implement Nova's AugmentedFCircuit

Cargo.toml

@@ -10,7 +10,7 @@ ark-poly = "^0.4.0"
 ark-std = "^0.4.0"
 ark-crypto-primitives = { version = "^0.4.0", default-features = false, features = ["r1cs", "sponge", "crh"] }
 ark-relations = { version = "^0.4.0", default-features = false }
-ark-r1cs-std = { version = "^0.4.0", default-features = false }
+ark-r1cs-std = { default-features = false } # use latest version from the patch
 ark-circom = { git = "https://github.com/gakonst/ark-circom.git" }
 thiserror = "1.0"
 rayon = "1.7.0"
@@ -26,6 +26,8 @@ espresso_transcript = {git="https://github.com/EspressoSystems/hyperplonk", pack
 ark-pallas = {version="0.4.0", features=["r1cs"]}
 ark-vesta = {version="0.4.0"}
 ark-bn254 = "0.4.0"
+tracing = { version = "0.1", default-features = false, features = [ "attributes" ] }
+tracing-subscriber = { version = "0.2" }
 
 [features]
 default = ["parallel", "nova", "hypernova"]
@@ -37,3 +39,11 @@ parallel = [
     "ark-ff/parallel",  
     "ark-poly/parallel", 
     ]
+
+# The following patch is to use a version of ark-r1cs-std compatible with
+# v0.4.0 but that includes a cherry-picked commit from after v0.4.0 which fixes
+# the in-circuit scalar multiplication of the zero point. The commit is from
+# https://github.com/arkworks-rs/r1cs-std/pull/124, without including other
+# changes done between v0.4.0 and this fix which would break compatibility.
+[patch.crates-io]
+ark-r1cs-std = { git = "https://github.com/arnaucube/ark-r1cs-std-cherry-picked/" }

src/folding/circuits/cyclefold.rs

@@ -21,9 +21,8 @@ impl<C: CurveGroup, GC: CurveVar<C, CF<C>>> ECRLC<C, GC> {
         p1: GC,
         p2: GC,
         p3: GC,
-    ) -> Result<(), SynthesisError> {
-        p3.enforce_equal(&(p1 + p2.scalar_mul_le(r_bits.iter())?))?;
-        Ok(())
+    ) -> Result<Boolean<CF<C>>, SynthesisError> {
+        p3.is_eq(&(p1 + p2.scalar_mul_le(r_bits.iter())?))
     }
 }
 
@@ -32,7 +31,7 @@ mod tests {
     use super::*;
     use ark_ff::{BigInteger, PrimeField};
     use ark_pallas::{constraints::GVar, Fq, Fr, Projective};
-    use ark_r1cs_std::alloc::AllocVar;
+    use ark_r1cs_std::{alloc::AllocVar, eq::EqGadget};
     use ark_relations::r1cs::ConstraintSystem;
     use ark_std::UniformRand;
     use std::ops::Mul;
@@ -59,7 +58,8 @@ mod tests {
         let p3Var = GVar::new_witness(cs.clone(), || Ok(p3)).unwrap();
 
         // check ECRLC circuit
-        ECRLC::<Projective, GVar>::check(rbitsVar, p1Var, p2Var, p3Var).unwrap();
+        let check_pass = ECRLC::<Projective, GVar>::check(rbitsVar, p1Var, p2Var, p3Var).unwrap();
+        check_pass.enforce_equal(&Boolean::<Fq>::TRUE).unwrap();
         assert!(cs.is_satisfied().unwrap());
     }
 }

src/folding/circuits/nonnative.rs

@@ -6,6 +6,7 @@ use ark_r1cs_std::{
     fields::nonnative::NonNativeFieldVar,
 };
 use ark_relations::r1cs::{Namespace, SynthesisError};
+use ark_std::{One, Zero};
 use core::borrow::Borrow;
 
 /// NonNativeAffineVar represents an elliptic curve point in Affine represenation in the non-native
@@ -31,6 +32,19 @@ where
             let cs = cs.into();
 
             let affine = val.borrow().into_affine();
+            if affine.is_zero() {
+                let x = NonNativeFieldVar::<C::BaseField, C::ScalarField>::new_variable(
+                    cs.clone(),
+                    || Ok(C::BaseField::zero()),
+                    mode,
+                )?;
+                let y = NonNativeFieldVar::<C::BaseField, C::ScalarField>::new_variable(
+                    cs.clone(),
+                    || Ok(C::BaseField::one()),
+                    mode,
+                )?;
+                return Ok(Self { x, y });
+            }
             let xy = affine.xy().unwrap();
             let x = NonNativeFieldVar::<C::BaseField, C::ScalarField>::new_variable(
                 cs.clone(),
@@ -58,6 +72,20 @@ where
     <C as ark_ec::CurveGroup>::BaseField: ark_ff::PrimeField,
 {
     let affine = p.into_affine();
+    if affine.is_zero() {
+        let x =
+            AllocatedNonNativeFieldVar::<C::BaseField, C::ScalarField>::get_limbs_representations(
+                &C::BaseField::zero(),
+                OptimizationType::Weight,
+            )?;
+        let y =
+            AllocatedNonNativeFieldVar::<C::BaseField, C::ScalarField>::get_limbs_representations(
+                &C::BaseField::one(),
+                OptimizationType::Weight,
+            )?;
+        return Ok((x, y));
+    }
+
     let (x, y) = affine.xy().unwrap();
     let x = AllocatedNonNativeFieldVar::<C::BaseField, C::ScalarField>::get_limbs_representations(
         x,
@@ -69,3 +97,21 @@ where
     )?;
     Ok((x, y))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use ark_pallas::{Fq, Fr, Projective};
+    use ark_r1cs_std::alloc::AllocVar;
+    use ark_relations::r1cs::ConstraintSystem;
+    use ark_std::Zero;
+
+    #[test]
+    fn test_alloc_nonnativeaffinevar_zero() {
+        let cs = ConstraintSystem::<Fr>::new_ref();
+
+        // dealing with the 'zero' point should not panic when doing the unwrap
+        let p = Projective::zero();
+        NonNativeAffineVar::<Fq, Fr>::new_witness(cs.clone(), || Ok(p)).unwrap();
+    }
+}