[ilyalesokhin-starkware]

Monday task: Consider propagating sizes instead of hardcoding them (similar to what we did with ppt)

Summary

In the multiverifier, each verified inner circuit is now identified in the outer output preimage by a circuit hash — blake2s(config_words ‖ preprocessed_root) — instead of the bare preprocessed_root.

A preprocessed root does not, by itself, commit to the config it is interpreted under (per-component trace log sizes + the FRI log_blowup_factor). Emitting only the root in the multiverifier's output leaves it open to a reinterpretation attack: a valid preprocessed root can be paired with config_words other than the ones actually used, so a consumer of the output hash cannot tell which configuration the root was verified under. Hashing config_words together with the root binds the full (config, root) pair, so the output commits to the exact configuration the circuit was verified with.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Changes the multiverifier’s public output commitment semantics (breaking for anyone hashing the old preimage) in exchange for binding config to identity; scope is limited to circuit_multiverifier and test fixtures.

Overview
The multiverifier’s outer Blake2s output preimage now uses each inner circuit’s circuit_hash (config + preprocessed root) paired with that circuit’s reserved output words, instead of the bare preprocessed root plus outputs. That ties the emitted digest to the exact verifier configuration (component log sizes and FRI blowup), not just the Merkle root.

build_multiverifier_circuit pulls statement.circuit_hash into the hash payload; tests add leaf_circuit_hash / rename the host Blake helper to native_blake_u32s, and fixtures (including MULTIVERIFIER_PREPROCESSED_ROOT) are updated to match the new binding.

^{Reviewed by Cursor Bugbot for commit df80d01. Bugbot is set up for automated code reviews on this repo. Configure here.}

[reviewable-StarkWare]

This change is 

[ilyalesokhin-starkware]

• feat(unpacker): add Merkle commitment unpacker circuit #612
• Use circuit hash instead of pp_root to uniquely identify the circuit #634 👈 (View in Graphite)
• feat(circuit-verifier): mix circuit hash into the channel. #648
• feat(circuit-verifier): add compute_circuit_hash #647
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[leo-starkware]

@leo-starkware reviewed 6 files and all commit messages, and made 2 comments.
Reviewable status: all files reviewed, 2 unresolved discussions (waiting on Gali-StarkWare and ilyalesokhin-starkware).

---

crates/circuit_multiverifier/src/test_utils.rs line 72 at r2 (raw file):

/// Computes the circuit hash for a given preprocessed root with the multiverifier's shared config.
pub fn multiverifier_leaf_circuit_hash(preprocessed_root: [u32; 8]) -> [u32; 8] {

Suggestion:

leaf_circuit_hash(preprocessed_root: [u32; 8], preprocessed_column_log_sizes: OrderedHashMap<PreProcessedColumnId, u32>)

---

crates/circuit_multiverifier/src/verify_test.rs line 367 at r2 (raw file):

    // followed by the eight raw output words.
    let cairo_input_preimage_words: Vec<u32> =
        multiverifier_leaf_circuit_hash(PRIVACY_CAIRO_VERIFIER_PREPROCESSED_ROOT)

Suggestion:

leaf_circuit_hash(PRIVACY_CAIRO_VERIFIER_PREPROCESSED_ROOT, shared_config.preprocessed_column_log_sizes)

[leo-starkware]

@leo-starkware made 1 comment.
Reviewable status: all files reviewed, 3 unresolved discussions (waiting on Gali-StarkWare and ilyalesokhin-starkware).

---

crates/circuit_multiverifier/src/verify.rs line 90 at r2 (raw file):

        verify(&mut context, &proof_vars, &shared_config.proof_config, &statement);
        // Reuse the statement's `circuit_hash` (the same hash mixed into the sub-proof's channel)
        // so the outer hash commits to it.

This comment is a bit confusing. Maybe claude can improve it

Code quote:

        // Reuse the statement's `circuit_hash` (the same hash mixed into the sub-proof's channel)
        // so the outer hash commits to it.

[ilyalesokhin-starkware]

crates/circuit_multiverifier/src/test_utils.rs line 72 at r2 (raw file):

/// Computes the circuit hash for a given preprocessed root with the multiverifier's shared config.
pub fn multiverifier_leaf_circuit_hash(preprocessed_root: [u32; 8]) -> [u32; 8] {

I passed the shared config.

Note, however, that it is a test_utils function.
So I think it should be optimized for the call-sites.

for example it return u32s and not Blake2sHash like compute_circuit_hash(

[ilyalesokhin-starkware]

@ilyalesokhin-starkware made 2 comments.
Reviewable status: 0 of 6 files reviewed, 3 unresolved discussions (waiting on Gali-StarkWare and leo-starkware).

---

crates/circuit_multiverifier/src/verify.rs line 90 at r2 (raw file):

Previously, leo-starkware wrote…

This comment is a bit confusing. Maybe claude can improve it

Done.

---

crates/circuit_multiverifier/src/verify_test.rs line 367 at r2 (raw file):

    // followed by the eight raw output words.
    let cairo_input_preimage_words: Vec<u32> =
        multiverifier_leaf_circuit_hash(PRIVACY_CAIRO_VERIFIER_PREPROCESSED_ROOT)

Done.

[leo-starkware]

@leo-starkware reviewed 6 files and all commit messages, made 2 comments, and resolved 3 discussions.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on Gali-StarkWare).

---

crates/circuit_multiverifier/src/test_utils.rs line 72 at r2 (raw file):

Previously, ilyalesokhin-starkware wrote…

I passed the shared config.

Note, however, that it is a test_utils function.
So I think it should be optimized for the call-sites.

for example it return u32s and not Blake2sHash like compute_circuit_hash(

makes sense, but i think that taking the argument explicitly is more readable here.

[ilyalesokhin-starkware]

@ilyalesokhin-starkware reviewed 6 files and all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on Gali-StarkWare).