Solana: Zero-knowledge proofs with Noir and Groth16

┌─────────────┐   ┌──────────────┐   ┌──────────────┐   ┌─────────────┐
│ Noir source │──▶│ nargo compile│──▶│ sunspot      │──▶│ sunspot     │
│  main.nr    │   │ (ACIR bytes) │   │ compile      │   │ setup       │
└─────────────┘   └──────────────┘   │ (CCS)        │   │ (pk, vk)    │
                                      └──────────────┘   └─────────────┘
                                                                 │
                                                                 ▼
┌─────────────┐   ┌──────────────┐   ┌──────────────┐   ┌─────────────┐
│  Solana     │◀──│ solana deploy│◀──│ sunspot      │◀──│ sunspot     │
│  verifier   │   │ (.so)        │   │ deploy       │   │ prove       │
│  program    │   │              │   │ (verifier)   │   │ (.proof)    │
└─────────────┘   └──────────────┘   └──────────────┘   └─────────────┘

# Install noirup
curl -L https://raw.githubusercontent.com/noir-lang/noirup/main/install | bash
source ~/.bashrc  # or your shell's rc file

# Pin the Noir version
noirup -v 1.0.0-beta.18

# Verify
nargo --version
# Expected: nargo version = 1.0.0-beta.18

git clone https://github.com/reilabs/sunspot.git ~/sunspot
cd ~/sunspot/go
go build -o sunspot .
sudo mv sunspot /usr/local/bin/

# Sunspot needs to know where the verifier-bin crate lives
export GNARK_VERIFIER_BIN="$HOME/sunspot/gnark-solana/crates/verifier-bin"
echo 'export GNARK_VERIFIER_BIN="$HOME/sunspot/gnark-solana/crates/verifier-bin"' >> ~/.zshrc

# Verify
sunspot --help

git clone https://github.com/solana-foundation/noir-examples.git
cd noir-examples
just install-all

fn main(x: u64, y: pub u64) {
    assert(x != y);
}

#[test]
fn test_main() {
    main(1, 2);
}

x = "42"
y = "100"

# 1. Compile Noir → ACIR bytecode
nargo compile
# Produces target/one.json (the ACIR)

# 2. Execute the circuit with the inputs from Prover.toml to produce a witness
nargo execute
# Produces target/one.gz (the witness)

# 3. Translate ACIR to Gnark's constraint system
sunspot compile target/one.json
# Produces target/one.ccs

# 4. Run the Groth16 trusted setup
sunspot setup target/one.ccs
# Produces target/one.pk (proving key) and target/one.vk (verifying key)

# 5. Generate the Groth16 proof
sunspot prove target/one.json target/one.gz target/one.ccs target/one.pk
# Produces target/one.proof and target/one.pw (public witness)

# Build a Solana program with the verifying key baked in
sunspot deploy target/one.vk
# Output file names derive from the verifying-key basename:
# target/one.so and target/one-keypair.json

# Deploy to devnet
solana program deploy target/one.so \
  --program-id target/one-keypair.json \
  --url devnet

import {
  createSolanaRpc,
  createSolanaRpcSubscriptions,
  createTransactionMessage,
  appendTransactionMessageInstructions,
  setTransactionMessageFeePayerSigner,
  setTransactionMessageLifetimeUsingBlockhash,
  signTransactionMessageWithSigners,
  sendAndConfirmTransactionFactory,
  type Address,
} from "@solana/kit";
import { getSetComputeUnitLimitInstruction } from "@solana-program/compute-budget";
import fs from "fs";

// Run from circuits/one/client/ — artifacts live one directory up.
const proof = fs.readFileSync("../target/one.proof");
const publicWitness = fs.readFileSync("../target/one.pw");
const instructionData = Buffer.concat([proof, publicWitness]);

const rpc = createSolanaRpc("YOUR_CHAINSTACK_RPC_ENDPOINT");
const rpcSubscriptions = createSolanaRpcSubscriptions("YOUR_CHAINSTACK_WSS_ENDPOINT");

const verifyInstruction = {
  programAddress: VERIFIER_PROGRAM_ID as Address,
  accounts: [],
  data: new Uint8Array(instructionData),
};

// Sunspot-generated verifiers consume 170K–500K CU depending on circuit
// complexity. The default per-instruction budget is 200K; set an explicit
// limit to cover the verifier plus caller overhead.
const { value: latestBlockhash } = await rpc.getLatestBlockhash().send();
const tx = appendTransactionMessageInstructions(
  [
    getSetComputeUnitLimitInstruction({ units: 500_000 }),
    verifyInstruction,
  ],
  setTransactionMessageLifetimeUsingBlockhash(
    latestBlockhash,
    setTransactionMessageFeePayerSigner(wallet, createTransactionMessage({ version: 0 })),
  ),
);

const signed = await signTransactionMessageWithSigners(tx);
const sendAndConfirm = sendAndConfirmTransactionFactory({ rpc, rpcSubscriptions });
await sendAndConfirm(signed, { commitment: "confirmed" });

just verify-one

[package]
name = "smt_exclusion"
type = "bin"
authors = [""]

[dependencies]
poseidon = { tag = "v0.1.1", git = "https://github.com/noir-lang/poseidon" }

use dep::poseidon::poseidon::bn254::hash_2 as poseidon_hash;

fn poseidon_hash_2(left: Field, right: Field) -> Field {
    poseidon_hash([left, right])
}

#[test]
fn test_poseidon_circom_compatible() {
    let h12 = poseidon_hash_2(1, 2);
    let expected: Field = 0x115cc0f5e7d690413df64c6b9662e9cf2a3617f2743245519e19607a4417189a;
    assert(h12 == expected, "Poseidon hash does not match circomlibjs");
}

use dep::poseidon::poseidon::bn254::hash_2 as poseidon_hash;

global TREE_DEPTH: u32 = 254;
global EMPTY_LEAF: Field = 0;

fn poseidon_hash_2(left: Field, right: Field) -> Field {
    poseidon_hash([left, right])
}

// Split a 32-byte pubkey into two 16-byte halves and hash them.
// This is the "pubkey to leaf index" function, matched by `sol_poseidon`
// on-chain.
pub fn pubkey_to_index(pubkey: [u8; 32]) -> Field {
    let low = bytes16_to_field(pubkey, 0);
    let high = bytes16_to_field(pubkey, 16);
    poseidon_hash_2(low, high)
}

fn compute_merkle_root<let N: u32>(
    leaf: Field,
    path_bits: [u1; N],
    siblings: [Field; N],
) -> Field {
    let mut current = leaf;
    for i in 0..N {
        let (left, right) = if path_bits[i] == 0 {
            (current, siblings[i])
        } else {
            (siblings[i], current)
        };
        current = poseidon_hash_2(left, right);
    }
    current
}

fn main(
    smt_root: pub Field,      // Public: committed on-chain
    pubkey_hash: pub Field,   // Public: bound to the signer on-chain
    pubkey: [u8; 32],         // Private: the actual pubkey
    siblings: [Field; TREE_DEPTH],  // Private: the Merkle path
    leaf_value: Field,        // Private: must be 0 for exclusion
) {
    // 1. Prove pubkey hashes to the claimed public hash.
    let computed_hash = pubkey_to_index(pubkey);
    assert(computed_hash == pubkey_hash, "Pubkey hash mismatch");

    // 2. Path through the tree is determined by the pubkey hash bits.
    let path_bits: [u1; TREE_DEPTH] = computed_hash.to_le_bits();

    // 3. Prove the leaf at this position is empty.
    assert(leaf_value == EMPTY_LEAF, "Exclusion failed: leaf is not empty");

    // 4. Prove the path reconstructs to the committed root.
    let computed_root = compute_merkle_root(leaf_value, path_bits, siblings);
    assert(computed_root == smt_root, "Root mismatch: invalid merkle proof");
}

cd circuits/smt_exclusion
nargo test
just setup-smt

use solana_poseidon::{hashv, Endianness, Parameters};
use solana_program::{
    instruction::Instruction,
    program::invoke,
    pubkey::Pubkey,
};

pub const ZK_VERIFIER_PROGRAM_ID: Pubkey =
    solana_program::pubkey!("548u4SFWZMaRWZQqdyAgm66z7VRYtNHHF2sr7JTBXbwN");

fn process_transfer_sol(accounts: &[AccountInfo], data: &[u8]) -> ProgramResult {
    // Instruction data layout: 8 (amount) + 388 (proof) + 76 (witness)
    if data.len() != 8 + 388 + 76 {
        return Err(ExclusionError::InvalidDataLength.into());
    }

    let amount = u64::from_le_bytes(data[0..8].try_into().unwrap());
    let proof_data = &data[8..8 + 388];
    let witness_data = &data[8 + 388..];

    // 1. Check the witness commits to the correct SMT root.
    let witness_smt_root = &witness_data[12..44];
    if witness_smt_root != stored_smt_root {
        return Err(ExclusionError::SmtRootMismatch.into());
    }

    // 2. Recompute the signer's pubkey_hash with sol_poseidon and check
    //    the witness commits to the same value. SIMD-0359 requires every
    //    input slice to be exactly 32 bytes; zero-pad the 16-byte halves.
    let pubkey_bytes = sender.key.as_ref();
    let mut low_padded = [0u8; 32];
    low_padded[..16].copy_from_slice(&pubkey_bytes[0..16]);
    let mut high_padded = [0u8; 32];
    high_padded[..16].copy_from_slice(&pubkey_bytes[16..32]);

    let computed_hash = hashv(
        Parameters::Bn254X5,
        Endianness::LittleEndian,
        &[&low_padded, &high_padded],
    )
    .map_err(|_| ExclusionError::PoseidonHashFailed)?;

    // sol_poseidon with LittleEndian outputs little-endian bytes;
    // gnark emits big-endian in the witness. Reverse before comparing.
    let computed_bytes = computed_hash.to_bytes();
    let mut computed_be = [0u8; 32];
    for i in 0..32 {
        computed_be[i] = computed_bytes[31 - i];
    }

    let witness_pubkey_hash = &witness_data[44..76];
    if witness_pubkey_hash != computed_be {
        return Err(ExclusionError::PubkeyHashMismatch.into());
    }

    // 3. CPI to the ZK verifier program. Accounts list is empty —
    //    the verifier has no state, only the baked-in verifying key.
    let mut verifier_data = Vec::with_capacity(388 + 76);
    verifier_data.extend_from_slice(proof_data);
    verifier_data.extend_from_slice(witness_data);

    let verify_ix = Instruction {
        program_id: ZK_VERIFIER_PROGRAM_ID,
        accounts: vec![],
        data: verifier_data,
    };
    invoke(&verify_ix, &[])?;

    // 4. Verification succeeded — run the rest of the logic.
    invoke(
        &system_instruction::transfer(sender.key, recipient.key, amount),
        &[sender.clone(), recipient.clone(), system_program.clone()],
    )?;

    Ok(())
}

import { generateProof } from "./proof.helper";

const proofResult = generateProof(circuitConfig, {
  smt_root: currentRoot,
  pubkey_hash: pubkeyHash,
  pubkey: pubkeyBytes,
  siblings: merklePath,
  leaf_value: "0",  // proving non-inclusion
});

// Instruction layout matches process_instruction's dispatch:
//   data[0]      = opcode (2 = TRANSFER_SOL)
//   data[1..9]   = amount (u64 LE)
//   data[9..397] = Groth16 proof (388 bytes)
//   data[397..]  = public witness (76 bytes)
const TRANSFER_SOL_OPCODE = 2;
const transferData = Buffer.concat([
  Buffer.from([TRANSFER_SOL_OPCODE]),
  toLeBytes(amountLamports, 8),
  proofResult.proof,
  proofResult.publicWitness,
]);

just test-transfer-smt

const RPC_URL = process.env.RPC_URL || "YOUR_CHAINSTACK_RPC_ENDPOINT";
const WS_URL = process.env.WS_URL || "YOUR_CHAINSTACK_WSS_ENDPOINT";

export RPC_URL="https://solana-devnet.core.chainstack.com/YOUR_KEY"
export WS_URL="wss://solana-devnet.core.chainstack.com/YOUR_KEY"
just verify-one
just test-transfer-smt

solana config set --url "$RPC_URL"
solana program deploy target/verifier.so

let mut low_padded = [0u8; 32];
low_padded[..16].copy_from_slice(&pubkey_bytes[0..16]);
let mut high_padded = [0u8; 32];
high_padded[..16].copy_from_slice(&pubkey_bytes[16..32]);
let computed_hash = hashv(
    Parameters::Bn254X5,
    Endianness::LittleEndian,
    &[&low_padded, &high_padded],
)?;