r1cs-compiler: AND/XOR black-box panics on witnesses wider than 32 bits (u64)
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 52/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Stale
- Tech stack
- rust
- Domain
- compilers, cryptography
Research direction
Reproduce the failure with the provided Noir main.nr, Prover.toml, and provekit commands. Read provekit/common/src/witness/binops.rs and digits.rs, then follow the witness-witness path in provekit/r1cs-compiler/src/noir_to_r1cs.rs. Done means u64 AND, XOR, and OR witnesses no longer panic during provekit preparation or proving.
Written by the indexing model from the issue text.
Description
Description
ProveKit's R1CS compiler hardcodes AND/XOR decomposition to 32 bits. Any Noir program that passes u64 (or wider) witnesses to a bitwise AND/XOR/OR operation causes provekit to panic at runtime with "Higher order bits are not zero". The same program runs fine under nargo execute, making this an incompatibility between provekit and the Noir toolchain.
Reproducer
// src/main.nr
fn main(a: u64, b: u64) -> pub u64 {
a ^ b
}
# Prover.toml
a = "109953116273223783" # > u32::MAX
b = "18446744073709551614"
Description
nargo execute # succeeds — nargo's ACVM handles u64 natively
provekit prepare
provekit prove # panics: thread '...' panicked at 'Higher order bits are not zero'
Root Cause
BINOP_BITS = 32 is hardcoded in provekit/common/src/witness/binops.rs:
pub const BINOP_BITS: usize = 32;
pub const NUM_DIGITS: usize = BINOP_BITS / BINOP_ATOMIC_BITS; // = 4 bytes
In process_binop_opcode, the witness-witness path allocates exactly 4 bytes (32 bits) for decomposition:
let log_bases = vec![BINOP_ATOMIC_BITS; NUM_DIGITS]; // [8, 8, 8, 8]
let dd = add_digital_decomposition(self, log_bases, vec![lhs_witness, rhs_witness, out_idx]);
At runtime, decompose_into_digits asserts that no bits remain after the 32-bit decomposition:
assert!(remaining_bits.all(|bit| !bit), "Higher order bits are not zero");
A u64 witness value > u32::MAX has bits set above position 31, triggering this panic.
Affected Files
| File | Notes |
|---|---|
provekit/common/src/witness/binops.rs |
BINOP_BITS = 32 constant |
provekit/r1cs-compiler/src/noir_to_r1cs.rs#L428-L438 |
witness-witness decomposition path |
provekit/common/src/witness/digits.rs#L46 |
panic site |
- Dominant language
- Noir
- Stars
- 138
- Forks
- 47
- Avg merge
- 1d 34m
- Merged PRs (30d)
- 6
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from worldfnd/provekit
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 1/5 Under an hour Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
All issues in worldfnd/provekit
Similar issues
-
mlir
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
llvm/llvm-project#224908 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
area-CodeGen-coreclr untriaged
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
secondlife/sl-vscode-plugin#147 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
objectionary/phie#149 ·