
-        calldatacopy(_mPtr, proof_bsb_commitments, size_bsb_commitments)
-        _mPtr := add(_mPtr, size_bsb_commitments)
-        full_size := add(full_size, size_bsb_commitments)
-        
-        // [Z], the commitment to the grand product polynomial
-        calldatacopy(_mPtr, add(aproof, PROOF_GRAND_PRODUCT_COMMITMENT_X), 0x40)
-        let l_success := staticcall(gas(), 0x2, add(mPtr, 0x1b), full_size, mPtr, 0x20)
-        if iszero(l_success) {
-          error_verify()
-        }
-
-        alpha_not_reduced := mload(mPtr)
-        mstore(add(state, STATE_ALPHA), mod(alpha_not_reduced, R_MOD))
-      }
-
-      /// derive zeta as sha256<transcript>
-      /// @param aproof pointer to the proof object
-      /// @param alpha_not_reduced the previous challenge (alpha) not reduced
-      /// The transcript consists of the previous challenge and the commitment to
-      /// the quotient polynomial h.
-      function derive_zeta(aproof, alpha_not_reduced) {
-        
-        let state := mload(0x40)
-        let mPtr := add(mload(0x40), STATE_LAST_MEM)
-
-        // zeta
-        mstore(mPtr, FS_ZETA) // "zeta"
-        mstore(add(mPtr, 0x20), alpha_not_reduced)
-        calldatacopy(add(mPtr, 0x40), add(aproof, PROOF_H_0_X), 0xc0)
-        let l_success := staticcall(gas(), 0x2, add(mPtr, 0x1c), 0xe4, mPtr, 0x20)
-        if iszero(l_success) {
-          error_verify()
-        }
-        let zeta_not_reduced := mload(mPtr)
-        mstore(add(state, STATE_ZETA), mod(zeta_not_reduced, R_MOD))
-      }
-      // END challenges -------------------------------------------------
-
-      // BEGINNING compute_pi -------------------------------------------------
-
-      /// sum_pi_wo_api_commit computes the public inputs contributions,
-      /// except for the public inputs coming from the custom gate
-      /// @param ins pointer to the public inputs
-      /// @param n number of public inputs
-      /// @param mPtr free memory
-      /// @return pi_wo_commit public inputs contribution (except the public inputs coming from the custom gate)
-      function sum_pi_wo_api_commit(ins, n, mPtr)->pi_wo_commit {
-        
-        let state := mload(0x40)
-        let z := mload(add(state, STATE_ZETA))
-        let zpnmo := mload(add(state, STATE_ZETA_POWER_N_MINUS_ONE))
-
-        let li := mPtr
-        batch_compute_lagranges_at_z(z, zpnmo, n, li)
-
-        let tmp := 0
-        for {let i:=0} lt(i,n) {i:=add(i,1)}
-        {
-          tmp := mulmod(mload(li), calldataload(ins), R_MOD)
-          pi_wo_commit := addmod(pi_wo_commit, tmp, R_MOD)
-          li := add(li, 0x20)
-          ins := add(ins, 0x20)
-        }
-        
-      }
-
-      /// batch_compute_lagranges_at_z computes [L_0(z), .., L_{n-1}(z)]
-      /// @param z point at which the Lagranges are evaluated
-      /// @param zpnmo ζⁿ-1
-      /// @param n number of public inputs (number of Lagranges to compute)
-      /// @param mPtr pointer to which the results are stored
-      function batch_compute_lagranges_at_z(z, zpnmo, n, mPtr) {
-
-        let zn := mulmod(zpnmo, VK_INV_DOMAIN_SIZE, R_MOD) // 1/n * (ζⁿ - 1)
-        
-        let _w := 1
-        let _mPtr := mPtr
-        for {let i:=0} lt(i,n) {i:=add(i,1)}
-        {
-          mstore(_mPtr, addmod(z,sub(R_MOD, _w), R_MOD))
-          _w := mulmod(_w, VK_OMEGA, R_MOD)
-          _mPtr := add(_mPtr, 0x20)
-        }
-        batch_invert(mPtr, n, _mPtr)
-        _mPtr := mPtr
-        _w := 1
-        for {let i:=0} lt(i,n) {i:=add(i,1)}
-        {
-          mstore(_mPtr, mulmod(mulmod(mload(_mPtr), zn , R_MOD), _w, R_MOD))
-          _mPtr := add(_mPtr, 0x20)
-          _w := mulmod(_w, VK_OMEGA, R_MOD)
-        }
-      } 
-
-      /// @notice Montgomery trick for batch inversion mod R_MOD
-      /// @param ins pointer to the data to batch invert
-      /// @param number of elements to batch invert
-      /// @param mPtr free memory
-      function batch_invert(ins, nb_ins, mPtr) {
-        mstore(mPtr, 1)
-        let offset := 0
-        for {let i:=0} lt(i, nb_ins) {i:=add(i,1)}
-        {
-          let prev := mload(add(mPtr, offset))
-          let cur := mload(add(ins, offset))
-          cur := mulmod(prev, cur, R_MOD)
-          offset := add(offset, 0x20)
-          mstore(add(mPtr, offset), cur)
-        }
-        ins := add(ins, sub(offset, 0x20))
-        mPtr := add(mPtr, offset)
-        let inv := pow(mload(mPtr), sub(R_MOD,2), add(mPtr, 0x20))
-        for {let i:=0} lt(i, nb_ins) {i:=add(i,1)}
-        {
-          mPtr := sub(mPtr, 0x20)
-          let tmp := mload(ins)
-          let cur := mulmod(inv, mload(mPtr), R_MOD)
-          mstore(ins, cur)
-          inv := mulmod(inv, tmp, R_MOD)
-          ins := sub(ins, 0x20)
-        }
-      }
-
-      
-      /// Public inputs (the ones coming from the custom gate) contribution
-      /// @param aproof pointer to the proof
-      /// @param nb_public_inputs number of public inputs
-      /// @param mPtr pointer to free memory
-      /// @return pi_commit custom gate public inputs contribution
-      function sum_pi_commit(aproof, nb_public_inputs, mPtr)->pi_commit {
-
-        let state := mload(0x40)
-        let z := mload(add(state, STATE_ZETA))
-        let zpnmo := mload(add(state, STATE_ZETA_POWER_N_MINUS_ONE))
-
-        let p := add(aproof, PROOF_BSB_COMMITMENTS)
-
-        let h_fr, ith_lagrange
-       
-        
-        h_fr := hash_fr(calldataload(p), calldataload(add(p, 0x20)), mPtr)
-        ith_lagrange := compute_ith_lagrange_at_z(z, zpnmo, add(nb_public_inputs, VK_INDEX_COMMIT_API_0), mPtr)
-        pi_commit := addmod(pi_commit, mulmod(h_fr, ith_lagrange, R_MOD), R_MOD)
-        p := add(p, 0x40)
-        
-
-      }
-
-      /// Computes L_i(zeta) =  ωⁱ/n * (ζⁿ-1)/(ζ-ωⁱ) where:
-      /// @param z zeta
-      /// @param zpmno ζⁿ-1
-      /// @param i i-th lagrange
-      /// @param mPtr free memory
-      /// @return res = ωⁱ/n * (ζⁿ-1)/(ζ-ωⁱ) 
-      function compute_ith_lagrange_at_z(z, zpnmo, i, mPtr)->res {
-
-        let w := pow(VK_OMEGA, i, mPtr) // w**i
-        i := addmod(z, sub(R_MOD, w), R_MOD) // z-w**i
-        w := mulmod(w, VK_INV_DOMAIN_SIZE, R_MOD) // w**i/n
-        i := pow(i, sub(R_MOD,2), mPtr) // (z-w**i)**-1
-        w := mulmod(w, i, R_MOD) // w**i/n*(z-w)**-1
-        res := mulmod(w, zpnmo, R_MOD)
-      
-      }
-
-      /// @dev https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-06#section-5.2
-      /// @param x x coordinate of a point on Bn254(𝔽_p)
-      /// @param y y coordinate of a point on Bn254(𝔽_p)
-      /// @param mPtr free memory
-      /// @return res an element mod R_MOD
-      function hash_fr(x, y, mPtr)->res {
-
-        // [0x00, .. , 0x00 || x, y, || 0, 48, 0, dst, HASH_FR_SIZE_DOMAIN]
-        // <-  64 bytes  ->  <-64b -> <-       1 bytes each     ->
-
-        // [0x00, .., 0x00] 64 bytes of zero
-        mstore(mPtr, HASH_FR_ZERO_UINT256)
-        mstore(add(mPtr, 0x20), HASH_FR_ZERO_UINT256)
-    
-        // msg =  x || y , both on 32 bytes
-        mstore(add(mPtr, 0x40), x)
-        mstore(add(mPtr, 0x60), y)
-
-        // 0 || 48 || 0 all on 1 byte
-        mstore8(add(mPtr, 0x80), 0)
-        mstore8(add(mPtr, 0x81), HASH_FR_LEN_IN_BYTES)
-        mstore8(add(mPtr, 0x82), 0)
-
-        // "BSB22-Plonk" = [42, 53, 42, 32, 32, 2d, 50, 6c, 6f, 6e, 6b,]
-        mstore8(add(mPtr, 0x83), 0x42)
-        mstore8(add(mPtr, 0x84), 0x53)
-        mstore8(add(mPtr, 0x85), 0x42)
-        mstore8(add(mPtr, 0x86), 0x32)
-        mstore8(add(mPtr, 0x87), 0x32)
-        mstore8(add(mPtr, 0x88), 0x2d)
-        mstore8(add(mPtr, 0x89), 0x50)
-        mstore8(add(mPtr, 0x8a), 0x6c)
-        mstore8(add(mPtr, 0x8b), 0x6f)
-        mstore8(add(mPtr, 0x8c), 0x6e)
-        mstore8(add(mPtr, 0x8d), 0x6b)
-
-        // size domain
-        mstore8(add(mPtr, 0x8e), HASH_FR_SIZE_DOMAIN)
-
-        let l_success := staticcall(gas(), 0x2, mPtr, 0x8f, mPtr, 0x20)
-        if iszero(l_success) {
-          error_verify()
-        }
-
-        let b0 := mload(mPtr)
-
-        // [b0         || one || dst || HASH_FR_SIZE_DOMAIN]
-        // <-64bytes ->  <-    1 byte each      ->
-        mstore8(add(mPtr, 0x20), HASH_FR_ONE) // 1
-        
-        mstore8(add(mPtr, 0x21), 0x42) // dst
-        mstore8(add(mPtr, 0x22), 0x53)
-        mstore8(add(mPtr, 0x23), 0x42)
-        mstore8(add(mPtr, 0x24), 0x32)
-        mstore8(add(mPtr, 0x25), 0x32)
-        mstore8(add(mPtr, 0x26), 0x2d)
-        mstore8(add(mPtr, 0x27), 0x50)
-        mstore8(add(mPtr, 0x28), 0x6c)
-        mstore8(add(mPtr, 0x29), 0x6f)
-        mstore8(add(mPtr, 0x2a), 0x6e)
-        mstore8(add(mPtr, 0x2b), 0x6b)
-
-        mstore8(add(mPtr, 0x2c), HASH_FR_SIZE_DOMAIN) // size domain
-        l_success := staticcall(gas(), 0x2, mPtr, 0x2d, mPtr, 0x20)
-        if iszero(l_success) {
-          error_verify()
-        }
-
-        // b1 is located at mPtr. We store b2 at add(mPtr, 0x20)
-
-        // [b0^b1      || two || dst || HASH_FR_SIZE_DOMAIN]
-        // <-64bytes ->  <-    1 byte each      ->
-        mstore(add(mPtr, 0x20), xor(mload(mPtr), b0))
-        mstore8(add(mPtr, 0x40), HASH_FR_TWO)
-
-        mstore8(add(mPtr, 0x41), 0x42) // dst
-        mstore8(add(mPtr, 0x42), 0x53)
-        mstore8(add(mPtr, 0x43), 0x42)
-        mstore8(add(mPtr, 0x44), 0x32)
-        mstore8(add(mPtr, 0x45), 0x32)
-        mstore8(add(mPtr, 0x46), 0x2d)
-        mstore8(add(mPtr, 0x47), 0x50)
-        mstore8(add(mPtr, 0x48), 0x6c)
-        mstore8(add(mPtr, 0x49), 0x6f)
-        mstore8(add(mPtr, 0x4a), 0x6e)
-        mstore8(add(mPtr, 0x4b), 0x6b)
-
-        mstore8(add(mPtr, 0x4c), HASH_FR_SIZE_DOMAIN) // size domain
-
-        let offset := add(mPtr, 0x20)
-        l_success := staticcall(gas(), 0x2, offset, 0x2d, offset, 0x20)
-        if iszero(l_success) {
-          error_verify()
-        }
-
-        // at this point we have mPtr = [ b1 || b2] where b1 is on 32byes and b2 in 16bytes.
-        // we interpret it as a big integer mod r in big endian (similar to regular decimal notation)
-        // the result is then 2**(8*16)*mPtr[32:] + mPtr[32:48]
-        res := mulmod(mload(mPtr), HASH_FR_BB, R_MOD) // <- res = 2**128 * mPtr[:32]
-        let b1 := shr(128, mload(add(mPtr, 0x20))) // b1 <- [0, 0, .., 0 ||  b2[:16] ]
-        res := addmod(res, b1, R_MOD)
-
-      }
-      
-      // END compute_pi -------------------------------------------------
-
-      /// @notice compute α² * 1/n * (ζ{n}-1)/(ζ - 1) where
-      /// *  α = challenge derived in derive_gamma_beta_alpha_zeta
-      /// * n = vk_domain_size
-      /// * ω = vk_omega (generator of the multiplicative cyclic group of order n in (ℤ/rℤ)*)
-      /// * ζ = zeta (challenge derived with Fiat Shamir)
-      function compute_alpha_square_lagrange_0() {   
-        let state := mload(0x40)
-        let mPtr := add(mload(0x40), STATE_LAST_MEM)
-
-        let res := mload(add(state, STATE_ZETA_POWER_N_MINUS_ONE))
-        let den := addmod(mload(add(state, STATE_ZETA)), sub(R_MOD, 1), R_MOD)
-        den := pow(den, sub(R_MOD, 2), mPtr)
-        den := mulmod(den, VK_INV_DOMAIN_SIZE, R_MOD)
-        res := mulmod(den, res, R_MOD)
-
-        let l_alpha := mload(add(state, STATE_ALPHA))
-        res := mulmod(res, l_alpha, R_MOD)
-        res := mulmod(res, l_alpha, R_MOD)
-        mstore(add(state, STATE_ALPHA_SQUARE_LAGRANGE_0), res)
-      }
-
-      /// @notice follows alg. p.13 of https://eprint.iacr.org/2019/953.pdf
-      /// with t₁ = t₂ = 1, and the proofs are ([digest] + [quotient] +purported evaluation):
-      /// * [state_folded_state_digests], [proof_batch_opening_at_zeta_x], state_folded_evals
-      /// * [proof_grand_product_commitment], [proof_opening_at_zeta_omega_x], [proof_grand_product_at_zeta_omega]
-      /// @param aproof pointer to the proof
-      function batch_verify_multi_points(aproof) {
-        let state := mload(0x40)
-        let mPtr := add(state, STATE_LAST_MEM)
-
-        // derive a random number. As there is no random generator, we
-        // do an FS like challenge derivation, depending on both digests and
-        // ζ to ensure that the prover cannot control the random numger.
-        // Note: adding the other point ζω is not needed, as ω is known beforehand.
-        mstore(mPtr, mload(add(state, STATE_FOLDED_DIGESTS_X)))
-        mstore(add(mPtr, 0x20), mload(add(state, STATE_FOLDED_DIGESTS_Y)))
-        mstore(add(mPtr, 0x40), calldataload(add(aproof, PROOF_BATCH_OPENING_AT_ZETA_X)))
-        mstore(add(mPtr, 0x60), calldataload(add(aproof, PROOF_BATCH_OPENING_AT_ZETA_Y)))
-        mstore(add(mPtr, 0x80), calldataload(add(aproof, PROOF_GRAND_PRODUCT_COMMITMENT_X)))
-        mstore(add(mPtr, 0xa0), calldataload(add(aproof, PROOF_GRAND_PRODUCT_COMMITMENT_Y)))
-        mstore(add(mPtr, 0xc0), calldataload(add(aproof, PROOF_OPENING_AT_ZETA_OMEGA_X)))
-        mstore(add(mPtr, 0xe0), calldataload(add(aproof, PROOF_OPENING_AT_ZETA_OMEGA_Y)))
-        mstore(add(mPtr, 0x100), mload(add(state, STATE_ZETA)))
-        mstore(add(mPtr, 0x120), mload(add(state, STATE_GAMMA_KZG)))
-        let random := staticcall(gas(), 0x2, mPtr, 0x140, mPtr, 0x20)
-        if iszero(random){
-          error_random_generation()
-        }
-        random := mod(mload(mPtr), R_MOD) // use the same variable as we are one variable away from getting stack-too-deep error...
-
-        let folded_quotients := mPtr
-        mPtr := add(folded_quotients, 0x40)
-        mstore(folded_quotients, calldataload(add(aproof, PROOF_BATCH_OPENING_AT_ZETA_X)))
-        mstore(add(folded_quotients, 0x20), calldataload(add(aproof, PROOF_BATCH_OPENING_AT_ZETA_Y)))
-        point_acc_mul_calldata(folded_quotients, add(aproof, PROOF_OPENING_AT_ZETA_OMEGA_X), random, mPtr)
-
-        let folded_digests := add(state, STATE_FOLDED_DIGESTS_X)
-        point_acc_mul_calldata(folded_digests, add(aproof, PROOF_GRAND_PRODUCT_COMMITMENT_X), random, mPtr)
-
-        let folded_evals := add(state, STATE_FOLDED_CLAIMED_VALUES)
-        fr_acc_mul_calldata(folded_evals, add(aproof, PROOF_GRAND_PRODUCT_AT_ZETA_OMEGA), random)
-
-        let folded_evals_commit := mPtr
-        mPtr := add(folded_evals_commit, 0x40)
-        mstore(folded_evals_commit, G1_SRS_X)
-        mstore(add(folded_evals_commit, 0x20), G1_SRS_Y)
-        mstore(add(folded_evals_commit, 0x40), mload(folded_evals))
-        let check_staticcall := staticcall(gas(), 7, folded_evals_commit, 0x60, folded_evals_commit, 0x40)
-        if iszero(check_staticcall) {
-          error_verify()
-        }
-
-        let folded_evals_commit_y := add(folded_evals_commit, 0x20)
-        mstore(folded_evals_commit_y, sub(P_MOD, mload(folded_evals_commit_y)))
-        point_add(folded_digests, folded_digests, folded_evals_commit, mPtr)
-
-        let folded_points_quotients := mPtr
-        mPtr := add(mPtr, 0x40)
-        point_mul_calldata(
-          folded_points_quotients,
-          add(aproof, PROOF_BATCH_OPENING_AT_ZETA_X),
-          mload(add(state, STATE_ZETA)),
-          mPtr
-        )
-        let zeta_omega := mulmod(mload(add(state, STATE_ZETA)), VK_OMEGA, R_MOD)
-        random := mulmod(random, zeta_omega, R_MOD)
-        point_acc_mul_calldata(folded_points_quotients, add(aproof, PROOF_OPENING_AT_ZETA_OMEGA_X), random, mPtr)
-
-        point_add(folded_digests, folded_digests, folded_points_quotients, mPtr)
-
-        let folded_quotients_y := add(folded_quotients, 0x20)
-        mstore(folded_quotients_y, sub(P_MOD, mload(folded_quotients_y)))
-
-        mstore(mPtr, mload(folded_digests))
-        mstore(add(mPtr, 0x20), mload(add(folded_digests, 0x20)))
-        mstore(add(mPtr, 0x40), G2_SRS_0_X_0) // the 4 lines are the canonical G2 point on BN254
-        mstore(add(mPtr, 0x60), G2_SRS_0_X_1)
-        mstore(add(mPtr, 0x80), G2_SRS_0_Y_0)
-        mstore(add(mPtr, 0xa0), G2_SRS_0_Y_1)
-        mstore(add(mPtr, 0xc0), mload(folded_quotients))
-        mstore(add(mPtr, 0xe0), mload(add(folded_quotients, 0x20)))
-        mstore(add(mPtr, 0x100), G2_SRS_1_X_0)
-        mstore(add(mPtr, 0x120), G2_SRS_1_X_1)
-        mstore(add(mPtr, 0x140), G2_SRS_1_Y_0)
-        mstore(add(mPtr, 0x160), G2_SRS_1_Y_1)
-        check_pairing_kzg(mPtr)
-      }
-
-      /// @notice check_pairing_kzg checks the result of the final pairing product of the batched
-      /// kzg verification. The purpose of this function is to avoid exhausting the stack
-      /// in the function batch_verify_multi_points.
-      /// @param mPtr pointer storing the tuple of pairs
-      function check_pairing_kzg(mPtr) {
-        let state := mload(0x40)
-
-        let l_success := staticcall(gas(), 8, mPtr, 0x180, 0x00, 0x20)
-        if iszero(l_success) {
-          error_pairing()
-        }
-        let res_pairing := mload(0x00)
-        mstore(add(state, STATE_SUCCESS), res_pairing)
-      }
-
-      /// @notice Fold the opening proofs at ζ:
-      /// * at state+state_folded_digest we store: [Linearised_polynomial]+γ[L] + γ²[R] + γ³[O] + γ⁴[S₁] +γ⁵[S₂] + ∑ᵢγ⁵⁺ⁱ[Pi_{i}]
-      /// * at state+state_folded_claimed_values we store: H(ζ) + γLinearised_polynomial(ζ)+γ²L(ζ) + γ³R(ζ)+ γ⁴O(ζ) + γ⁵S₁(ζ) +γ⁶S₂(ζ) + ∑ᵢγ⁶⁺ⁱPi_{i}(ζ)
-      /// @param aproof pointer to the proof
-      /// acc_gamma stores the γⁱ
-      function fold_state(aproof) {
-
-        let state := mload(0x40)
-        let mPtr := add(mload(0x40), STATE_LAST_MEM)
-        let mPtr20 := add(mPtr, 0x20)
-        let mPtr40 := add(mPtr, 0x40)
-
-        let l_gamma_kzg := mload(add(state, STATE_GAMMA_KZG))
-        let acc_gamma := l_gamma_kzg
-        let state_folded_digests := add(state, STATE_FOLDED_DIGESTS_X)
-
-        mstore(add(state, STATE_FOLDED_DIGESTS_X), mload(add(state, STATE_LINEARISED_POLYNOMIAL_X)))
-        mstore(add(state, STATE_FOLDED_DIGESTS_Y), mload(add(state, STATE_LINEARISED_POLYNOMIAL_Y)))
-        mstore(add(state, STATE_FOLDED_CLAIMED_VALUES), mload(add(state, STATE_OPENING_LINEARISED_POLYNOMIAL_ZETA)))
-
-        point_acc_mul_calldata(add(state, STATE_FOLDED_DIGESTS_X), add(aproof, PROOF_L_COM_X), acc_gamma, mPtr)
-        fr_acc_mul_calldata(add(state, STATE_FOLDED_CLAIMED_VALUES), add(aproof, PROOF_L_AT_ZETA), acc_gamma)
-
-        acc_gamma := mulmod(acc_gamma, l_gamma_kzg, R_MOD)
-        point_acc_mul_calldata(state_folded_digests, add(aproof, PROOF_R_COM_X), acc_gamma, mPtr)
-        fr_acc_mul_calldata(add(state, STATE_FOLDED_CLAIMED_VALUES), add(aproof, PROOF_R_AT_ZETA), acc_gamma)
-
-        acc_gamma := mulmod(acc_gamma, l_gamma_kzg, R_MOD)
-        point_acc_mul_calldata(state_folded_digests, add(aproof, PROOF_O_COM_X), acc_gamma, mPtr)
-        fr_acc_mul_calldata(add(state, STATE_FOLDED_CLAIMED_VALUES), add(aproof, PROOF_O_AT_ZETA), acc_gamma)
-
-        acc_gamma := mulmod(acc_gamma, l_gamma_kzg, R_MOD)
-        mstore(mPtr, VK_S1_COM_X)
-        mstore(mPtr20, VK_S1_COM_Y)
-        point_acc_mul(state_folded_digests, mPtr, acc_gamma, mPtr40)
-        fr_acc_mul_calldata(add(state, STATE_FOLDED_CLAIMED_VALUES), add(aproof, PROOF_S1_AT_ZETA), acc_gamma)
-
-        acc_gamma := mulmod(acc_gamma, l_gamma_kzg, R_MOD)
-        mstore(mPtr, VK_S2_COM_X)
-        mstore(mPtr20, VK_S2_COM_Y)
-        point_acc_mul(state_folded_digests, mPtr, acc_gamma, mPtr40)
-        fr_acc_mul_calldata(add(state, STATE_FOLDED_CLAIMED_VALUES), add(aproof, PROOF_S2_AT_ZETA), acc_gamma)
-        let poqaz := add(aproof, PROOF_OPENING_QCP_AT_ZETA)
-        
-        acc_gamma := mulmod(acc_gamma, l_gamma_kzg, R_MOD)
-        mstore(mPtr, VK_QCP_0_X)
-        mstore(mPtr20, VK_QCP_0_Y)
-        point_acc_mul(state_folded_digests, mPtr, acc_gamma, mPtr40)
-        fr_acc_mul_calldata(add(state, STATE_FOLDED_CLAIMED_VALUES), poqaz, acc_gamma)
-        poqaz := add(poqaz, 0x20)
-        
-        }
-
-      /// @notice generate the challenge (using Fiat Shamir) to fold the opening proofs
-      /// at ζ.
-      /// The process for deriving γ is the same as in derive_gamma but this time the inputs are
-      /// in this order (the [] means it's a commitment):
-      /// * ζ
-      /// * [Linearised polynomial]
-      /// * [L], [R], [O]
-      /// * [S₁] [S₂]
-      /// * [Pi_{i}] (wires associated to custom gates)
-      /// Then there are the purported evaluations of the previous committed polynomials:
-      /// * Linearised_polynomial(ζ)
-      /// * L(ζ), R(ζ), O(ζ), S₁(ζ), S₂(ζ)
-      /// * Pi_{i}(ζ)
-      /// * Z(ζω)
-      /// @param aproof pointer to the proof
-      function compute_gamma_kzg(aproof) {
-
-        let state := mload(0x40)
-        let mPtr := add(mload(0x40), STATE_LAST_MEM)
-        mstore(mPtr, FS_GAMMA_KZG) // "gamma"
-        mstore(add(mPtr, 0x20), mload(add(state, STATE_ZETA)))
-        mstore(add(mPtr,0x40), mload(add(state, STATE_LINEARISED_POLYNOMIAL_X)))
-        mstore(add(mPtr,0x60), mload(add(state, STATE_LINEARISED_POLYNOMIAL_Y)))
-        calldatacopy(add(mPtr, 0x80), add(aproof, PROOF_L_COM_X), 0xc0)
-        mstore(add(mPtr,0x140), VK_S1_COM_X)
-        mstore(add(mPtr,0x160), VK_S1_COM_Y)
-        mstore(add(mPtr,0x180), VK_S2_COM_X)
-        mstore(add(mPtr,0x1a0), VK_S2_COM_Y)
-        
-        let offset := 0x1c0
-        
-        mstore(add(mPtr,offset), VK_QCP_0_X)
-        mstore(add(mPtr,add(offset, 0x20)), VK_QCP_0_Y)
-        offset := add(offset, 0x40)
-        mstore(add(mPtr, offset), mload(add(state, STATE_OPENING_LINEARISED_POLYNOMIAL_ZETA)))
-        mstore(add(mPtr, add(offset, 0x20)), calldataload(add(aproof, PROOF_L_AT_ZETA)))
-        mstore(add(mPtr, add(offset, 0x40)), calldataload(add(aproof, PROOF_R_AT_ZETA)))
-        mstore(add(mPtr, add(offset, 0x60)), calldataload(add(aproof, PROOF_O_AT_ZETA)))
-        mstore(add(mPtr, add(offset, 0x80)), calldataload(add(aproof, PROOF_S1_AT_ZETA)))
-        mstore(add(mPtr, add(offset, 0xa0)), calldataload(add(aproof, PROOF_S2_AT_ZETA)))
-
-        let _mPtr := add(mPtr, add(offset, 0xc0))
-
-        
-        let _poqaz := add(aproof, PROOF_OPENING_QCP_AT_ZETA)
-        calldatacopy(_mPtr, _poqaz, mul(VK_NB_CUSTOM_GATES, 0x20))
-        _mPtr := add(_mPtr, mul(VK_NB_CUSTOM_GATES, 0x20))
-        
-
-        mstore(_mPtr, calldataload(add(aproof, PROOF_GRAND_PRODUCT_AT_ZETA_OMEGA)))
-
-        let start_input := 0x1b // 00.."gamma"
-        let size_input := add(0x14, mul(VK_NB_CUSTOM_GATES,3)) // number of 32bytes elmts = 0x17 (zeta+3*6 for the digests+openings) + 3*VK_NB_CUSTOM_GATES (for the commitments of the selectors) + 1 (opening of Z at ζω)
-        size_input := add(0x5, mul(size_input, 0x20)) // size in bytes: 15*32 bytes + 5 bytes for gamma
-        let check_staticcall := staticcall(gas(), 0x2, add(mPtr,start_input), size_input, add(state, STATE_GAMMA_KZG), 0x20)
-        if iszero(check_staticcall) {
-          error_verify()
-        }
-        mstore(add(state, STATE_GAMMA_KZG), mod(mload(add(state, STATE_GAMMA_KZG)), R_MOD))
-      }
-
-      function compute_commitment_linearised_polynomial_ec(aproof, s1, s2) {
-        
-        let state := mload(0x40)
-        let mPtr := add(mload(0x40), STATE_LAST_MEM)
-
-        mstore(mPtr, VK_QL_COM_X)
-        mstore(add(mPtr, 0x20), VK_QL_COM_Y)
-        point_mul(
-          add(state, STATE_LINEARISED_POLYNOMIAL_X),
-          mPtr,
-          calldataload(add(aproof, PROOF_L_AT_ZETA)),
-          add(mPtr, 0x40)
-        )
-
-        mstore(mPtr, VK_QR_COM_X)
-        mstore(add(mPtr, 0x20), VK_QR_COM_Y)
-        point_acc_mul(
-          add(state, STATE_LINEARISED_POLYNOMIAL_X),
-          mPtr,
-          calldataload(add(aproof, PROOF_R_AT_ZETA)),
-          add(mPtr, 0x40)
-        )
-
-        let rl := mulmod(calldataload(add(aproof, PROOF_L_AT_ZETA)), calldataload(add(aproof, PROOF_R_AT_ZETA)), R_MOD)
-        mstore(mPtr, VK_QM_COM_X)
-        mstore(add(mPtr, 0x20), VK_QM_COM_Y)
-        point_acc_mul(add(state, STATE_LINEARISED_POLYNOMIAL_X), mPtr, rl, add(mPtr, 0x40))
-
-        mstore(mPtr, VK_QO_COM_X)
-        mstore(add(mPtr, 0x20), VK_QO_COM_Y)
-        point_acc_mul(
-          add(state, STATE_LINEARISED_POLYNOMIAL_X),
-          mPtr,
-          calldataload(add(aproof, PROOF_O_AT_ZETA)),
-          add(mPtr, 0x40)
-        )
-
-        mstore(mPtr, VK_QK_COM_X)
-        mstore(add(mPtr, 0x20), VK_QK_COM_Y)
-        point_add(
-          add(state, STATE_LINEARISED_POLYNOMIAL_X),
-          add(state, STATE_LINEARISED_POLYNOMIAL_X),
-          mPtr,
-          add(mPtr, 0x40)
-        )
-
-        
-        let qcp_opening_at_zeta := add(aproof, PROOF_OPENING_QCP_AT_ZETA)
-        let bsb_commitments := add(aproof, PROOF_BSB_COMMITMENTS)
-        for {
-          let i := 0
-        } lt(i, VK_NB_CUSTOM_GATES) {
-          i := add(i, 1)
-        } {
-          mstore(mPtr, calldataload(bsb_commitments))
-          mstore(add(mPtr, 0x20), calldataload(add(bsb_commitments, 0x20)))
-          point_acc_mul(
-            add(state, STATE_LINEARISED_POLYNOMIAL_X),
-            mPtr,
-            calldataload(qcp_opening_at_zeta),
-            add(mPtr, 0x40)
-          )
-          qcp_opening_at_zeta := add(qcp_opening_at_zeta, 0x20)
-          bsb_commitments := add(bsb_commitments, 0x40)
-        }
-        
-
-        mstore(mPtr, VK_S3_COM_X)
-        mstore(add(mPtr, 0x20), VK_S3_COM_Y)
-        point_acc_mul(add(state, STATE_LINEARISED_POLYNOMIAL_X), mPtr, s1, add(mPtr, 0x40))
-
-        mstore(mPtr, calldataload(add(aproof, PROOF_GRAND_PRODUCT_COMMITMENT_X)))
-        mstore(add(mPtr, 0x20), calldataload(add(aproof, PROOF_GRAND_PRODUCT_COMMITMENT_Y)))
-        point_acc_mul(add(state, STATE_LINEARISED_POLYNOMIAL_X), mPtr, s2, add(mPtr, 0x40))
-
-        point_add(
-          add(state, STATE_LINEARISED_POLYNOMIAL_X), 
-          add(state, STATE_LINEARISED_POLYNOMIAL_X), 
-          add(state, STATE_FOLDED_H_X), 
-          mPtr)
-      }
-
-      /// @notice Compute the commitment to the linearized polynomial equal to
-      ///	L(ζ)[Qₗ]+r(ζ)[Qᵣ]+R(ζ)L(ζ)[Qₘ]+O(ζ)[Qₒ]+[Qₖ]+Σᵢqc'ᵢ(ζ)[BsbCommitmentᵢ] +
-      ///	α*( Z(μζ)(L(ζ)+β*S₁(ζ)+γ)*(R(ζ)+β*S₂(ζ)+γ)[S₃]-[Z](L(ζ)+β*id_{1}(ζ)+γ)*(R(ζ)+β*id_{2}(ζ)+γ)*(O(ζ)+β*id_{3}(ζ)+γ) ) +
-      ///	α²*L₁(ζ)[Z] - Z_{H}(ζ)*(([H₀] + ζᵐ⁺²*[H₁] + ζ²⁽ᵐ⁺²⁾*[H₂])
-      /// where
-      /// * id_1 = id, id_2 = vk_coset_shift*id, id_3 = vk_coset_shift^{2}*id
-      /// * the [] means that it's a commitment (i.e. a point on Bn254(F_p))
-      /// * Z_{H}(ζ) = ζ^n-1
-      /// @param aproof pointer to the proof
-      function compute_commitment_linearised_polynomial(aproof) {
-        let state := mload(0x40)
-        let l_beta := mload(add(state, STATE_BETA))
-        let l_gamma := mload(add(state, STATE_GAMMA))
-        let l_zeta := mload(add(state, STATE_ZETA))
-        let l_alpha := mload(add(state, STATE_ALPHA))
-
-        let u := mulmod(calldataload(add(aproof, PROOF_GRAND_PRODUCT_AT_ZETA_OMEGA)), l_beta, R_MOD)
-        let v := mulmod(l_beta, calldataload(add(aproof, PROOF_S1_AT_ZETA)), R_MOD)
-        v := addmod(v, calldataload(add(aproof, PROOF_L_AT_ZETA)), R_MOD)
-        v := addmod(v, l_gamma, R_MOD)
-
-        let w := mulmod(l_beta, calldataload(add(aproof, PROOF_S2_AT_ZETA)), R_MOD)
-        w := addmod(w, calldataload(add(aproof, PROOF_R_AT_ZETA)), R_MOD)
-        w := addmod(w, l_gamma, R_MOD)
-
-        let s1 := mulmod(u, v, R_MOD)
-        s1 := mulmod(s1, w, R_MOD)
-        s1 := mulmod(s1, l_alpha, R_MOD)
-
-        let coset_square := mulmod(VK_COSET_SHIFT, VK_COSET_SHIFT, R_MOD)
-        let betazeta := mulmod(l_beta, l_zeta, R_MOD)
-        u := addmod(betazeta, calldataload(add(aproof, PROOF_L_AT_ZETA)), R_MOD)
-        u := addmod(u, l_gamma, R_MOD)
-
-        v := mulmod(betazeta, VK_COSET_SHIFT, R_MOD)
-        v := addmod(v, calldataload(add(aproof, PROOF_R_AT_ZETA)), R_MOD)
-        v := addmod(v, l_gamma, R_MOD)
-
-        w := mulmod(betazeta, coset_square, R_MOD)
-        w := addmod(w, calldataload(add(aproof, PROOF_O_AT_ZETA)), R_MOD)
-        w := addmod(w, l_gamma, R_MOD)
-
-        let s2 := mulmod(u, v, R_MOD)
-        s2 := mulmod(s2, w, R_MOD)
-        s2 := sub(R_MOD, s2)
-        s2 := mulmod(s2, l_alpha, R_MOD)
-        s2 := addmod(s2, mload(add(state, STATE_ALPHA_SQUARE_LAGRANGE_0)), R_MOD)
-
-        // at this stage:
-        // * s₁ = α*Z(μζ)(l(ζ)+β*s₁(ζ)+γ)*(r(ζ)+β*s₂(ζ)+γ)*β
-        // * s₂ = -α*(l(ζ)+β*ζ+γ)*(r(ζ)+β*u*ζ+γ)*(o(ζ)+β*u²*ζ+γ) + α²*L₁(ζ)
-
-        compute_commitment_linearised_polynomial_ec(aproof, s1, s2)
-      }
-
-      /// @notice compute -z_h(ζ)*([H₁] + ζᵐ⁺²[H₂] + ζ²⁽ᵐ⁺²⁾[H₃]) and store the result at
-      /// state + state_folded_h
-      /// @param aproof pointer to the proof
-      function fold_h(aproof) {
-        let state := mload(0x40)
-        let n_plus_two := add(VK_DOMAIN_SIZE, 2)
-        let mPtr := add(mload(0x40), STATE_LAST_MEM)
-        let zeta_power_n_plus_two := pow(mload(add(state, STATE_ZETA)), n_plus_two, mPtr)
-        point_mul_calldata(add(state, STATE_FOLDED_H_X), add(aproof, PROOF_H_2_X), zeta_power_n_plus_two, mPtr)
-        point_add_calldata(add(state, STATE_FOLDED_H_X), add(state, STATE_FOLDED_H_X), add(aproof, PROOF_H_1_X), mPtr)
-        point_mul(add(state, STATE_FOLDED_H_X), add(state, STATE_FOLDED_H_X), zeta_power_n_plus_two, mPtr)
-        point_add_calldata(add(state, STATE_FOLDED_H_X), add(state, STATE_FOLDED_H_X), add(aproof, PROOF_H_0_X), mPtr)
-          point_mul(add(state, STATE_FOLDED_H_X), add(state, STATE_FOLDED_H_X), mload(add(state, STATE_ZETA_POWER_N_MINUS_ONE)), mPtr)
-        let folded_h_y := mload(add(state, STATE_FOLDED_H_Y))
-        folded_h_y := sub(P_MOD, folded_h_y)
-        mstore(add(state, STATE_FOLDED_H_Y), folded_h_y)
-      }
-
-      /// @notice check that the opening of the linearised polynomial at zeta is equal to
-      /// - [ PI(ζ) - α²*L₁(ζ) + α(l(ζ)+β*s1(ζ)+γ)(r(ζ)+β*s2(ζ)+γ)(o(ζ)+γ)*z(ωζ) ]
-      /// @param aproof pointer to the proof
-      function verify_opening_linearised_polynomial(aproof) {
-        
-        let state := mload(0x40)
-
-        // (l(ζ)+β*s1(ζ)+γ)
-        let s1
-        s1 := mulmod(calldataload(add(aproof, PROOF_S1_AT_ZETA)), mload(add(state, STATE_BETA)), R_MOD)
-        s1 := addmod(s1, mload(add(state, STATE_GAMMA)), R_MOD)
-        s1 := addmod(s1, calldataload(add(aproof, PROOF_L_AT_ZETA)), R_MOD)
-
-        // (r(ζ)+β*s2(ζ)+γ)
-        let s2
-        s2 := mulmod(calldataload(add(aproof, PROOF_S2_AT_ZETA)), mload(add(state, STATE_BETA)), R_MOD)
-        s2 := addmod(s2, mload(add(state, STATE_GAMMA)), R_MOD)
-        s2 := addmod(s2, calldataload(add(aproof, PROOF_R_AT_ZETA)), R_MOD)
-
-        // (o(ζ)+γ)
-        let o
-        o := addmod(calldataload(add(aproof, PROOF_O_AT_ZETA)), mload(add(state, STATE_GAMMA)), R_MOD)
-
-        //  α*Z(μζ)*(l(ζ)+β*s1(ζ)+γ)*(r(ζ)+β*s2(ζ)+γ)*(o(ζ)+γ)
-        s1 := mulmod(s1, s2, R_MOD)
-        s1 := mulmod(s1, o, R_MOD)
-        s1 := mulmod(s1, mload(add(state, STATE_ALPHA)), R_MOD)
-        s1 := mulmod(s1, calldataload(add(aproof, PROOF_GRAND_PRODUCT_AT_ZETA_OMEGA)), R_MOD)
-
-        // PI(ζ) - α²*L₁(ζ) + α(l(ζ)+β*s1(ζ)+γ)(r(ζ)+β*s2(ζ)+γ)(o(ζ)+γ)*z(ωζ)
-        s1 := addmod(s1, mload(add(state, STATE_PI)), R_MOD)
-        s2 := mload(add(state, STATE_ALPHA_SQUARE_LAGRANGE_0))
-        s2 := sub(R_MOD, s2)
-        s1 := addmod(s1, s2, R_MOD)
-        s1 := sub(R_MOD, s1)
-
-        mstore(add(state, STATE_OPENING_LINEARISED_POLYNOMIAL_ZETA), s1)
-      }
-
-      // BEGINNING utils math functions -------------------------------------------------
-      
-      /// @param dst pointer storing the result
-      /// @param p pointer to the first point
-      /// @param q pointer to the second point
-      /// @param mPtr pointer to free memory
-      function point_add(dst, p, q, mPtr) {
-        mstore(mPtr, mload(p))
-        mstore(add(mPtr, 0x20), mload(add(p, 0x20)))
-        mstore(add(mPtr, 0x40), mload(q))
-        mstore(add(mPtr, 0x60), mload(add(q, 0x20)))
-        let l_success := staticcall(gas(),EC_ADD,mPtr,0x80,dst,0x40)
-        if iszero(l_success) {
-          error_ec_op()
-        }
-      }
-
-      /// @param dst pointer storing the result
-      /// @param p pointer to the first point (calldata)
-      /// @param q pointer to the second point (calladata)
-      /// @param mPtr pointer to free memory
-      function point_add_calldata(dst, p, q, mPtr) {
-        mstore(mPtr, mload(p))
-        mstore(add(mPtr, 0x20), mload(add(p, 0x20)))
-        mstore(add(mPtr, 0x40), calldataload(q))
-        mstore(add(mPtr, 0x60), calldataload(add(q, 0x20)))
-        let l_success := staticcall(gas(), EC_ADD, mPtr, 0x80, dst, 0x40)
-        if iszero(l_success) {
-          error_ec_op()
-        }
-      }
-
-      /// @parma dst pointer storing the result
-      /// @param src pointer to a point on Bn254(𝔽_p)
-      /// @param s scalar
-      /// @param mPtr free memory
-      function point_mul(dst,src,s, mPtr) {
-        mstore(mPtr,mload(src))
-        mstore(add(mPtr,0x20),mload(add(src,0x20)))
-        mstore(add(mPtr,0x40),s)
-        let l_success := staticcall(gas(),EC_MUL,mPtr,0x60,dst,0x40)
-        if iszero(l_success) {
-          error_ec_op()
-        }
-      }
-
-      /// @parma dst pointer storing the result
-      /// @param src pointer to a point on Bn254(𝔽_p) on calldata
-      /// @param s scalar
-      /// @param mPtr free memory
-      function point_mul_calldata(dst, src, s, mPtr) {
-        mstore(mPtr, calldataload(src))
-        mstore(add(mPtr, 0x20), calldataload(add(src, 0x20)))
-        mstore(add(mPtr, 0x40), s)
-        let l_success := staticcall(gas(), EC_MUL, mPtr, 0x60, dst, 0x40)
-        if iszero(l_success) {
-          error_ec_op()
-        }
-      }
-
-      /// @notice dst <- dst + [s]src (Elliptic curve)
-      /// @param dst pointer accumulator point storing the result
-      /// @param src pointer to the point to multiply and add
-      /// @param s scalar
-      /// @param mPtr free memory
-      function point_acc_mul(dst,src,s, mPtr) {
-        mstore(mPtr,mload(src))
-        mstore(add(mPtr,0x20),mload(add(src,0x20)))
-        mstore(add(mPtr,0x40),s)
-        let l_success := staticcall(gas(),7,mPtr,0x60,mPtr,0x40)
-        mstore(add(mPtr,0x40),mload(dst))
-        mstore(add(mPtr,0x60),mload(add(dst,0x20)))
-        l_success := and(l_success, staticcall(gas(),EC_ADD,mPtr,0x80,dst, 0x40))
-        if iszero(l_success) {
-          error_ec_op()
-        }
-      }
-
-      /// @notice dst <- dst + [s]src (Elliptic curve)
-      /// @param dst pointer accumulator point storing the result
-      /// @param src pointer to the point to multiply and add (on calldata)
-      /// @param s scalar
-      /// @mPtr free memory
-      function point_acc_mul_calldata(dst, src, s, mPtr) {
-        let state := mload(0x40)
-        mstore(mPtr, calldataload(src))
-        mstore(add(mPtr, 0x20), calldataload(add(src, 0x20)))
-        mstore(add(mPtr, 0x40), s)
-        let l_success := staticcall(gas(), 7, mPtr, 0x60, mPtr, 0x40)
-        mstore(add(mPtr, 0x40), mload(dst))
-        mstore(add(mPtr, 0x60), mload(add(dst, 0x20)))
-        l_success := and(l_success, staticcall(gas(), EC_ADD, mPtr, 0x80, dst, 0x40))
-        if iszero(l_success) {
-          error_ec_op()
-        }
-      }
-
-      /// @notice dst <- dst + src*s (Fr) dst,src are addresses, s is a value
-      /// @param dst pointer storing the result
-      /// @param src pointer to the scalar to multiply and add (on calldata)
-      /// @param s scalar
-      function fr_acc_mul_calldata(dst, src, s) {
-        let tmp :=  mulmod(calldataload(src), s, R_MOD)
-        mstore(dst, addmod(mload(dst), tmp, R_MOD))
-      }
-
-      /// @param x element to exponentiate
-      /// @param e exponent
-      /// @param mPtr free memory
-      /// @return res x ** e mod r
-      function pow(x, e, mPtr)->res {
-        mstore(mPtr, 0x20)
-        mstore(add(mPtr, 0x20), 0x20)
-        mstore(add(mPtr, 0x40), 0x20)
-        mstore(add(mPtr, 0x60), x)
-        mstore(add(mPtr, 0x80), e)
-        mstore(add(mPtr, 0xa0), R_MOD)
-        let check_staticcall := staticcall(gas(),MOD_EXP,mPtr,0xc0,mPtr,0x20)
-        if eq(check_staticcall, 0) {
-            
-        }
-        res := mload(mPtr)
-      }
-    }
-  }
-}
diff --git a/contracts/src/SP1MockVerifier.sol b/contracts/src/SP1MockVerifier.sol
index 5928507..b403d02 100644
--- a/contracts/src/SP1MockVerifier.sol
+++ b/contracts/src/SP1MockVerifier.sol
@@ -7,21 +7,9 @@ import {ISP1Verifier} from "./ISP1Verifier.sol";
 /// @author Succinct Labs
 /// @notice This contracts implements a Mock solidity verifier for SP1.
 contract SP1MockVerifier is ISP1Verifier {
-    function VERSION() external pure returns (string memory) {
-        return "v1.0.7-testnet";
-    }
-
-    function VKEY_HASH() external pure returns (bytes32) {
-        return bytes32(0);
-    }
-
     /// @notice Verifies a mock proof with given public values and vkey.
     /// @param proofBytes The proof of the program execution the SP1 zkVM encoded as bytes.
-    function verifyProof(
-        bytes32,
-        bytes memory,
-        bytes memory proofBytes
-    ) external pure {
+    function verifyProof(bytes32, bytes calldata, bytes calldata proofBytes) external pure {
         assert(proofBytes.length == 0);
     }
 }
diff --git a/contracts/src/SP1Verifier.sol b/contracts/src/SP1Verifier.sol
deleted file mode 100644
index bc727e7..0000000
--- a/contracts/src/SP1Verifier.sol
+++ /dev/null
@@ -1,51 +0,0 @@
-// SPDX-License-Identifier: MIT
-pragma solidity ^0.8.19;
-
-import {ISP1Verifier} from "./ISP1Verifier.sol";
-import {PlonkVerifier} from "./PlonkVerifier.sol";
-
-/// @title SP1 Verifier
-/// @author Succinct Labs
-/// @notice This contracts implements a solidity verifier for SP1.
-contract SP1Verifier is PlonkVerifier {
-    error WrongVersionProof();
-
-    function VERSION() external pure returns (string memory) {
-        return "v1.0.7-testnet";
-    }
-
-    function VKEY_HASH() public pure returns (bytes32) {
-        return 0x8c5bc5e47d8cb77f864aee881f8b66cc2457d46bd0b81b315bf82ccfadf78c50;
-    }
-
-    /// @notice Hashes the public values to a field elements inside Bn254.
-    /// @param publicValues The public values.
-    function hashPublicValues(
-        bytes calldata publicValues
-    ) public pure returns (bytes32) {
-        return sha256(publicValues) & bytes32(uint256((1 << 253) - 1));
-    }
-
-    /// @notice Verifies a proof with given public values and vkey.
-    /// @param vkey The verification key for the RISC-V program.
-    /// @param publicValues The public values encoded as bytes.
-    /// @param proofBytes The proof of the program execution the SP1 zkVM encoded as bytes.
-    function verifyProof(
-        bytes32 vkey,
-        bytes calldata publicValues,
-        bytes calldata proofBytes
-    ) public view {
-        // To ensure the proof corresponds to this verifier, we check that the first 4 bytes of
-        // proofBytes match the first 4 bytes of VKEY_HASH.
-        bytes4 proofBytesPrefix = bytes4(proofBytes[:4]);
-        if (proofBytesPrefix != bytes4(VKEY_HASH())) {
-            revert WrongVersionProof();
-        }
-
-        bytes32 publicValuesDigest = hashPublicValues(publicValues);
-        uint256[] memory inputs = new uint256[](2);
-        inputs[0] = uint256(vkey);
-        inputs[1] = uint256(publicValuesDigest);
-        this.Verify(proofBytes[4:], inputs);
-    }
-}
\ No newline at end of file
diff --git a/contracts/src/SP1VerifierGateway.sol b/contracts/src/SP1VerifierGateway.sol
new file mode 100644
index 0000000..3100180
--- /dev/null
+++ b/contracts/src/SP1VerifierGateway.sol
@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {ISP1Verifier, ISP1VerifierWithHash} from "./ISP1Verifier.sol";
+import {ISP1VerifierGateway, VerifierRoute} from "./ISP1VerifierGateway.sol";
+import {Ownable} from "lib/openzeppelin-contracts/contracts/access/Ownable.sol";
+
+/// @title SP1 Verifier Gateway
+/// @author Succinct Labs
+/// @notice This contract verifies proofs by routing to the correct verifier based on the verifier
+/// selector contained in the first 4 bytes of the proof. It additionally checks that to see that
+/// the verifier route is not frozen.
+contract SP1VerifierGateway is ISP1VerifierGateway, Ownable {
+    /// @inheritdoc ISP1VerifierGateway
+    mapping(bytes4 => VerifierRoute) public routes;
+
+    constructor(address initialOwner) Ownable(initialOwner) {}
+
+    /// @inheritdoc ISP1Verifier
+    function verifyProof(
+        bytes32 programVKey,
+        bytes calldata publicValues,
+        bytes calldata proofBytes
+    ) external view {
+        bytes4 selector = bytes4(proofBytes[:4]);
+        VerifierRoute memory route = routes[selector];
+        if (route.verifier == address(0)) {
+            revert RouteNotFound(selector);
+        } else if (route.frozen) {
+            revert RouteIsFrozen(selector);
+        }
+
+        ISP1Verifier(route.verifier).verifyProof(programVKey, publicValues, proofBytes);
+    }
+
+    /// @inheritdoc ISP1VerifierGateway
+    function addRoute(address verifier) external onlyOwner {
+        bytes4 selector = bytes4(ISP1VerifierWithHash(verifier).VERIFIER_HASH());
+        if (selector == bytes4(0)) {
+            revert SelectorCannotBeZero();
+        }
+
+        VerifierRoute storage route = routes[selector];
+        if (route.verifier != address(0)) {
+            revert RouteAlreadyExists(route.verifier);
+        }
+
+        route.verifier = verifier;
+
+        emit RouteAdded(selector, verifier);
+    }
+
+    /// @inheritdoc ISP1VerifierGateway
+    function freezeRoute(bytes4 selector) external onlyOwner {
+        VerifierRoute storage route = routes[selector];
+        if (route.verifier == address(0)) {
+            revert RouteNotFound(selector);
+        }
+        if (route.frozen) {
+            revert RouteIsFrozen(selector);
+        }
+
+        route.frozen = true;
+
+        emit RouteFrozen(selector, route.verifier);
+    }
+}
diff --git a/contracts/src/v1.0.7-testnet/PlonkVerifier.sol b/contracts/src/v1.0.7-testnet/PlonkVerifier.sol
new file mode 100644
index 0000000..70c03e2
--- /dev/null
+++ b/contracts/src/v1.0.7-testnet/PlonkVerifier.sol
@@ -0,0 +1,1375 @@
+// SPDX-License-Identifier: Apache-2.0
+
+// Copyright 2023 Consensys Software Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by gnark DO NOT EDIT
+
+pragma solidity ^0.8.20;
+
+contract PlonkVerifier {
+    uint256 private constant R_MOD =
+        21888242871839275222246405745257275088548364400416034343698204186575808495617;
+    uint256 private constant R_MOD_MINUS_ONE =
+        21888242871839275222246405745257275088548364400416034343698204186575808495616;
+    uint256 private constant P_MOD =
+        21888242871839275222246405745257275088696311157297823662689037894645226208583;
+
+    uint256 private constant G2_SRS_0_X_0 =
+        11559732032986387107991004021392285783925812861821192530917403151452391805634;
+    uint256 private constant G2_SRS_0_X_1 =
+        10857046999023057135944570762232829481370756359578518086990519993285655852781;
+    uint256 private constant G2_SRS_0_Y_0 =
+        4082367875863433681332203403145435568316851327593401208105741076214120093531;
+    uint256 private constant G2_SRS_0_Y_1 =
+        8495653923123431417604973247489272438418190587263600148770280649306958101930;
+
+    uint256 private constant G2_SRS_1_X_0 =
+        15805639136721018565402881920352193254830339253282065586954346329754995870280;
+    uint256 private constant G2_SRS_1_X_1 =
+        19089565590083334368588890253123139704298730990782503769911324779715431555531;
+    uint256 private constant G2_SRS_1_Y_0 =
+        9779648407879205346559610309258181044130619080926897934572699915909528404984;
+    uint256 private constant G2_SRS_1_Y_1 =
+        6779728121489434657638426458390319301070371227460768374343986326751507916979;
+
+    uint256 private constant G1_SRS_X =
+        14312776538779914388377568895031746459131577658076416373430523308756343304251;
+    uint256 private constant G1_SRS_Y =
+        11763105256161367503191792604679297387056316997144156930871823008787082098465;
+
+    // ----------------------- vk ---------------------
+    uint256 private constant VK_NB_PUBLIC_INPUTS = 2;
+    uint256 private constant VK_DOMAIN_SIZE = 67108864;
+    uint256 private constant VK_INV_DOMAIN_SIZE =
+        21888242545679039938882419398440172875981108180010270949818755658014750055173;
+    uint256 private constant VK_OMEGA =
+        7419588552507395652481651088034484897579724952953562618697845598160172257810;
+    uint256 private constant VK_QL_COM_X =
+        2510865836342267429164163502598759509233852557614588061522341500382391532005;
+    uint256 private constant VK_QL_COM_Y =
+        15126192188192629774065132265780112999140142830433564320449141735872321728630;
+    uint256 private constant VK_QR_COM_X =
+        9333652959929076130675473782051903816259917465603863191457122028934650097457;
+    uint256 private constant VK_QR_COM_Y =
+        2313370322493955964357872255577010408876655837557938852207734814532131060361;
+    uint256 private constant VK_QM_COM_X =
+        9695457198608976564938847790280162275205746283048408216283499672902690859636;
+    uint256 private constant VK_QM_COM_Y =
+        2863222446359988991116462236914508045597262668919200556923697932352945902094;
+    uint256 private constant VK_QO_COM_X =
+        17143802559384719837929824985685699892440981030866765423035114092186969346839;
+    uint256 private constant VK_QO_COM_Y =
+        7035954688092870566772269661940626992719825409924783939927782818192065440004;
+    uint256 private constant VK_QK_COM_X =
+        21445645220242675557007054864075083862767574532736843083792911169558332021092;
+    uint256 private constant VK_QK_COM_Y =
+        15253869392669919290219800592812754879649859828328995608623647268881615845194;
+
+    uint256 private constant VK_S1_COM_X =
+        21060316691690652216900052151773860810138987313309957676007513966927821347831;
+    uint256 private constant VK_S1_COM_Y =
+        19256351951337671769199565809385521104102167502963443186067549090409440417696;
+
+    uint256 private constant VK_S2_COM_X =
+        12407785672743756788481704158638509568132154189030236015878537159964718545787;
+    uint256 private constant VK_S2_COM_Y =
+        11224677738210739259642063251131968487382105453016414942600495075901339030055;
+
+    uint256 private constant VK_S3_COM_X =
+        21872545519839958987912275906732152426354809332288401338845764466421833288920;
+    uint256 private constant VK_S3_COM_Y =
+        12847692498097562704188864683633196071506587648307456692644131497300644533735;
+
+    uint256 private constant VK_COSET_SHIFT = 5;
+
+    uint256 private constant VK_QCP_0_X =
+        3924710379213476882172010215773914137297360196327858615369966568647879502209;
+    uint256 private constant VK_QCP_0_Y =
+        7151069519516975683787976500213788273069269794747379876269151195768245484982;
+
+    uint256 private constant VK_INDEX_COMMIT_API_0 = 32440226;
+    uint256 private constant VK_NB_CUSTOM_GATES = 1;
+
+    // ------------------------------------------------
+
+    // offset proof
+
+    uint256 private constant PROOF_L_COM_X = 0x0;
+    uint256 private constant PROOF_L_COM_Y = 0x20;
+    uint256 private constant PROOF_R_COM_X = 0x40;
+    uint256 private constant PROOF_R_COM_Y = 0x60;
+    uint256 private constant PROOF_O_COM_X = 0x80;
+    uint256 private constant PROOF_O_COM_Y = 0xa0;
+
+    // h = h_0 + x^{n+2}h_1 + x^{2(n+2)}h_2
+    uint256 private constant PROOF_H_0_X = 0xc0;
+    uint256 private constant PROOF_H_0_Y = 0xe0;
+    uint256 private constant PROOF_H_1_X = 0x100;
+    uint256 private constant PROOF_H_1_Y = 0x120;
+    uint256 private constant PROOF_H_2_X = 0x140;
+    uint256 private constant PROOF_H_2_Y = 0x160;
+
+    // wire values at zeta
+    uint256 private constant PROOF_L_AT_ZETA = 0x180;
+    uint256 private constant PROOF_R_AT_ZETA = 0x1a0;
+    uint256 private constant PROOF_O_AT_ZETA = 0x1c0;
+
+    // S1(zeta),S2(zeta)
+    uint256 private constant PROOF_S1_AT_ZETA = 0x1e0; // Sσ1(zeta)
+    uint256 private constant PROOF_S2_AT_ZETA = 0x200; // Sσ2(zeta)
+
+    // [Z]
+    uint256 private constant PROOF_GRAND_PRODUCT_COMMITMENT_X = 0x220;
+    uint256 private constant PROOF_GRAND_PRODUCT_COMMITMENT_Y = 0x240;
+
+    uint256 private constant PROOF_GRAND_PRODUCT_AT_ZETA_OMEGA = 0x260; // z(w*zeta)
+
+    // Folded proof for the opening of linearised poly, l, r, o, s_1, s_2, qcp
+    uint256 private constant PROOF_BATCH_OPENING_AT_ZETA_X = 0x280;
+    uint256 private constant PROOF_BATCH_OPENING_AT_ZETA_Y = 0x2a0;
+
+    uint256 private constant PROOF_OPENING_AT_ZETA_OMEGA_X = 0x2c0;
+    uint256 private constant PROOF_OPENING_AT_ZETA_OMEGA_Y = 0x2e0;
+
+    uint256 private constant PROOF_OPENING_QCP_AT_ZETA = 0x300;
+    uint256 private constant PROOF_BSB_COMMITMENTS = 0x320;
+
+    // -> next part of proof is
+    // [ openings_selector_commits || commitments_wires_commit_api]
+
+    // -------- offset state
+
+    // challenges to check the claimed quotient
+
+    uint256 private constant STATE_ALPHA = 0x0;
+    uint256 private constant STATE_BETA = 0x20;
+    uint256 private constant STATE_GAMMA = 0x40;
+    uint256 private constant STATE_ZETA = 0x60;
+    uint256 private constant STATE_ALPHA_SQUARE_LAGRANGE_0 = 0x80;
+    uint256 private constant STATE_FOLDED_H_X = 0xa0;
+    uint256 private constant STATE_FOLDED_H_Y = 0xc0;
+    uint256 private constant STATE_LINEARISED_POLYNOMIAL_X = 0xe0;
+    uint256 private constant STATE_LINEARISED_POLYNOMIAL_Y = 0x100;
+    uint256 private constant STATE_OPENING_LINEARISED_POLYNOMIAL_ZETA = 0x120;
+    uint256 private constant STATE_FOLDED_CLAIMED_VALUES = 0x140; // Folded proof for the opening of H, linearised poly, l, r, o, s_1, s_2, qcp
+    uint256 private constant STATE_FOLDED_DIGESTS_X = 0x160; // folded digests of H, linearised poly, l, r, o, s_1, s_2, qcp
+    uint256 private constant STATE_FOLDED_DIGESTS_Y = 0x180;
+    uint256 private constant STATE_PI = 0x1a0;
+    uint256 private constant STATE_ZETA_POWER_N_MINUS_ONE = 0x1c0;
+    uint256 private constant STATE_GAMMA_KZG = 0x1e0;
+    uint256 private constant STATE_SUCCESS = 0x200;
+    uint256 private constant STATE_CHECK_VAR = 0x220; // /!\ this slot is used for debugging only
+    uint256 private constant STATE_LAST_MEM = 0x240;
+
+    // -------- utils (for Fiat Shamir)
+    uint256 private constant FS_ALPHA = 0x616C706861; // "alpha"
+    uint256 private constant FS_BETA = 0x62657461; // "beta"
+    uint256 private constant FS_GAMMA = 0x67616d6d61; // "gamma"
+    uint256 private constant FS_ZETA = 0x7a657461; // "zeta"
+    uint256 private constant FS_GAMMA_KZG = 0x67616d6d61; // "gamma"
+
+    // -------- errors
+    uint256 private constant ERROR_STRING_ID =
+        0x08c379a000000000000000000000000000000000000000000000000000000000; // selector for function Error(string)
+
+    // -------- utils (for hash_fr)
+    uint256 private constant HASH_FR_BB = 340282366920938463463374607431768211456; // 2**128
+    uint256 private constant HASH_FR_ZERO_UINT256 = 0;
+    uint8 private constant HASH_FR_LEN_IN_BYTES = 48;
+    uint8 private constant HASH_FR_SIZE_DOMAIN = 11;
+    uint8 private constant HASH_FR_ONE = 1;
+    uint8 private constant HASH_FR_TWO = 2;
+
+    // -------- precompiles
+    uint8 private constant MOD_EXP = 0x5;
+    uint8 private constant EC_ADD = 0x6;
+    uint8 private constant EC_MUL = 0x7;
+    uint8 private constant EC_PAIR = 0x8;
+
+    /// Verify a Plonk proof.
+    /// Reverts if the proof or the public inputs are malformed.
+    /// @param proof serialised plonk proof (using gnark's MarshalSolidity)
+    /// @param public_inputs (must be reduced)
+    /// @return success true if the proof passes false otherwise
+    function Verify(bytes calldata proof, uint256[] calldata public_inputs)
+        public
+        view
+        returns (bool success)
+    {
+        assembly {
+            let mem := mload(0x40)
+            let freeMem := add(mem, STATE_LAST_MEM)
+
+            // sanity checks
+            check_number_of_public_inputs(public_inputs.length)
+            check_inputs_size(public_inputs.length, public_inputs.offset)
+            check_proof_size(proof.length)
+            check_proof_openings_size(proof.offset)
+
+            // compute the challenges
+            let prev_challenge_non_reduced
+            prev_challenge_non_reduced :=
+                derive_gamma(proof.offset, public_inputs.length, public_inputs.offset)
+            prev_challenge_non_reduced := derive_beta(prev_challenge_non_reduced)
+            prev_challenge_non_reduced := derive_alpha(proof.offset, prev_challenge_non_reduced)
+            derive_zeta(proof.offset, prev_challenge_non_reduced)
+
+            // evaluation of Z=Xⁿ-1 at ζ, we save this value
+            let zeta := mload(add(mem, STATE_ZETA))
+            let zeta_power_n_minus_one :=
+                addmod(pow(zeta, VK_DOMAIN_SIZE, freeMem), sub(R_MOD, 1), R_MOD)
+            mstore(add(mem, STATE_ZETA_POWER_N_MINUS_ONE), zeta_power_n_minus_one)
+
+            // public inputs contribution
+            let l_pi := sum_pi_wo_api_commit(public_inputs.offset, public_inputs.length, freeMem)
+            let l_pi_commit := sum_pi_commit(proof.offset, public_inputs.length, freeMem)
+            l_pi := addmod(l_pi_commit, l_pi, R_MOD)
+            mstore(add(mem, STATE_PI), l_pi)
+
+            compute_alpha_square_lagrange_0()
+            verify_opening_linearised_polynomial(proof.offset)
+            fold_h(proof.offset)
+            compute_commitment_linearised_polynomial(proof.offset)
+            compute_gamma_kzg(proof.offset)
+            fold_state(proof.offset)
+            batch_verify_multi_points(proof.offset)
+
+            success := mload(add(mem, STATE_SUCCESS))
+
+            // Beginning errors -------------------------------------------------
+
+            function error_nb_public_inputs() {
+                let ptError := mload(0x40)
+                mstore(ptError, ERROR_STRING_ID) // selector for function Error(string)
+                mstore(add(ptError, 0x4), 0x20)
+                mstore(add(ptError, 0x24), 0x1d)
+                mstore(add(ptError, 0x44), "wrong number of public inputs")
+                revert(ptError, 0x64)
+            }
+
+            /// Called when an operation on Bn254 fails
+            /// @dev for instance when calling EcMul on a point not on Bn254.
+            function error_ec_op() {
+                let ptError := mload(0x40)
+                mstore(ptError, ERROR_STRING_ID) // selector for function Error(string)
+                mstore(add(ptError, 0x4), 0x20)
+                mstore(add(ptError, 0x24), 0x12)
+                mstore(add(ptError, 0x44), "error ec operation")
+                revert(ptError, 0x64)
+            }
+
+            /// Called when one of the public inputs is not reduced.
+            function error_inputs_size() {
+                let ptError := mload(0x40)
+                mstore(ptError, ERROR_STRING_ID) // selector for function Error(string)
+                mstore(add(ptError, 0x4), 0x20)
+                mstore(add(ptError, 0x24), 0x18)
+                mstore(add(ptError, 0x44), "inputs are bigger than r")
+                revert(ptError, 0x64)
+            }
+
+            /// Called when the size proof is not as expected
+            /// @dev to avoid overflow attack for instance
+            function error_proof_size() {
+                let ptError := mload(0x40)
+                mstore(ptError, ERROR_STRING_ID) // selector for function Error(string)
+                mstore(add(ptError, 0x4), 0x20)
+                mstore(add(ptError, 0x24), 0x10)
+                mstore(add(ptError, 0x44), "wrong proof size")
+                revert(ptError, 0x64)
+            }
+
+            /// Called when one the openings is bigger than r
+            /// The openings are the claimed evalutions of a polynomial
+            /// in a Kzg proof.
+            function error_proof_openings_size() {
+                let ptError := mload(0x40)
+                mstore(ptError, ERROR_STRING_ID) // selector for function Error(string)
+                mstore(add(ptError, 0x4), 0x20)
+                mstore(add(ptError, 0x24), 0x16)
+                mstore(add(ptError, 0x44), "openings bigger than r")
+                revert(ptError, 0x64)
+            }
+
+            function error_pairing() {
+                let ptError := mload(0x40)
+                mstore(ptError, ERROR_STRING_ID) // selector for function Error(string)
+                mstore(add(ptError, 0x4), 0x20)
+                mstore(add(ptError, 0x24), 0xd)
+                mstore(add(ptError, 0x44), "error pairing")
+                revert(ptError, 0x64)
+            }
+
+            function error_verify() {
+                let ptError := mload(0x40)
+                mstore(ptError, ERROR_STRING_ID) // selector for function Error(string)
+                mstore(add(ptError, 0x4), 0x20)
+                mstore(add(ptError, 0x24), 0xc)
+                mstore(add(ptError, 0x44), "error verify")
+                revert(ptError, 0x64)
+            }
+
+            function error_random_generation() {
+                let ptError := mload(0x40)
+                mstore(ptError, ERROR_STRING_ID) // selector for function Error(string)
+                mstore(add(ptError, 0x4), 0x20)
+                mstore(add(ptError, 0x24), 0x14)
+                mstore(add(ptError, 0x44), "error random gen kzg")
+                revert(ptError, 0x64)
+            }
+            // end errors -------------------------------------------------
+
+            // Beginning checks -------------------------------------------------
+
+            /// @param s actual number of public inputs
+            function check_number_of_public_inputs(s) {
+                if iszero(eq(s, VK_NB_PUBLIC_INPUTS)) { error_nb_public_inputs() }
+            }
+
+            /// Checks that the public inputs are < R_MOD.
+            /// @param s number of public inputs
+            /// @param p pointer to the public inputs array
+            function check_inputs_size(s, p) {
+                for { let i } lt(i, s) { i := add(i, 1) } {
+                    if gt(calldataload(p), R_MOD_MINUS_ONE) { error_inputs_size() }
+                    p := add(p, 0x20)
+                }
+            }
+
+            /// Checks if the proof is of the correct size
+            /// @param actual_proof_size size of the proof (not the expected size)
+            function check_proof_size(actual_proof_size) {
+                let expected_proof_size := add(0x300, mul(VK_NB_CUSTOM_GATES, 0x60))
+                if iszero(eq(actual_proof_size, expected_proof_size)) { error_proof_size() }
+            }
+
+            /// Checks if the multiple openings of the polynomials are < R_MOD.
+            /// @param aproof pointer to the beginning of the proof
+            /// @dev the 'a' prepending proof is to have a local name
+            function check_proof_openings_size(aproof) {
+                // PROOF_L_AT_ZETA
+                let p := add(aproof, PROOF_L_AT_ZETA)
+                if gt(calldataload(p), R_MOD_MINUS_ONE) { error_proof_openings_size() }
+
+                // PROOF_R_AT_ZETA
+                p := add(aproof, PROOF_R_AT_ZETA)
+                if gt(calldataload(p), R_MOD_MINUS_ONE) { error_proof_openings_size() }
+
+                // PROOF_O_AT_ZETA
+                p := add(aproof, PROOF_O_AT_ZETA)
+                if gt(calldataload(p), R_MOD_MINUS_ONE) { error_proof_openings_size() }
+
+                // PROOF_S1_AT_ZETA
+                p := add(aproof, PROOF_S1_AT_ZETA)
+                if gt(calldataload(p), R_MOD_MINUS_ONE) { error_proof_openings_size() }
+
+                // PROOF_S2_AT_ZETA
+                p := add(aproof, PROOF_S2_AT_ZETA)
+                if gt(calldataload(p), R_MOD_MINUS_ONE) { error_proof_openings_size() }
+
+                // PROOF_GRAND_PRODUCT_AT_ZETA_OMEGA
+                p := add(aproof, PROOF_GRAND_PRODUCT_AT_ZETA_OMEGA)
+                if gt(calldataload(p), R_MOD_MINUS_ONE) { error_proof_openings_size() }
+
+                // PROOF_OPENING_QCP_AT_ZETA
+
+                p := add(aproof, PROOF_OPENING_QCP_AT_ZETA)
+                for { let i := 0 } lt(i, VK_NB_CUSTOM_GATES) { i := add(i, 1) } {
+                    if gt(calldataload(p), R_MOD_MINUS_ONE) { error_proof_openings_size() }
+                    p := add(p, 0x20)
+                }
+            }
+            // end checks -------------------------------------------------
+
+            // Beginning challenges -------------------------------------------------
+
+            /// Derive gamma as Sha256(<transcript>)
+            /// @param aproof pointer to the proof
+            /// @param nb_pi number of public inputs
+            /// @param pi pointer to the array of public inputs
+            /// @return the challenge gamma, not reduced
+            /// @notice The transcript is the concatenation (in this order) of:
+            /// * the word "gamma" in ascii, equal to [0x67,0x61,0x6d, 0x6d, 0x61] and encoded as a uint256.
+            /// * the commitments to the permutation polynomials S1, S2, S3, where we concatenate the coordinates of those points
+            /// * the commitments of Ql, Qr, Qm, Qo, Qk
+            /// * the public inputs
+            /// * the commitments of the wires related to the custom gates (commitments_wires_commit_api)
+            /// * commitments to L, R, O (proof_<l,r,o>_com_<x,y>)
+            /// The data described above is written starting at mPtr. "gamma" lies on 5 bytes,
+            /// and is encoded as a uint256 number n. In basis b = 256, the number looks like this
+            /// [0 0 0 .. 0x67 0x61 0x6d, 0x6d, 0x61]. The first non zero entry is at position 27=0x1b
+            /// Gamma reduced (the actual challenge) is stored at add(state, state_gamma)
+            function derive_gamma(aproof, nb_pi, pi) -> gamma_not_reduced {
+                let state := mload(0x40)
+                let mPtr := add(state, STATE_LAST_MEM)
+
+                // gamma
+                // gamma in ascii is [0x67,0x61,0x6d, 0x6d, 0x61]
+                // (same for alpha, beta, zeta)
+                mstore(mPtr, FS_GAMMA) // "gamma"
+
+                mstore(add(mPtr, 0x20), VK_S1_COM_X)
+                mstore(add(mPtr, 0x40), VK_S1_COM_Y)
+                mstore(add(mPtr, 0x60), VK_S2_COM_X)
+                mstore(add(mPtr, 0x80), VK_S2_COM_Y)
+                mstore(add(mPtr, 0xa0), VK_S3_COM_X)
+                mstore(add(mPtr, 0xc0), VK_S3_COM_Y)
+                mstore(add(mPtr, 0xe0), VK_QL_COM_X)
+                mstore(add(mPtr, 0x100), VK_QL_COM_Y)
+                mstore(add(mPtr, 0x120), VK_QR_COM_X)
+                mstore(add(mPtr, 0x140), VK_QR_COM_Y)
+                mstore(add(mPtr, 0x160), VK_QM_COM_X)
+                mstore(add(mPtr, 0x180), VK_QM_COM_Y)
+                mstore(add(mPtr, 0x1a0), VK_QO_COM_X)
+                mstore(add(mPtr, 0x1c0), VK_QO_COM_Y)
+                mstore(add(mPtr, 0x1e0), VK_QK_COM_X)
+                mstore(add(mPtr, 0x200), VK_QK_COM_Y)
+
+                mstore(add(mPtr, 0x220), VK_QCP_0_X)
+                mstore(add(mPtr, 0x240), VK_QCP_0_Y)
+
+                // public inputs
+                let _mPtr := add(mPtr, 0x260)
+                let size_pi_in_bytes := mul(nb_pi, 0x20)
+                calldatacopy(_mPtr, pi, size_pi_in_bytes)
+                _mPtr := add(_mPtr, size_pi_in_bytes)
+
+                // commitments to l, r, o
+                let size_commitments_lro_in_bytes := 0xc0
+                calldatacopy(_mPtr, aproof, size_commitments_lro_in_bytes)
+                _mPtr := add(_mPtr, size_commitments_lro_in_bytes)
+
+                // total size is :
+                // sizegamma(=0x5) + 11*64(=0x2c0)
+                // + nb_public_inputs*0x20
+                // + nb_custom gates*0x40
+                let size := add(0x2c5, size_pi_in_bytes)
+
+                size := add(size, mul(VK_NB_CUSTOM_GATES, 0x40))
+                let l_success := staticcall(gas(), 0x2, add(mPtr, 0x1b), size, mPtr, 0x20) //0x1b -> 000.."gamma"
+                if iszero(l_success) { error_verify() }
+                gamma_not_reduced := mload(mPtr)
+                mstore(add(state, STATE_GAMMA), mod(gamma_not_reduced, R_MOD))
+            }
+
+            /// derive beta as Sha256<transcript>
+            /// @param gamma_not_reduced the previous challenge (gamma) not reduced
+            /// @return beta_not_reduced the next challenge, beta, not reduced
+            /// @notice the transcript consists of the previous challenge only.
+            /// The reduced version of beta is stored at add(state, state_beta)
+            function derive_beta(gamma_not_reduced) -> beta_not_reduced {
+                let state := mload(0x40)
+                let mPtr := add(mload(0x40), STATE_LAST_MEM)
+
+                // beta
+                mstore(mPtr, FS_BETA) // "beta"
+                mstore(add(mPtr, 0x20), gamma_not_reduced)
+                let l_success := staticcall(gas(), 0x2, add(mPtr, 0x1c), 0x24, mPtr, 0x20) //0x1b -> 000.."gamma"
+                if iszero(l_success) { error_verify() }
+                beta_not_reduced := mload(mPtr)
+                mstore(add(state, STATE_BETA), mod(beta_not_reduced, R_MOD))
+            }
+
+            /// derive alpha as sha256<transcript>
+            /// @param aproof pointer to the proof object
+            /// @param beta_not_reduced the previous challenge (beta) not reduced
+            /// @return alpha_not_reduced the next challenge, alpha, not reduced
+            /// @notice the transcript consists of the previous challenge (beta)
+            /// not reduced, the commitments to the wires associated to the QCP_i,
+            /// and the commitment to the grand product polynomial
+            function derive_alpha(aproof, beta_not_reduced) -> alpha_not_reduced {
+                let state := mload(0x40)
+                let mPtr := add(mload(0x40), STATE_LAST_MEM)
+                let full_size := 0x65 // size("alpha") + 0x20 (previous challenge)
+
+                // alpha
+                mstore(mPtr, FS_ALPHA) // "alpha"
+                let _mPtr := add(mPtr, 0x20)
+                mstore(_mPtr, beta_not_reduced)
+                _mPtr := add(_mPtr, 0x20)
+
+                // Bsb22Commitments
+                let proof_bsb_commitments := add(aproof, PROOF_BSB_COMMITMENTS)
+                let size_bsb_commitments := mul(0x40, VK_NB_CUSTOM_GATES)
+                calldatacopy(_mPtr, proof_bsb_commitments, size_bsb_commitments)
+                _mPtr := add(_mPtr, size_bsb_commitments)
+                full_size := add(full_size, size_bsb_commitments)
+
+                // [Z], the commitment to the grand product polynomial
+                calldatacopy(_mPtr, add(aproof, PROOF_GRAND_PRODUCT_COMMITMENT_X), 0x40)
+                let l_success := staticcall(gas(), 0x2, add(mPtr, 0x1b), full_size, mPtr, 0x20)
+                if iszero(l_success) { error_verify() }
+
+                alpha_not_reduced := mload(mPtr)
+                mstore(add(state, STATE_ALPHA), mod(alpha_not_reduced, R_MOD))
+            }
+
+            /// derive zeta as sha256<transcript>
+            /// @param aproof pointer to the proof object
+            /// @param alpha_not_reduced the previous challenge (alpha) not reduced
+            /// The transcript consists of the previous challenge and the commitment to
+            /// the quotient polynomial h.
+            function derive_zeta(aproof, alpha_not_reduced) {
+                let state := mload(0x40)
+                let mPtr := add(mload(0x40), STATE_LAST_MEM)
+
+                // zeta
+                mstore(mPtr, FS_ZETA) // "zeta"
+                mstore(add(mPtr, 0x20), alpha_not_reduced)
+                calldatacopy(add(mPtr, 0x40), add(aproof, PROOF_H_0_X), 0xc0)
+                let l_success := staticcall(gas(), 0x2, add(mPtr, 0x1c), 0xe4, mPtr, 0x20)
+                if iszero(l_success) { error_verify() }
+                let zeta_not_reduced := mload(mPtr)
+                mstore(add(state, STATE_ZETA), mod(zeta_not_reduced, R_MOD))
+            }
+            // END challenges -------------------------------------------------
+
+            // BEGINNING compute_pi -------------------------------------------------
+
+            /// sum_pi_wo_api_commit computes the public inputs contributions,
+            /// except for the public inputs coming from the custom gate
+            /// @param ins pointer to the public inputs
+            /// @param n number of public inputs
+            /// @param mPtr free memory
+            /// @return pi_wo_commit public inputs contribution (except the public inputs coming from the custom gate)
+            function sum_pi_wo_api_commit(ins, n, mPtr) -> pi_wo_commit {
+                let state := mload(0x40)
+                let z := mload(add(state, STATE_ZETA))
+                let zpnmo := mload(add(state, STATE_ZETA_POWER_N_MINUS_ONE))
+
+                let li := mPtr
+                batch_compute_lagranges_at_z(z, zpnmo, n, li)
+
+                let tmp := 0
+                for { let i := 0 } lt(i, n) { i := add(i, 1) } {
+                    tmp := mulmod(mload(li), calldataload(ins), R_MOD)
+                    pi_wo_commit := addmod(pi_wo_commit, tmp, R_MOD)
+                    li := add(li, 0x20)
+                    ins := add(ins, 0x20)
+                }
+            }
+
+            /// batch_compute_lagranges_at_z computes [L_0(z), .., L_{n-1}(z)]
+            /// @param z point at which the Lagranges are evaluated
+            /// @param zpnmo ζⁿ-1
+            /// @param n number of public inputs (number of Lagranges to compute)
+            /// @param mPtr pointer to which the results are stored
+            function batch_compute_lagranges_at_z(z, zpnmo, n, mPtr) {
+                let zn := mulmod(zpnmo, VK_INV_DOMAIN_SIZE, R_MOD) // 1/n * (ζⁿ - 1)
+
+                let _w := 1
+                let _mPtr := mPtr
+                for { let i := 0 } lt(i, n) { i := add(i, 1) } {
+                    mstore(_mPtr, addmod(z, sub(R_MOD, _w), R_MOD))
+                    _w := mulmod(_w, VK_OMEGA, R_MOD)
+                    _mPtr := add(_mPtr, 0x20)
+                }
+                batch_invert(mPtr, n, _mPtr)
+                _mPtr := mPtr
+                _w := 1
+                for { let i := 0 } lt(i, n) { i := add(i, 1) } {
+                    mstore(_mPtr, mulmod(mulmod(mload(_mPtr), zn, R_MOD), _w, R_MOD))
+                    _mPtr := add(_mPtr, 0x20)
+                    _w := mulmod(_w, VK_OMEGA, R_MOD)
+                }
+            }
+
+            /// @notice Montgomery trick for batch inversion mod R_MOD
+            /// @param ins pointer to the data to batch invert
+            /// @param number of elements to batch invert
+            /// @param mPtr free memory
+            function batch_invert(ins, nb_ins, mPtr) {
+                mstore(mPtr, 1)
+                let offset := 0
+                for { let i := 0 } lt(i, nb_ins) { i := add(i, 1) } {
+                    let prev := mload(add(mPtr, offset))
+                    let cur := mload(add(ins, offset))
+                    cur := mulmod(prev, cur, R_MOD)
+                    offset := add(offset, 0x20)
+                    mstore(add(mPtr, offset), cur)
+                }
+                ins := add(ins, sub(offset, 0x20))
+                mPtr := add(mPtr, offset)
+                let inv := pow(mload(mPtr), sub(R_MOD, 2), add(mPtr, 0x20))
+                for { let i := 0 } lt(i, nb_ins) { i := add(i, 1) } {
+                    mPtr := sub(mPtr, 0x20)
+                    let tmp := mload(ins)
+                    let cur := mulmod(inv, mload(mPtr), R_MOD)
+                    mstore(ins, cur)
+                    inv := mulmod(inv, tmp, R_MOD)
+                    ins := sub(ins, 0x20)
+                }
+            }
+
+            /// Public inputs (the ones coming from the custom gate) contribution
+            /// @param aproof pointer to the proof
+            /// @param nb_public_inputs number of public inputs
+            /// @param mPtr pointer to free memory
+            /// @return pi_commit custom gate public inputs contribution
+            function sum_pi_commit(aproof, nb_public_inputs, mPtr) -> pi_commit {
+                let state := mload(0x40)
+                let z := mload(add(state, STATE_ZETA))
+                let zpnmo := mload(add(state, STATE_ZETA_POWER_N_MINUS_ONE))
+
+                let p := add(aproof, PROOF_BSB_COMMITMENTS)
+
+                let h_fr, ith_lagrange
+
+                h_fr := hash_fr(calldataload(p), calldataload(add(p, 0x20)), mPtr)
+                ith_lagrange :=
+                    compute_ith_lagrange_at_z(
+                        z, zpnmo, add(nb_public_inputs, VK_INDEX_COMMIT_API_0), mPtr
+                    )
+                pi_commit := addmod(pi_commit, mulmod(h_fr, ith_lagrange, R_MOD), R_MOD)
+                p := add(p, 0x40)
+            }
+
+            /// Computes L_i(zeta) =  ωⁱ/n * (ζⁿ-1)/(ζ-ωⁱ) where:
+            /// @param z zeta
+            /// @param zpmno ζⁿ-1
+            /// @param i i-th lagrange
+            /// @param mPtr free memory
+            /// @return res = ωⁱ/n * (ζⁿ-1)/(ζ-ωⁱ)
+            function compute_ith_lagrange_at_z(z, zpnmo, i, mPtr) -> res {
+                let w := pow(VK_OMEGA, i, mPtr) // w**i
+                i := addmod(z, sub(R_MOD, w), R_MOD) // z-w**i
+                w := mulmod(w, VK_INV_DOMAIN_SIZE, R_MOD) // w**i/n
+                i := pow(i, sub(R_MOD, 2), mPtr) // (z-w**i)**-1
+                w := mulmod(w, i, R_MOD) // w**i/n*(z-w)**-1
+                res := mulmod(w, zpnmo, R_MOD)
+            }
+
+            /// @dev https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-06#section-5.2
+            /// @param x x coordinate of a point on Bn254(𝔽_p)
+            /// @param y y coordinate of a point on Bn254(𝔽_p)
+            /// @param mPtr free memory
+            /// @return res an element mod R_MOD
+            function hash_fr(x, y, mPtr) -> res {
+                // [0x00, .. , 0x00 || x, y, || 0, 48, 0, dst, HASH_FR_SIZE_DOMAIN]
+                // <-  64 bytes  ->  <-64b -> <-       1 bytes each     ->
+
+                // [0x00, .., 0x00] 64 bytes of zero
+                mstore(mPtr, HASH_FR_ZERO_UINT256)
+                mstore(add(mPtr, 0x20), HASH_FR_ZERO_UINT256)
+
+                // msg =  x || y , both on 32 bytes
+                mstore(add(mPtr, 0x40), x)
+                mstore(add(mPtr, 0x60), y)
+
+                // 0 || 48 || 0 all on 1 byte
+                mstore8(add(mPtr, 0x80), 0)
+                mstore8(add(mPtr, 0x81), HASH_FR_LEN_IN_BYTES)
+                mstore8(add(mPtr, 0x82), 0)
+
+                // "BSB22-Plonk" = [42, 53, 42, 32, 32, 2d, 50, 6c, 6f, 6e, 6b,]
+                mstore8(add(mPtr, 0x83), 0x42)
+                mstore8(add(mPtr, 0x84), 0x53)
+                mstore8(add(mPtr, 0x85), 0x42)
+                mstore8(add(mPtr, 0x86), 0x32)
+                mstore8(add(mPtr, 0x87), 0x32)
+                mstore8(add(mPtr, 0x88), 0x2d)
+                mstore8(add(mPtr, 0x89), 0x50)
+                mstore8(add(mPtr, 0x8a), 0x6c)
+                mstore8(add(mPtr, 0x8b), 0x6f)
+                mstore8(add(mPtr, 0x8c), 0x6e)
+                mstore8(add(mPtr, 0x8d), 0x6b)
+
+                // size domain
+                mstore8(add(mPtr, 0x8e), HASH_FR_SIZE_DOMAIN)
+
+                let l_success := staticcall(gas(), 0x2, mPtr, 0x8f, mPtr, 0x20)
+                if iszero(l_success) { error_verify() }
+
+                let b0 := mload(mPtr)
+
+                // [b0         || one || dst || HASH_FR_SIZE_DOMAIN]
+                // <-64bytes ->  <-    1 byte each      ->
+                mstore8(add(mPtr, 0x20), HASH_FR_ONE) // 1
+
+                mstore8(add(mPtr, 0x21), 0x42) // dst
+                mstore8(add(mPtr, 0x22), 0x53)
+                mstore8(add(mPtr, 0x23), 0x42)
+                mstore8(add(mPtr, 0x24), 0x32)
+                mstore8(add(mPtr, 0x25), 0x32)
+                mstore8(add(mPtr, 0x26), 0x2d)
+                mstore8(add(mPtr, 0x27), 0x50)
+                mstore8(add(mPtr, 0x28), 0x6c)
+                mstore8(add(mPtr, 0x29), 0x6f)
+                mstore8(add(mPtr, 0x2a), 0x6e)
+                mstore8(add(mPtr, 0x2b), 0x6b)
+
+                mstore8(add(mPtr, 0x2c), HASH_FR_SIZE_DOMAIN) // size domain
+                l_success := staticcall(gas(), 0x2, mPtr, 0x2d, mPtr, 0x20)
+                if iszero(l_success) { error_verify() }
+
+                // b1 is located at mPtr. We store b2 at add(mPtr, 0x20)
+
+                // [b0^b1      || two || dst || HASH_FR_SIZE_DOMAIN]
+                // <-64bytes ->  <-    1 byte each      ->
+                mstore(add(mPtr, 0x20), xor(mload(mPtr), b0))
+                mstore8(add(mPtr, 0x40), HASH_FR_TWO)
+
+                mstore8(add(mPtr, 0x41), 0x42) // dst
+                mstore8(add(mPtr, 0x42), 0x53)
+                mstore8(add(mPtr, 0x43), 0x42)
+                mstore8(add(mPtr, 0x44), 0x32)
+                mstore8(add(mPtr, 0x45), 0x32)
+                mstore8(add(mPtr, 0x46), 0x2d)
+                mstore8(add(mPtr, 0x47), 0x50)
+                mstore8(add(mPtr, 0x48), 0x6c)
+                mstore8(add(mPtr, 0x49), 0x6f)
+                mstore8(add(mPtr, 0x4a), 0x6e)
+                mstore8(add(mPtr, 0x4b), 0x6b)
+
+                mstore8(add(mPtr, 0x4c), HASH_FR_SIZE_DOMAIN) // size domain
+
+                let offset := add(mPtr, 0x20)
+                l_success := staticcall(gas(), 0x2, offset, 0x2d, offset, 0x20)
+                if iszero(l_success) { error_verify() }
+
+                // at this point we have mPtr = [ b1 || b2] where b1 is on 32byes and b2 in 16bytes.
+                // we interpret it as a big integer mod r in big endian (similar to regular decimal notation)
+                // the result is then 2**(8*16)*mPtr[32:] + mPtr[32:48]
+                res := mulmod(mload(mPtr), HASH_FR_BB, R_MOD) // <- res = 2**128 * mPtr[:32]
+                let b1 := shr(128, mload(add(mPtr, 0x20))) // b1 <- [0, 0, .., 0 ||  b2[:16] ]
+                res := addmod(res, b1, R_MOD)
+            }
+
+            // END compute_pi -------------------------------------------------
+
+            /// @notice compute α² * 1/n * (ζ{n}-1)/(ζ - 1) where
+            /// *  α = challenge derived in derive_gamma_beta_alpha_zeta
+            /// * n = vk_domain_size
+            /// * ω = vk_omega (generator of the multiplicative cyclic group of order n in (ℤ/rℤ)*)
+            /// * ζ = zeta (challenge derived with Fiat Shamir)
+            function compute_alpha_square_lagrange_0() {
+                let state := mload(0x40)
+                let mPtr := add(mload(0x40), STATE_LAST_MEM)
+
+                let res := mload(add(state, STATE_ZETA_POWER_N_MINUS_ONE))
+                let den := addmod(mload(add(state, STATE_ZETA)), sub(R_MOD, 1), R_MOD)
+                den := pow(den, sub(R_MOD, 2), mPtr)
+                den := mulmod(den, VK_INV_DOMAIN_SIZE, R_MOD)
+                res := mulmod(den, res, R_MOD)
+
+                let l_alpha := mload(add(state, STATE_ALPHA))
+                res := mulmod(res, l_alpha, R_MOD)
+                res := mulmod(res, l_alpha, R_MOD)
+                mstore(add(state, STATE_ALPHA_SQUARE_LAGRANGE_0), res)
+            }
+
+            /// @notice follows alg. p.13 of https://eprint.iacr.org/2019/953.pdf
+            /// with t₁ = t₂ = 1, and the proofs are ([digest] + [quotient] +purported evaluation):
+            /// * [state_folded_state_digests], [proof_batch_opening_at_zeta_x], state_folded_evals
+            /// * [proof_grand_product_commitment], [proof_opening_at_zeta_omega_x], [proof_grand_product_at_zeta_omega]
+            /// @param aproof pointer to the proof
+            function batch_verify_multi_points(aproof) {
+                let state := mload(0x40)
+                let mPtr := add(state, STATE_LAST_MEM)
+
+                // derive a random number. As there is no random generator, we
+                // do an FS like challenge derivation, depending on both digests and
+                // ζ to ensure that the prover cannot control the random numger.
+                // Note: adding the other point ζω is not needed, as ω is known beforehand.
+                mstore(mPtr, mload(add(state, STATE_FOLDED_DIGESTS_X)))
+                mstore(add(mPtr, 0x20), mload(add(state, STATE_FOLDED_DIGESTS_Y)))
+                mstore(add(mPtr, 0x40), calldataload(add(aproof, PROOF_BATCH_OPENING_AT_ZETA_X)))
+                mstore(add(mPtr, 0x60), calldataload(add(aproof, PROOF_BATCH_OPENING_AT_ZETA_Y)))
+                mstore(add(mPtr, 0x80), calldataload(add(aproof, PROOF_GRAND_PRODUCT_COMMITMENT_X)))
+                mstore(add(mPtr, 0xa0), calldataload(add(aproof, PROOF_GRAND_PRODUCT_COMMITMENT_Y)))
+                mstore(add(mPtr, 0xc0), calldataload(add(aproof, PROOF_OPENING_AT_ZETA_OMEGA_X)))
+                mstore(add(mPtr, 0xe0), calldataload(add(aproof, PROOF_OPENING_AT_ZETA_OMEGA_Y)))
+                mstore(add(mPtr, 0x100), mload(add(state, STATE_ZETA)))
+                mstore(add(mPtr, 0x120), mload(add(state, STATE_GAMMA_KZG)))
+                let random := staticcall(gas(), 0x2, mPtr, 0x140, mPtr, 0x20)
+                if iszero(random) { error_random_generation() }
+                random := mod(mload(mPtr), R_MOD) // use the same variable as we are one variable away from getting stack-too-deep error...
+
+                let folded_quotients := mPtr
+                mPtr := add(folded_quotients, 0x40)
+                mstore(folded_quotients, calldataload(add(aproof, PROOF_BATCH_OPENING_AT_ZETA_X)))
+                mstore(
+                    add(folded_quotients, 0x20),
+                    calldataload(add(aproof, PROOF_BATCH_OPENING_AT_ZETA_Y))
+                )
+                point_acc_mul_calldata(
+                    folded_quotients, add(aproof, PROOF_OPENING_AT_ZETA_OMEGA_X), random, mPtr
+                )
+
+                let folded_digests := add(state, STATE_FOLDED_DIGESTS_X)
+                point_acc_mul_calldata(
+                    folded_digests, add(aproof, PROOF_GRAND_PRODUCT_COMMITMENT_X), random, mPtr
+                )
+
+                let folded_evals := add(state, STATE_FOLDED_CLAIMED_VALUES)
+                fr_acc_mul_calldata(
+                    folded_evals, add(aproof, PROOF_GRAND_PRODUCT_AT_ZETA_OMEGA), random
+                )
+
+                let folded_evals_commit := mPtr
+                mPtr := add(folded_evals_commit, 0x40)
+                mstore(folded_evals_commit, G1_SRS_X)
+                mstore(add(folded_evals_commit, 0x20), G1_SRS_Y)
+                mstore(add(folded_evals_commit, 0x40), mload(folded_evals))
+                let check_staticcall :=
+                    staticcall(gas(), 7, folded_evals_commit, 0x60, folded_evals_commit, 0x40)
+                if iszero(check_staticcall) { error_verify() }
+
+                let folded_evals_commit_y := add(folded_evals_commit, 0x20)
+                mstore(folded_evals_commit_y, sub(P_MOD, mload(folded_evals_commit_y)))
+                point_add(folded_digests, folded_digests, folded_evals_commit, mPtr)
+
+                let folded_points_quotients := mPtr
+                mPtr := add(mPtr, 0x40)
+                point_mul_calldata(
+                    folded_points_quotients,
+                    add(aproof, PROOF_BATCH_OPENING_AT_ZETA_X),
+                    mload(add(state, STATE_ZETA)),
+                    mPtr
+                )
+                let zeta_omega := mulmod(mload(add(state, STATE_ZETA)), VK_OMEGA, R_MOD)
+                random := mulmod(random, zeta_omega, R_MOD)
+                point_acc_mul_calldata(
+                    folded_points_quotients,
+                    add(aproof, PROOF_OPENING_AT_ZETA_OMEGA_X),
+                    random,
+                    mPtr
+                )
+
+                point_add(folded_digests, folded_digests, folded_points_quotients, mPtr)
+
+                let folded_quotients_y := add(folded_quotients, 0x20)
+                mstore(folded_quotients_y, sub(P_MOD, mload(folded_quotients_y)))
+
+                mstore(mPtr, mload(folded_digests))
+                mstore(add(mPtr, 0x20), mload(add(folded_digests, 0x20)))
+                mstore(add(mPtr, 0x40), G2_SRS_0_X_0) // the 4 lines are the canonical G2 point on BN254
+                mstore(add(mPtr, 0x60), G2_SRS_0_X_1)
+                mstore(add(mPtr, 0x80), G2_SRS_0_Y_0)
+                mstore(add(mPtr, 0xa0), G2_SRS_0_Y_1)
+                mstore(add(mPtr, 0xc0), mload(folded_quotients))
+                mstore(add(mPtr, 0xe0), mload(add(folded_quotients, 0x20)))
+                mstore(add(mPtr, 0x100), G2_SRS_1_X_0)
+                mstore(add(mPtr, 0x120), G2_SRS_1_X_1)
+                mstore(add(mPtr, 0x140), G2_SRS_1_Y_0)
+                mstore(add(mPtr, 0x160), G2_SRS_1_Y_1)
+                check_pairing_kzg(mPtr)
+            }
+
+            /// @notice check_pairing_kzg checks the result of the final pairing product of the batched
+            /// kzg verification. The purpose of this function is to avoid exhausting the stack
+            /// in the function batch_verify_multi_points.
+            /// @param mPtr pointer storing the tuple of pairs
+            function check_pairing_kzg(mPtr) {
+                let state := mload(0x40)
+
+                let l_success := staticcall(gas(), 8, mPtr, 0x180, 0x00, 0x20)
+                if iszero(l_success) { error_pairing() }
+                let res_pairing := mload(0x00)
+                mstore(add(state, STATE_SUCCESS), res_pairing)
+            }
+
+            /// @notice Fold the opening proofs at ζ:
+            /// * at state+state_folded_digest we store: [Linearised_polynomial]+γ[L] + γ²[R] + γ³[O] + γ⁴[S₁] +γ⁵[S₂] + ∑ᵢγ⁵⁺ⁱ[Pi_{i}]
+            /// * at state+state_folded_claimed_values we store: H(ζ) + γLinearised_polynomial(ζ)+γ²L(ζ) + γ³R(ζ)+ γ⁴O(ζ) + γ⁵S₁(ζ) +γ⁶S₂(ζ) + ∑ᵢγ⁶⁺ⁱPi_{i}(ζ)
+            /// @param aproof pointer to the proof
+            /// acc_gamma stores the γⁱ
+            function fold_state(aproof) {
+                let state := mload(0x40)
+                let mPtr := add(mload(0x40), STATE_LAST_MEM)
+                let mPtr20 := add(mPtr, 0x20)
+                let mPtr40 := add(mPtr, 0x40)
+
+                let l_gamma_kzg := mload(add(state, STATE_GAMMA_KZG))
+                let acc_gamma := l_gamma_kzg
+                let state_folded_digests := add(state, STATE_FOLDED_DIGESTS_X)
+
+                mstore(
+                    add(state, STATE_FOLDED_DIGESTS_X),
+                    mload(add(state, STATE_LINEARISED_POLYNOMIAL_X))
+                )
+                mstore(
+                    add(state, STATE_FOLDED_DIGESTS_Y),
+                    mload(add(state, STATE_LINEARISED_POLYNOMIAL_Y))
+                )
+                mstore(
+                    add(state, STATE_FOLDED_CLAIMED_VALUES),
+                    mload(add(state, STATE_OPENING_LINEARISED_POLYNOMIAL_ZETA))
+                )
+
+                point_acc_mul_calldata(
+                    add(state, STATE_FOLDED_DIGESTS_X), add(aproof, PROOF_L_COM_X), acc_gamma, mPtr
+                )
+                fr_acc_mul_calldata(
+                    add(state, STATE_FOLDED_CLAIMED_VALUES), add(aproof, PROOF_L_AT_ZETA), acc_gamma
+                )
+
+                acc_gamma := mulmod(acc_gamma, l_gamma_kzg, R_MOD)
+                point_acc_mul_calldata(
+                    state_folded_digests, add(aproof, PROOF_R_COM_X), acc_gamma, mPtr
+                )
+                fr_acc_mul_calldata(
+                    add(state, STATE_FOLDED_CLAIMED_VALUES), add(aproof, PROOF_R_AT_ZETA), acc_gamma
+                )
+
+                acc_gamma := mulmod(acc_gamma, l_gamma_kzg, R_MOD)
+                point_acc_mul_calldata(
+                    state_folded_digests, add(aproof, PROOF_O_COM_X), acc_gamma, mPtr
+                )
+                fr_acc_mul_calldata(
+                    add(state, STATE_FOLDED_CLAIMED_VALUES), add(aproof, PROOF_O_AT_ZETA), acc_gamma
+                )
+
+                acc_gamma := mulmod(acc_gamma, l_gamma_kzg, R_MOD)
+                mstore(mPtr, VK_S1_COM_X)
+                mstore(mPtr20, VK_S1_COM_Y)
+                point_acc_mul(state_folded_digests, mPtr, acc_gamma, mPtr40)
+                fr_acc_mul_calldata(
+                    add(state, STATE_FOLDED_CLAIMED_VALUES),
+                    add(aproof, PROOF_S1_AT_ZETA),
+                    acc_gamma
+                )
+
+                acc_gamma := mulmod(acc_gamma, l_gamma_kzg, R_MOD)
+                mstore(mPtr, VK_S2_COM_X)
+                mstore(mPtr20, VK_S2_COM_Y)
+                point_acc_mul(state_folded_digests, mPtr, acc_gamma, mPtr40)
+                fr_acc_mul_calldata(
+                    add(state, STATE_FOLDED_CLAIMED_VALUES),
+                    add(aproof, PROOF_S2_AT_ZETA),
+                    acc_gamma
+                )
+                let poqaz := add(aproof, PROOF_OPENING_QCP_AT_ZETA)
+
+                acc_gamma := mulmod(acc_gamma, l_gamma_kzg, R_MOD)
+                mstore(mPtr, VK_QCP_0_X)
+                mstore(mPtr20, VK_QCP_0_Y)
+                point_acc_mul(state_folded_digests, mPtr, acc_gamma, mPtr40)
+                fr_acc_mul_calldata(add(state, STATE_FOLDED_CLAIMED_VALUES), poqaz, acc_gamma)
+                poqaz := add(poqaz, 0x20)
+            }
+
+            /// @notice generate the challenge (using Fiat Shamir) to fold the opening proofs
+            /// at ζ.
+            /// The process for deriving γ is the same as in derive_gamma but this time the inputs are
+            /// in this order (the [] means it's a commitment):
+            /// * ζ
+            /// * [Linearised polynomial]
+            /// * [L], [R], [O]
+            /// * [S₁] [S₂]
+            /// * [Pi_{i}] (wires associated to custom gates)
+            /// Then there are the purported evaluations of the previous committed polynomials:
+            /// * Linearised_polynomial(ζ)
+            /// * L(ζ), R(ζ), O(ζ), S₁(ζ), S₂(ζ)
+            /// * Pi_{i}(ζ)
+            /// * Z(ζω)
+            /// @param aproof pointer to the proof
+            function compute_gamma_kzg(aproof) {
+                let state := mload(0x40)
+                let mPtr := add(mload(0x40), STATE_LAST_MEM)
+                mstore(mPtr, FS_GAMMA_KZG) // "gamma"
+                mstore(add(mPtr, 0x20), mload(add(state, STATE_ZETA)))
+                mstore(add(mPtr, 0x40), mload(add(state, STATE_LINEARISED_POLYNOMIAL_X)))
+                mstore(add(mPtr, 0x60), mload(add(state, STATE_LINEARISED_POLYNOMIAL_Y)))
+                calldatacopy(add(mPtr, 0x80), add(aproof, PROOF_L_COM_X), 0xc0)
+                mstore(add(mPtr, 0x140), VK_S1_COM_X)
+                mstore(add(mPtr, 0x160), VK_S1_COM_Y)
+                mstore(add(mPtr, 0x180), VK_S2_COM_X)
+                mstore(add(mPtr, 0x1a0), VK_S2_COM_Y)
+
+                let offset := 0x1c0
+
+                mstore(add(mPtr, offset), VK_QCP_0_X)
+                mstore(add(mPtr, add(offset, 0x20)), VK_QCP_0_Y)
+                offset := add(offset, 0x40)
+                mstore(
+                    add(mPtr, offset), mload(add(state, STATE_OPENING_LINEARISED_POLYNOMIAL_ZETA))
+                )
+                mstore(add(mPtr, add(offset, 0x20)), calldataload(add(aproof, PROOF_L_AT_ZETA)))
+                mstore(add(mPtr, add(offset, 0x40)), calldataload(add(aproof, PROOF_R_AT_ZETA)))
+                mstore(add(mPtr, add(offset, 0x60)), calldataload(add(aproof, PROOF_O_AT_ZETA)))
+                mstore(add(mPtr, add(offset, 0x80)), calldataload(add(aproof, PROOF_S1_AT_ZETA)))
+                mstore(add(mPtr, add(offset, 0xa0)), calldataload(add(aproof, PROOF_S2_AT_ZETA)))
+
+                let _mPtr := add(mPtr, add(offset, 0xc0))
+
+                let _poqaz := add(aproof, PROOF_OPENING_QCP_AT_ZETA)
+                calldatacopy(_mPtr, _poqaz, mul(VK_NB_CUSTOM_GATES, 0x20))
+                _mPtr := add(_mPtr, mul(VK_NB_CUSTOM_GATES, 0x20))
+
+                mstore(_mPtr, calldataload(add(aproof, PROOF_GRAND_PRODUCT_AT_ZETA_OMEGA)))
+
+                let start_input := 0x1b // 00.."gamma"
+                let size_input := add(0x14, mul(VK_NB_CUSTOM_GATES, 3)) // number of 32bytes elmts = 0x17 (zeta+3*6 for the digests+openings) + 3*VK_NB_CUSTOM_GATES (for the commitments of the selectors) + 1 (opening of Z at ζω)
+                size_input := add(0x5, mul(size_input, 0x20)) // size in bytes: 15*32 bytes + 5 bytes for gamma
+                let check_staticcall :=
+                    staticcall(
+                        gas(),
+                        0x2,
+                        add(mPtr, start_input),
+                        size_input,
+                        add(state, STATE_GAMMA_KZG),
+                        0x20
+                    )
+                if iszero(check_staticcall) { error_verify() }
+                mstore(add(state, STATE_GAMMA_KZG), mod(mload(add(state, STATE_GAMMA_KZG)), R_MOD))
+            }
+
+            function compute_commitment_linearised_polynomial_ec(aproof, s1, s2) {
+                let state := mload(0x40)
+                let mPtr := add(mload(0x40), STATE_LAST_MEM)
+
+                mstore(mPtr, VK_QL_COM_X)
+                mstore(add(mPtr, 0x20), VK_QL_COM_Y)
+                point_mul(
+                    add(state, STATE_LINEARISED_POLYNOMIAL_X),
+                    mPtr,
+                    calldataload(add(aproof, PROOF_L_AT_ZETA)),
+                    add(mPtr, 0x40)
+                )
+
+                mstore(mPtr, VK_QR_COM_X)
+                mstore(add(mPtr, 0x20), VK_QR_COM_Y)
+                point_acc_mul(
+                    add(state, STATE_LINEARISED_POLYNOMIAL_X),
+                    mPtr,
+                    calldataload(add(aproof, PROOF_R_AT_ZETA)),
+                    add(mPtr, 0x40)
+                )
+
+                let rl :=
+                    mulmod(
+                        calldataload(add(aproof, PROOF_L_AT_ZETA)),
+                        calldataload(add(aproof, PROOF_R_AT_ZETA)),
+                        R_MOD
+                    )
+                mstore(mPtr, VK_QM_COM_X)
+                mstore(add(mPtr, 0x20), VK_QM_COM_Y)
+                point_acc_mul(add(state, STATE_LINEARISED_POLYNOMIAL_X), mPtr, rl, add(mPtr, 0x40))
+
+                mstore(mPtr, VK_QO_COM_X)
+                mstore(add(mPtr, 0x20), VK_QO_COM_Y)
+                point_acc_mul(
+                    add(state, STATE_LINEARISED_POLYNOMIAL_X),
+                    mPtr,
+                    calldataload(add(aproof, PROOF_O_AT_ZETA)),
+                    add(mPtr, 0x40)
+                )
+
+                mstore(mPtr, VK_QK_COM_X)
+                mstore(add(mPtr, 0x20), VK_QK_COM_Y)
+                point_add(
+                    add(state, STATE_LINEARISED_POLYNOMIAL_X),
+                    add(state, STATE_LINEARISED_POLYNOMIAL_X),
+                    mPtr,
+                    add(mPtr, 0x40)
+                )
+
+                let qcp_opening_at_zeta := add(aproof, PROOF_OPENING_QCP_AT_ZETA)
+                let bsb_commitments := add(aproof, PROOF_BSB_COMMITMENTS)
+                for { let i := 0 } lt(i, VK_NB_CUSTOM_GATES) { i := add(i, 1) } {
+                    mstore(mPtr, calldataload(bsb_commitments))
+                    mstore(add(mPtr, 0x20), calldataload(add(bsb_commitments, 0x20)))
+                    point_acc_mul(
+                        add(state, STATE_LINEARISED_POLYNOMIAL_X),
+                        mPtr,
+                        calldataload(qcp_opening_at_zeta),
+                        add(mPtr, 0x40)
+                    )
+                    qcp_opening_at_zeta := add(qcp_opening_at_zeta, 0x20)
+                    bsb_commitments := add(bsb_commitments, 0x40)
+                }
+
+                mstore(mPtr, VK_S3_COM_X)
+                mstore(add(mPtr, 0x20), VK_S3_COM_Y)
+                point_acc_mul(add(state, STATE_LINEARISED_POLYNOMIAL_X), mPtr, s1, add(mPtr, 0x40))
+
+                mstore(mPtr, calldataload(add(aproof, PROOF_GRAND_PRODUCT_COMMITMENT_X)))
+                mstore(add(mPtr, 0x20), calldataload(add(aproof, PROOF_GRAND_PRODUCT_COMMITMENT_Y)))
+                point_acc_mul(add(state, STATE_LINEARISED_POLYNOMIAL_X), mPtr, s2, add(mPtr, 0x40))
+
+                point_add(
+                    add(state, STATE_LINEARISED_POLYNOMIAL_X),
+                    add(state, STATE_LINEARISED_POLYNOMIAL_X),
+                    add(state, STATE_FOLDED_H_X),
+                    mPtr
+                )
+            }
+
+            /// @notice Compute the commitment to the linearized polynomial equal to
+            ///	L(ζ)[Qₗ]+r(ζ)[Qᵣ]+R(ζ)L(ζ)[Qₘ]+O(ζ)[Qₒ]+[Qₖ]+Σᵢqc'ᵢ(ζ)[BsbCommitmentᵢ] +
+            ///	α*( Z(μζ)(L(ζ)+β*S₁(ζ)+γ)*(R(ζ)+β*S₂(ζ)+γ)[S₃]-[Z](L(ζ)+β*id_{1}(ζ)+γ)*(R(ζ)+β*id_{2}(ζ)+γ)*(O(ζ)+β*id_{3}(ζ)+γ) ) +
+            ///	α²*L₁(ζ)[Z] - Z_{H}(ζ)*(([H₀] + ζᵐ⁺²*[H₁] + ζ²⁽ᵐ⁺²⁾*[H₂])
+            /// where
+            /// * id_1 = id, id_2 = vk_coset_shift*id, id_3 = vk_coset_shift^{2}*id
+            /// * the [] means that it's a commitment (i.e. a point on Bn254(F_p))
+            /// * Z_{H}(ζ) = ζ^n-1
+            /// @param aproof pointer to the proof
+            function compute_commitment_linearised_polynomial(aproof) {
+                let state := mload(0x40)
+                let l_beta := mload(add(state, STATE_BETA))
+                let l_gamma := mload(add(state, STATE_GAMMA))
+                let l_zeta := mload(add(state, STATE_ZETA))
+                let l_alpha := mload(add(state, STATE_ALPHA))
+
+                let u :=
+                    mulmod(calldataload(add(aproof, PROOF_GRAND_PRODUCT_AT_ZETA_OMEGA)), l_beta, R_MOD)
+                let v := mulmod(l_beta, calldataload(add(aproof, PROOF_S1_AT_ZETA)), R_MOD)
+                v := addmod(v, calldataload(add(aproof, PROOF_L_AT_ZETA)), R_MOD)
+                v := addmod(v, l_gamma, R_MOD)
+
+                let w := mulmod(l_beta, calldataload(add(aproof, PROOF_S2_AT_ZETA)), R_MOD)
+                w := addmod(w, calldataload(add(aproof, PROOF_R_AT_ZETA)), R_MOD)
+                w := addmod(w, l_gamma, R_MOD)
+
+                let s1 := mulmod(u, v, R_MOD)
+                s1 := mulmod(s1, w, R_MOD)
+                s1 := mulmod(s1, l_alpha, R_MOD)
+
+                let coset_square := mulmod(VK_COSET_SHIFT, VK_COSET_SHIFT, R_MOD)
+                let betazeta := mulmod(l_beta, l_zeta, R_MOD)
+                u := addmod(betazeta, calldataload(add(aproof, PROOF_L_AT_ZETA)), R_MOD)
+                u := addmod(u, l_gamma, R_MOD)
+
+                v := mulmod(betazeta, VK_COSET_SHIFT, R_MOD)
+                v := addmod(v, calldataload(add(aproof, PROOF_R_AT_ZETA)), R_MOD)
+                v := addmod(v, l_gamma, R_MOD)
+
+                w := mulmod(betazeta, coset_square, R_MOD)
+                w := addmod(w, calldataload(add(aproof, PROOF_O_AT_ZETA)), R_MOD)
+                w := addmod(w, l_gamma, R_MOD)
+
+                let s2 := mulmod(u, v, R_MOD)
+                s2 := mulmod(s2, w, R_MOD)
+                s2 := sub(R_MOD, s2)
+                s2 := mulmod(s2, l_alpha, R_MOD)
+                s2 := addmod(s2, mload(add(state, STATE_ALPHA_SQUARE_LAGRANGE_0)), R_MOD)
+
+                // at this stage:
+                // * s₁ = α*Z(μζ)(l(ζ)+β*s₁(ζ)+γ)*(r(ζ)+β*s₂(ζ)+γ)*β
+                // * s₂ = -α*(l(ζ)+β*ζ+γ)*(r(ζ)+β*u*ζ+γ)*(o(ζ)+β*u²*ζ+γ) + α²*L₁(ζ)
+
+                compute_commitment_linearised_polynomial_ec(aproof, s1, s2)
+            }
+
+            /// @notice compute -z_h(ζ)*([H₁] + ζᵐ⁺²[H₂] + ζ²⁽ᵐ⁺²⁾[H₃]) and store the result at
+            /// state + state_folded_h
+            /// @param aproof pointer to the proof
+            function fold_h(aproof) {
+                let state := mload(0x40)
+                let n_plus_two := add(VK_DOMAIN_SIZE, 2)
+                let mPtr := add(mload(0x40), STATE_LAST_MEM)
+                let zeta_power_n_plus_two := pow(mload(add(state, STATE_ZETA)), n_plus_two, mPtr)
+                point_mul_calldata(
+                    add(state, STATE_FOLDED_H_X),
+                    add(aproof, PROOF_H_2_X),
+                    zeta_power_n_plus_two,
+                    mPtr
+                )
+                point_add_calldata(
+                    add(state, STATE_FOLDED_H_X),
+                    add(state, STATE_FOLDED_H_X),
+                    add(aproof, PROOF_H_1_X),
+                    mPtr
+                )
+                point_mul(
+                    add(state, STATE_FOLDED_H_X),
+                    add(state, STATE_FOLDED_H_X),
+                    zeta_power_n_plus_two,
+                    mPtr
+                )
+                point_add_calldata(
+                    add(state, STATE_FOLDED_H_X),
+                    add(state, STATE_FOLDED_H_X),
+                    add(aproof, PROOF_H_0_X),
+                    mPtr
+                )
+                point_mul(
+                    add(state, STATE_FOLDED_H_X),
+                    add(state, STATE_FOLDED_H_X),
+                    mload(add(state, STATE_ZETA_POWER_N_MINUS_ONE)),
+                    mPtr
+                )
+                let folded_h_y := mload(add(state, STATE_FOLDED_H_Y))
+                folded_h_y := sub(P_MOD, folded_h_y)
+                mstore(add(state, STATE_FOLDED_H_Y), folded_h_y)
+            }
+
+            /// @notice check that the opening of the linearised polynomial at zeta is equal to
+            /// - [ PI(ζ) - α²*L₁(ζ) + α(l(ζ)+β*s1(ζ)+γ)(r(ζ)+β*s2(ζ)+γ)(o(ζ)+γ)*z(ωζ) ]
+            /// @param aproof pointer to the proof
+            function verify_opening_linearised_polynomial(aproof) {
+                let state := mload(0x40)
+
+                // (l(ζ)+β*s1(ζ)+γ)
+                let s1
+                s1 :=
+                    mulmod(
+                        calldataload(add(aproof, PROOF_S1_AT_ZETA)),
+                        mload(add(state, STATE_BETA)),
+                        R_MOD
+                    )
+                s1 := addmod(s1, mload(add(state, STATE_GAMMA)), R_MOD)
+                s1 := addmod(s1, calldataload(add(aproof, PROOF_L_AT_ZETA)), R_MOD)
+
+                // (r(ζ)+β*s2(ζ)+γ)
+                let s2
+                s2 :=
+                    mulmod(
+                        calldataload(add(aproof, PROOF_S2_AT_ZETA)),
+                        mload(add(state, STATE_BETA)),
+                        R_MOD
+                    )
+                s2 := addmod(s2, mload(add(state, STATE_GAMMA)), R_MOD)
+                s2 := addmod(s2, calldataload(add(aproof, PROOF_R_AT_ZETA)), R_MOD)
+
+                // (o(ζ)+γ)
+                let o
+                o :=
+                    addmod(
+                        calldataload(add(aproof, PROOF_O_AT_ZETA)),
+                        mload(add(state, STATE_GAMMA)),
+                        R_MOD
+                    )
+
+                //  α*Z(μζ)*(l(ζ)+β*s1(ζ)+γ)*(r(ζ)+β*s2(ζ)+γ)*(o(ζ)+γ)
+                s1 := mulmod(s1, s2, R_MOD)
+                s1 := mulmod(s1, o, R_MOD)
+                s1 := mulmod(s1, mload(add(state, STATE_ALPHA)), R_MOD)
+                s1 :=
+                    mulmod(s1, calldataload(add(aproof, PROOF_GRAND_PRODUCT_AT_ZETA_OMEGA)), R_MOD)
+
+                // PI(ζ) - α²*L₁(ζ) + α(l(ζ)+β*s1(ζ)+γ)(r(ζ)+β*s2(ζ)+γ)(o(ζ)+γ)*z(ωζ)
+                s1 := addmod(s1, mload(add(state, STATE_PI)), R_MOD)
+                s2 := mload(add(state, STATE_ALPHA_SQUARE_LAGRANGE_0))
+                s2 := sub(R_MOD, s2)
+                s1 := addmod(s1, s2, R_MOD)
+                s1 := sub(R_MOD, s1)
+
+                mstore(add(state, STATE_OPENING_LINEARISED_POLYNOMIAL_ZETA), s1)
+            }
+
+            // BEGINNING utils math functions -------------------------------------------------
+
+            /// @param dst pointer storing the result
+            /// @param p pointer to the first point
+            /// @param q pointer to the second point
+            /// @param mPtr pointer to free memory
+            function point_add(dst, p, q, mPtr) {
+                mstore(mPtr, mload(p))
+                mstore(add(mPtr, 0x20), mload(add(p, 0x20)))
+                mstore(add(mPtr, 0x40), mload(q))
+                mstore(add(mPtr, 0x60), mload(add(q, 0x20)))
+                let l_success := staticcall(gas(), EC_ADD, mPtr, 0x80, dst, 0x40)
+                if iszero(l_success) { error_ec_op() }
+            }
+
+            /// @param dst pointer storing the result
+            /// @param p pointer to the first point (calldata)
+            /// @param q pointer to the second point (calladata)
+            /// @param mPtr pointer to free memory
+            function point_add_calldata(dst, p, q, mPtr) {
+                mstore(mPtr, mload(p))
+                mstore(add(mPtr, 0x20), mload(add(p, 0x20)))
+                mstore(add(mPtr, 0x40), calldataload(q))
+                mstore(add(mPtr, 0x60), calldataload(add(q, 0x20)))
+                let l_success := staticcall(gas(), EC_ADD, mPtr, 0x80, dst, 0x40)
+                if iszero(l_success) { error_ec_op() }
+            }
+
+            /// @parma dst pointer storing the result
+            /// @param src pointer to a point on Bn254(𝔽_p)
+            /// @param s scalar
+            /// @param mPtr free memory
+            function point_mul(dst, src, s, mPtr) {
+                mstore(mPtr, mload(src))
+                mstore(add(mPtr, 0x20), mload(add(src, 0x20)))
+                mstore(add(mPtr, 0x40), s)
+                let l_success := staticcall(gas(), EC_MUL, mPtr, 0x60, dst, 0x40)
+                if iszero(l_success) { error_ec_op() }
+            }
+
+            /// @parma dst pointer storing the result
+            /// @param src pointer to a point on Bn254(𝔽_p) on calldata
+            /// @param s scalar
+            /// @param mPtr free memory
+            function point_mul_calldata(dst, src, s, mPtr) {
+                mstore(mPtr, calldataload(src))
+                mstore(add(mPtr, 0x20), calldataload(add(src, 0x20)))
+                mstore(add(mPtr, 0x40), s)
+                let l_success := staticcall(gas(), EC_MUL, mPtr, 0x60, dst, 0x40)
+                if iszero(l_success) { error_ec_op() }
+            }
+
+            /// @notice dst <- dst + [s]src (Elliptic curve)
+            /// @param dst pointer accumulator point storing the result
+            /// @param src pointer to the point to multiply and add
+            /// @param s scalar
+            /// @param mPtr free memory
+            function point_acc_mul(dst, src, s, mPtr) {
+                mstore(mPtr, mload(src))
+                mstore(add(mPtr, 0x20), mload(add(src, 0x20)))
+                mstore(add(mPtr, 0x40), s)
+                let l_success := staticcall(gas(), 7, mPtr, 0x60, mPtr, 0x40)
+                mstore(add(mPtr, 0x40), mload(dst))
+                mstore(add(mPtr, 0x60), mload(add(dst, 0x20)))
+                l_success := and(l_success, staticcall(gas(), EC_ADD, mPtr, 0x80, dst, 0x40))
+                if iszero(l_success) { error_ec_op() }
+            }
+
+            /// @notice dst <- dst + [s]src (Elliptic curve)
+            /// @param dst pointer accumulator point storing the result
+            /// @param src pointer to the point to multiply and add (on calldata)
+            /// @param s scalar
+            /// @mPtr free memory
+            function point_acc_mul_calldata(dst, src, s, mPtr) {
+                let state := mload(0x40)
+                mstore(mPtr, calldataload(src))
+                mstore(add(mPtr, 0x20), calldataload(add(src, 0x20)))
+                mstore(add(mPtr, 0x40), s)
+                let l_success := staticcall(gas(), 7, mPtr, 0x60, mPtr, 0x40)
+                mstore(add(mPtr, 0x40), mload(dst))
+                mstore(add(mPtr, 0x60), mload(add(dst, 0x20)))
+                l_success := and(l_success, staticcall(gas(), EC_ADD, mPtr, 0x80, dst, 0x40))
+                if iszero(l_success) { error_ec_op() }
+            }
+
+            /// @notice dst <- dst + src*s (Fr) dst,src are addresses, s is a value
+            /// @param dst pointer storing the result
+            /// @param src pointer to the scalar to multiply and add (on calldata)
+            /// @param s scalar
+            function fr_acc_mul_calldata(dst, src, s) {
+                let tmp := mulmod(calldataload(src), s, R_MOD)
+                mstore(dst, addmod(mload(dst), tmp, R_MOD))
+            }
+
+            /// @param x element to exponentiate
+            /// @param e exponent
+            /// @param mPtr free memory
+            /// @return res x ** e mod r
+            function pow(x, e, mPtr) -> res {
+                mstore(mPtr, 0x20)
+                mstore(add(mPtr, 0x20), 0x20)
+                mstore(add(mPtr, 0x40), 0x20)
+                mstore(add(mPtr, 0x60), x)
+                mstore(add(mPtr, 0x80), e)
+                mstore(add(mPtr, 0xa0), R_MOD)
+                let check_staticcall := staticcall(gas(), MOD_EXP, mPtr, 0xc0, mPtr, 0x20)
+                if eq(check_staticcall, 0) {}
+                res := mload(mPtr)
+            }
+        }
+    }
+}
diff --git a/contracts/src/v1.0.7-testnet/SP1Verifier.sol b/contracts/src/v1.0.7-testnet/SP1Verifier.sol
new file mode 100644
index 0000000..255504b
--- /dev/null
+++ b/contracts/src/v1.0.7-testnet/SP1Verifier.sol
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {ISP1Verifier, ISP1VerifierWithHash} from "../ISP1Verifier.sol";
+import {PlonkVerifier} from "./PlonkVerifier.sol";
+
+/// @title SP1 Verifier
+/// @author Succinct Labs
+/// @notice This contracts implements a solidity verifier for SP1.
+contract SP1Verifier is PlonkVerifier, ISP1VerifierWithHash {
+    /// @notice Thrown when the verifier selector from this proof does not match the one in this
+    /// verifier. This indicates that this proof was sent to the wrong verifier.
+    /// @param received The verifier selector from the first 4 bytes of the proof.
+    /// @param expected The verifier selector from the first 4 bytes of the VERIFIER_HASH().
+    error WrongVerifierSelector(bytes4 received, bytes4 expected);
+
+    function VERSION() external pure returns (string memory) {
+        return "v1.0.7-testnet";
+    }
+
+    /// @inheritdoc ISP1VerifierWithHash
+    function VERIFIER_HASH() public pure returns (bytes32) {
+        return 0x8c5bc5e47d8cb77f864aee881f8b66cc2457d46bd0b81b315bf82ccfadf78c50;
+    }
+
+    /// @notice Hashes the public values to a field elements inside Bn254.
+    /// @param publicValues The public values.
+    function hashPublicValues(bytes calldata publicValues) public pure returns (bytes32) {
+        return sha256(publicValues) & bytes32(uint256((1 << 253) - 1));
+    }
+
+    /// @inheritdoc ISP1Verifier
+    function verifyProof(
+        bytes32 programVKey,
+        bytes calldata publicValues,
+        bytes calldata proofBytes
+    ) external view {
+        bytes4 recievedSelector = bytes4(proofBytes[:4]);
+        bytes4 expectedSelector = bytes4(VERIFIER_HASH());
+        if (recievedSelector != expectedSelector) {
+            revert WrongVerifierSelector(recievedSelector, expectedSelector);
+        }
+
+        bytes32 publicValuesDigest = hashPublicValues(publicValues);
+        uint256[] memory inputs = new uint256[](2);
+        inputs[0] = uint256(programVKey);
+        inputs[1] = uint256(publicValuesDigest);
+        this.Verify(proofBytes[4:], inputs);
+    }
+}
diff --git a/contracts/test/SP1Verifier.t.sol b/contracts/test/SP1Verifier.t.sol
deleted file mode 100644
index 86ca42a..0000000
--- a/contracts/test/SP1Verifier.t.sol
+++ /dev/null
@@ -1,13 +0,0 @@
-// SPDX-License-Identifier: UNLICENSED
-pragma solidity ^0.8.13;
-
-import {Test, console} from "forge-std/Test.sol";
-import {SP1Verifier} from "../src/SP1Verifier.sol";
-
-contract SP1VerifierTest is Test {
-    SP1Verifier public verifier;
-
-    function setUp() public {
-        verifier = new SP1Verifier();
-    }
-}
diff --git a/contracts/test/SP1VerifierGateway.t.sol b/contracts/test/SP1VerifierGateway.t.sol
new file mode 100644
index 0000000..b759860
--- /dev/null
+++ b/contracts/test/SP1VerifierGateway.t.sol
@@ -0,0 +1,218 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Test, console} from "forge-std/Test.sol";
+import {SP1VerifierGateway} from "../src/SP1VerifierGateway.sol";
+import {ISP1VerifierWithHash} from "../src/ISP1Verifier.sol";
+
+import {
+    ISP1VerifierGatewayEvents,
+    ISP1VerifierGatewayErrors,
+    VerifierRoute
+} from "../src/ISP1VerifierGateway.sol";
+import {Ownable} from "lib/openzeppelin-contracts/contracts/access/Ownable.sol";
+
+contract SP1VerifierV1 is ISP1VerifierWithHash {
+    function VERSION() external pure returns (string memory) {
+        return "1";
+    }
+
+    function VERIFIER_HASH() public pure returns (bytes32) {
+        return 0x19ff1d210e06a53ee50e5bad25fa509a6b00ed395695f7d9b82b68155d9e1065;
+    }
+
+    function verifyProof(bytes32, bytes calldata, bytes calldata proofBytes) external pure {
+        assert(bytes4(proofBytes[:4]) == bytes4(VERIFIER_HASH()));
+    }
+}
+
+contract SP1VerifierV2 is ISP1VerifierWithHash {
+    function VERSION() external pure returns (string memory) {
+        return "2";
+    }
+
+    function VERIFIER_HASH() public pure returns (bytes32) {
+        return 0xfd4b4d23a917e7d7d75deec81f86b55b1c86689a5e3a3c8ae054741af2a7fea8;
+    }
+
+    function verifyProof(bytes32, bytes calldata, bytes calldata proofBytes) external pure {
+        assert(bytes4(proofBytes[:4]) == bytes4(VERIFIER_HASH()));
+    }
+}
+
+contract SP1VerifierGatewayTest is Test, ISP1VerifierGatewayEvents, ISP1VerifierGatewayErrors {
+    address internal constant REMOVED_VERIFIER = address(1);
+    bytes32 internal constant PROGRAM_VKEY = bytes32(uint256(1));
+    bytes internal constant PUBLIC_VALUES = hex"";
+    bytes internal constant PROOF_1 = hex"19ff1d210001";
+    bytes internal constant PROOF_2 = hex"fd4b4d230002";
+
+    address internal verifier1;
+    address internal verifier2;
+    address internal owner;
+    address internal gateway;
+
+    function setUp() public virtual {
+        verifier1 = address(new SP1VerifierV1());
+        verifier2 = address(new SP1VerifierV2());
+        owner = makeAddr("owner");
+        gateway = address(new SP1VerifierGateway(owner));
+    }
+
+    /// @notice Should confirm that the test environment is set up correctly.
+    function test_SetUp() public view {
+        assertEq(SP1VerifierGateway(gateway).owner(), owner);
+
+        address verifier;
+        bool frozen;
+        (verifier, frozen) =
+            SP1VerifierGateway(gateway).routes(bytes4(SP1VerifierV1(verifier1).VERIFIER_HASH()));
+        assertEq(verifier, address(0));
+        assertEq(frozen, false);
+
+        (verifier, frozen) =
+            SP1VerifierGateway(gateway).routes(bytes4(SP1VerifierV2(verifier2).VERIFIER_HASH()));
+        assertEq(verifier, address(0));
+        assertEq(frozen, false);
+    }
+
+    /// @notice Should succeed when the owner adds a verifier route.
+    function test_AddRoute() public {
+        // Add verifier route 1
+        bytes4 verifier1Selector = bytes4(SP1VerifierV1(verifier1).VERIFIER_HASH());
+        vm.expectEmit(true, true, true, true);
+        emit RouteAdded(verifier1Selector, verifier1);
+        vm.prank(owner);
+        SP1VerifierGateway(gateway).addRoute(verifier1);
+
+        (address verifier, bool frozen) = SP1VerifierGateway(gateway).routes(verifier1Selector);
+        assertEq(verifier, verifier1);
+        assertEq(frozen, false);
+    }
+
+    /// @notice Should revert when an account other than the owner tries to add a verifier route.
+    function test_RevertAddRoute_WhenNotOwner() public {
+        vm.expectRevert(
+            abi.encodeWithSelector(
+                Ownable.OwnableUnauthorizedAccount.selector, makeAddr("notOwner")
+            )
+        );
+        vm.prank(makeAddr("notOwner"));
+        SP1VerifierGateway(gateway).addRoute(verifier1);
+    }
+
+    /// @notice Should revert when a verifier does not implement the ISP1VerifierWithHash interface.
+    function test_RevertAddRoute_WhenNotSP1Verifier() public {
+        vm.expectRevert();
+        vm.prank(owner);
+        SP1VerifierGateway(gateway).addRoute(makeAddr("notSP1Verifier"));
+    }
+
+    /// @notice Should revert when a verifier already exists that was added with the same selector.
+    function test_RevertAddRoute_WhenAlreadyExists() public {
+        bytes4 verifier1Selector = bytes4(SP1VerifierV1(verifier1).VERIFIER_HASH());
+        vm.expectEmit(true, true, true, true);
+        emit RouteAdded(verifier1Selector, verifier1);
+        vm.prank(owner);
+        SP1VerifierGateway(gateway).addRoute(verifier1);
+
+        vm.expectRevert(abi.encodeWithSelector(RouteAlreadyExists.selector, verifier1));
+        vm.prank(owner);
+        SP1VerifierGateway(gateway).addRoute(verifier1);
+    }
+
+    /// @notice Should succeed when the owner freezes an existing verifier route.
+    function test_FreezeRoute() public {
+        // Add verifier route 1
+        bytes4 verifier1Selector = bytes4(SP1VerifierV1(verifier1).VERIFIER_HASH());
+        vm.expectEmit(true, true, true, true);
+        emit RouteAdded(verifier1Selector, verifier1);
+        vm.prank(owner);
+        SP1VerifierGateway(gateway).addRoute(verifier1);
+
+        (address verifier, bool frozen) = SP1VerifierGateway(gateway).routes(verifier1Selector);
+        assertEq(verifier, verifier1);
+        assertEq(frozen, false);
+
+        vm.expectEmit(true, true, true, true);
+        emit RouteFrozen(verifier1Selector, verifier1);
+        vm.prank(owner);
+        SP1VerifierGateway(gateway).freezeRoute(verifier1Selector);
+
+        (verifier, frozen) = SP1VerifierGateway(gateway).routes(verifier1Selector);
+        assertEq(verifier, verifier1);
+        assertEq(frozen, true);
+    }
+
+    /// @notice Should revert when an account other than the owner tries to freeze a verifier route.
+    function test_RevertFreezeRoute_WhenNotOwner() public {
+        bytes4 verifier1Selector = bytes4(SP1VerifierV1(verifier1).VERIFIER_HASH());
+        vm.expectRevert(
+            abi.encodeWithSelector(
+                Ownable.OwnableUnauthorizedAccount.selector, makeAddr("notOwner")
+            )
+        );
+        vm.prank(makeAddr("notOwner"));
+        SP1VerifierGateway(gateway).freezeRoute(verifier1Selector);
+    }
+
+    /// @notice Should revert when a verifier route does not exist.
+    function test_RevertFreezeRoute_WhenNoRoute() public {
+        bytes4 verifier1Selector = bytes4(SP1VerifierV1(verifier1).VERIFIER_HASH());
+        vm.expectRevert(abi.encodeWithSelector(RouteNotFound.selector, verifier1Selector));
+        vm.prank(owner);
+        SP1VerifierGateway(gateway).freezeRoute(verifier1Selector);
+    }
+
+    /// @notice Should revert when a verifier route is already frozen.
+    function test_RevertFreezeRoute_WhenRouteIsFrozen() public {
+        bytes4 verifier1Selector = bytes4(SP1VerifierV1(verifier1).VERIFIER_HASH());
+        vm.prank(owner);
+        SP1VerifierGateway(gateway).addRoute(verifier1);
+        vm.prank(owner);
+        SP1VerifierGateway(gateway).freezeRoute(verifier1Selector);
+
+        vm.expectRevert(abi.encodeWithSelector(RouteIsFrozen.selector, verifier1Selector));
+        vm.prank(owner);
+        SP1VerifierGateway(gateway).freezeRoute(verifier1Selector);
+    }
+
+    /// @notice Should succeed when a proof that has the verifier selector is sent to the
+    /// the verifier gateway which has those verifiers added.
+    function test_VerifyProof() public {
+        // Add verifier 1
+        vm.prank(owner);
+        SP1VerifierGateway(gateway).addRoute(verifier1);
+
+        // Add verifier 2
+        vm.prank(owner);
+        SP1VerifierGateway(gateway).addRoute(verifier2);
+
+        // Send a proof using verifier 1
+        SP1VerifierGateway(gateway).verifyProof(PROGRAM_VKEY, PUBLIC_VALUES, PROOF_1);
+
+        // Send a proof using verifier 2
+        SP1VerifierGateway(gateway).verifyProof(PROGRAM_VKEY, PUBLIC_VALUES, PROOF_2);
+    }
+
+    /// @notice Should revert when a proof is sent to the verifier gateway which has no verifier
+    /// route for the proof's verifier selector.
+    function test_RevertVerifyProof_WhenNoRoute() public {
+        bytes4 verifier1Selector = bytes4(SP1VerifierV1(verifier1).VERIFIER_HASH());
+        vm.expectRevert(abi.encodeWithSelector(RouteNotFound.selector, verifier1Selector));
+        SP1VerifierGateway(gateway).verifyProof(PROGRAM_VKEY, PUBLIC_VALUES, PROOF_1);
+    }
+
+    /// @notice Should revert when a proof is sent to the verifier gateway which has a verifier
+    /// route that is frozen for the proof's verifier selector.
+    function test_RevertVerifyProof_WhenRouteIsFrozen() public {
+        bytes4 verifier1Selector = bytes4(SP1VerifierV1(verifier1).VERIFIER_HASH());
+        vm.prank(owner);
+        SP1VerifierGateway(gateway).addRoute(verifier1);
+        vm.prank(owner);
+        SP1VerifierGateway(gateway).freezeRoute(verifier1Selector);
+
+        vm.expectRevert(abi.encodeWithSelector(RouteIsFrozen.selector, verifier1Selector));
+        SP1VerifierGateway(gateway).verifyProof(PROGRAM_VKEY, PUBLIC_VALUES, PROOF_1);
+    }
+}