replaced instances of eta*eta and eta*eta*eta with independent challe…

…nges (for Honk not Plonk)

compiler nits

increased grumpkin points

proof system tests fix

barretenberg/cpp/bootstrap.sh

@@ -58,7 +58,7 @@ cmake --build --preset $PRESET --target bb
 if [ ! -d ./srs_db/grumpkin ]; then
   # The Grumpkin SRS is generated manually at the moment, only up to a large enough size for tests
   # If tests require more points, the parameter can be increased here.
-  (cd ./build && cmake --build . --parallel --target grumpkin_srs_gen && ./bin/grumpkin_srs_gen 8192)
+  (cd ./build && cmake --build . --parallel --target grumpkin_srs_gen && ./bin/grumpkin_srs_gen 16384)
 fi
 
 # Install wasi-sdk.

barretenberg/cpp/src/barretenberg/flavor/ultra.hpp

@@ -55,7 +55,7 @@ class UltraFlavor {
     static constexpr size_t MAX_PARTIAL_RELATION_LENGTH = compute_max_partial_relation_length<Relations>();
     static_assert(MAX_PARTIAL_RELATION_LENGTH == 6);
     static constexpr size_t MAX_TOTAL_RELATION_LENGTH = compute_max_total_relation_length<Relations>();
-    static_assert(MAX_TOTAL_RELATION_LENGTH == 12);
+    static_assert(MAX_TOTAL_RELATION_LENGTH == 11);
     static constexpr size_t NUM_SUBRELATIONS = compute_number_of_subrelations<Relations>();
     // For instances of this flavour, used in folding, we need a unique sumcheck batching challenge for each
     // subrelation. This is because using powers of alpha would increase the degree of Protogalaxy polynomial $G$ (the

barretenberg/cpp/src/barretenberg/flavor/ultra_recursive.hpp

@@ -81,7 +81,7 @@ template <typename BuilderType> class UltraRecursiveFlavor_ {
     static constexpr size_t MAX_PARTIAL_RELATION_LENGTH = compute_max_partial_relation_length<Relations>();
     static_assert(MAX_PARTIAL_RELATION_LENGTH == 6);
     static constexpr size_t MAX_TOTAL_RELATION_LENGTH = compute_max_total_relation_length<Relations>();
-    static_assert(MAX_TOTAL_RELATION_LENGTH == 12);
+    static_assert(MAX_TOTAL_RELATION_LENGTH == 11);
 
     // BATCHED_RELATION_PARTIAL_LENGTH = algebraic degree of sumcheck relation *after* multiplying by the `pow_zeta`
     // random polynomial e.g. For \sum(x) [A(x) * B(x) + C(x)] * PowZeta(X), relation length = 2 and random relation

barretenberg/cpp/src/barretenberg/proof_system/circuit_builder/ultra_circuit_builder.cpp

@@ -2551,7 +2551,7 @@ template <typename Arithmetization> void UltraCircuitBuilder_<Arithmetization>::
         // generate the `eta` challenge, we'll use `memory_records` to figure out which gates need a record wire
         // value
         // to be computed.
-        // record (w4) = w3 * eta^3 + w2 * eta^2 + w1 * eta + read_write_flag (0 for reads, 1 for writes)
+        // record (w4) = w3 * eta_three + w2 * eta_two + w1 * eta + read_write_flag (0 for reads, 1 for writes)
         // Separate containers used to store gate indices of reads and writes. Need to differentiate because of
         // `read_write_flag` (N.B. all ROM accesses are considered reads. Writes are for RAM operations)
         memory_read_records.push_back(static_cast<uint32_t>(sorted_record.gate_index));
@@ -3037,7 +3037,9 @@ inline typename Arithmetization::FF UltraCircuitBuilder_<Arithmetization>::compu
     FF w_4_shifted_value,
     FF alpha_base,
     FF alpha,
-    FF eta) const
+    FF eta,
+    FF eta_two,
+    FF eta_three) const
 {
     constexpr FF LIMB_SIZE(uint256_t(1) << DEFAULT_NON_NATIVE_FIELD_LIMB_BITS);
     // TODO(kesha): Replace with a constant defined in header
@@ -3131,7 +3133,7 @@ inline typename Arithmetization::FF UltraCircuitBuilder_<Arithmetization>::compu
      *  * i: `index` of memory cell being accessed
      *  * v: `value1` of memory cell being accessed (ROM tables can store up to 2 values per index)
      *  * v2:`value2` of memory cell being accessed (ROM tables can store up to 2 values per index)
-     *  * r: `record` of memory cell. record = index * eta + value2 * eta^2 + value1 * eta^3
+     *  * r: `record` of memory cell. record = index * eta + value2 * eta_two + value1 * eta_three
      *
      *  When performing a read/write access, the values of i, t, v, v2, a, r are stored in the following wires +
      * selectors, depending on whether the gate is a RAM read/write or a ROM read
@@ -3155,17 +3157,14 @@ inline typename Arithmetization::FF UltraCircuitBuilder_<Arithmetization>::compu
      *
      * A ROM/ROM access gate can be evaluated with the identity:
      *
-     * qc + w1 \eta + w2 \eta^2 + w3 \eta^3 - w4 = 0
+     * qc + w1 \eta + w2 \eta_two + w3 \eta_three - w4 = 0
      *
      * For ROM gates, qc = 0
      */
 
-    FF memory_record_check = w_3_value;
-    memory_record_check *= eta;
-    memory_record_check += w_2_value;
-    memory_record_check *= eta;
-    memory_record_check += w_1_value;
-    memory_record_check *= eta;
+    FF memory_record_check = w_3_value * eta_three;
+    memory_record_check += w_2_value * eta_two;
+    memory_record_check += w_1_value * eta;
     memory_record_check += q_c_value;
     FF partial_record_check = memory_record_check; // used in RAM consistency check
     memory_record_check = memory_record_check - w_4_value;
@@ -3204,7 +3203,7 @@ inline typename Arithmetization::FF UltraCircuitBuilder_<Arithmetization>::compu
      * RAM Consistency Check
      *
      * The 'access' type of the record is extracted with the expression `w_4 - partial_record_check`
-     * (i.e. for an honest Prover `w1 * eta + w2 * eta^2 + w3 * eta^3 - w4 = access`.
+     * (i.e. for an honest Prover `w1 * eta + w2 * eta_two + w3 * eta_three - w4 = access`.
      * This is validated by requiring `access` to be boolean
      *
      * For two adjacent entries in the sorted list if _both_
@@ -3222,12 +3221,9 @@ inline typename Arithmetization::FF UltraCircuitBuilder_<Arithmetization>::compu
     FF access_check = access_type.sqr() - access_type;   // check value is 0 or 1
 
     // TODO: oof nasty compute here. If we sorted in reverse order we could re-use `partial_record_check`
-    FF next_gate_access_type = w_3_shifted_value;
-    next_gate_access_type *= eta;
-    next_gate_access_type += w_2_shifted_value;
-    next_gate_access_type *= eta;
-    next_gate_access_type += w_1_shifted_value;
-    next_gate_access_type *= eta;
+    FF next_gate_access_type = w_3_shifted_value * eta_three;
+    next_gate_access_type += w_2_shifted_value * eta_two;
+    next_gate_access_type += w_1_shifted_value * eta;
     next_gate_access_type = w_4_shifted_value - next_gate_access_type;
 
     FF value_delta = w_3_shifted_value - w_3_value;
@@ -3307,6 +3303,8 @@ template <typename Arithmetization> bool UltraCircuitBuilder_<Arithmetization>::
     const FF auxillary_base = FF::random_element();
     const FF alpha = FF::random_element();
     const FF eta = FF::random_element();
+    const FF eta_two = FF::random_element();
+    const FF eta_three = FF::random_element();
 
     // We need to get all memory
     std::unordered_set<size_t> memory_read_record_gates;
@@ -3420,10 +3418,10 @@ template <typename Arithmetization> bool UltraCircuitBuilder_<Arithmetization>::
 
         // If we are touching a gate with memory access, we need to update the value of the 4th witness
         if (memory_read_record_gates.contains(i)) {
-            w_4_value = ((w_3_value * eta + w_2_value) * eta + w_1_value) * eta;
+            w_4_value = w_3_value * eta_three + w_2_value * eta_two + w_1_value * eta;
         }
         if (memory_write_record_gates.contains(i)) {
-            w_4_value = ((w_3_value * eta + w_2_value) * eta + w_1_value) * eta + FF::one();
+            w_4_value = w_3_value * eta_three + w_2_value * eta_two + w_1_value * eta + FF::one();
         }
         // Now we can update the tag product for w_4
         update_tag_check_information((uint32_t)w_4_index, w_4_value);
@@ -3443,11 +3441,11 @@ template <typename Arithmetization> bool UltraCircuitBuilder_<Arithmetization>::
             w_4_shifted_value = FF::zero();
         }
         if (memory_read_record_gates.contains(i + 1)) {
-            w_4_shifted_value = ((w_3_shifted_value * eta + w_2_shifted_value) * eta + w_1_shifted_value) * eta;
+            w_4_shifted_value = w_3_shifted_value * eta_three + w_2_shifted_value * eta_two + w_1_shifted_value * eta;
         }
         if (memory_write_record_gates.contains(i + 1)) {
             w_4_shifted_value =
-                ((w_3_shifted_value * eta + w_2_shifted_value) * eta + w_1_shifted_value) * eta + FF::one();
+                w_3_shifted_value * eta_three + w_2_shifted_value * eta_two + w_1_shifted_value * eta + FF::one();
         }
         if (!compute_arithmetic_identity(q_arith_value,
                                          q_1_value,
@@ -3489,7 +3487,9 @@ template <typename Arithmetization> bool UltraCircuitBuilder_<Arithmetization>::
                                        w_4_shifted_value,
                                        auxillary_base,
                                        alpha,
-                                       eta)
+                                       eta,
+                                       eta_two,
+                                       eta_three)
                  .is_zero()) {
 #ifndef FUZZING
             info("Auxilary identity fails at gate ", i);

barretenberg/cpp/src/barretenberg/proof_system/circuit_builder/ultra_circuit_builder.hpp

@@ -1151,7 +1151,9 @@ class UltraCircuitBuilder_ : public CircuitBuilderBase<typename Arithmetization:
                                  FF w_4_shifted_value,
                                  FF alpha_base,
                                  FF alpha,
-                                 FF eta) const;
+                                 FF eta,
+                                 FF eta_two,
+                                 FF eta_three) const;
     FF compute_elliptic_identity(FF q_elliptic_value,
                                  FF q_1_value,
                                  FF q_m_value,

barretenberg/cpp/src/barretenberg/proof_system/library/grand_product_library.test.cpp

@@ -227,9 +227,13 @@ template <class FF> class GrandProductTests : public testing::Test {
         auto beta = FF::random_element();
         auto gamma = FF::random_element();
         auto eta = FF::random_element();
+        auto eta_two = FF::random_element();
+        auto eta_three = FF::random_element();
 
         RelationParameters<FF> params{
             .eta = eta,
+            .eta_two = eta_two,
+            .eta_three = eta_three,
             .beta = beta,
             .gamma = gamma,
             .public_input_delta = 1,
@@ -266,8 +270,6 @@ template <class FF> class GrandProductTests : public testing::Test {
         //                                   ∏(s_k + βs_{k+1} + γ(1 + β))
         //
         // in a way that is simple to read (but inefficient). See prover library method for more details.
-        const FF eta_sqr = eta.sqr();
-        const FF eta_cube = eta_sqr * eta;
 
         std::array<Polynomial, 4> accumulators;
         for (size_t i = 0; i < 4; ++i) {
@@ -279,22 +281,22 @@ template <class FF> class GrandProductTests : public testing::Test {
         // Note: block_mask is used for efficient modulus, i.e. i % N := i & (N-1), for N = 2^k
         const size_t block_mask = circuit_size - 1;
         // Initialize 't(X)' to be used in an expression of the form t(X) + β*t(Xω)
-        FF table_i = tables[0][0] + tables[1][0] * eta + tables[2][0] * eta_sqr + tables[3][0] * eta_cube;
+        FF table_i = tables[0][0] + tables[1][0] * eta + tables[2][0] * eta_two + tables[3][0] * eta_three;
         for (size_t i = 0; i < circuit_size; ++i) {
             size_t shift_idx = (i + 1) & block_mask;
 
             // f = (w_1 + q_2*w_1(Xω)) + η(w_2 + q_m*w_2(Xω)) + η²(w_3 + q_c*w_3(Xω)) + η³q_index.
             FF f_i = (wires[0][i] + wires[0][shift_idx] * column_1_step_size[i]) +
                      (wires[1][i] + wires[1][shift_idx] * column_2_step_size[i]) * eta +
-                     (wires[2][i] + wires[2][shift_idx] * column_3_step_size[i]) * eta_sqr +
-                     eta_cube * lookup_index_selector[i];
+                     (wires[2][i] + wires[2][shift_idx] * column_3_step_size[i]) * eta_two +
+                     eta_three * lookup_index_selector[i];
 
             // q_lookup * f + γ
             accumulators[0][i] = lookup_selector[i] * f_i + gamma;
 
             // t = t_1 + ηt_2 + η²t_3 + η³t_4
-            FF table_i_plus_1 = tables[0][shift_idx] + eta * tables[1][shift_idx] + eta_sqr * tables[2][shift_idx] +
-                                eta_cube * tables[3][shift_idx];
+            FF table_i_plus_1 = tables[0][shift_idx] + eta * tables[1][shift_idx] + eta_two * tables[2][shift_idx] +
+                                eta_three * tables[3][shift_idx];
 
             // t + βt(Xω) + γ(1 + β)
             accumulators[1][i] = table_i + table_i_plus_1 * beta + gamma * (FF::one() + beta);

barretenberg/cpp/src/barretenberg/protogalaxy/combiner.test.cpp

@@ -50,10 +50,10 @@ TEST(Protogalaxy, CombinerOn2Instances)
             }
 
             ProverInstances instances{ instance_data };
-            instances.alphas.fill(bb::Univariate<FF, 13>(FF(0))); // focus on the arithmetic relation only
+            instances.alphas.fill(bb::Univariate<FF, 12>(FF(0))); // focus on the arithmetic relation only
             auto pow_polynomial = PowPolynomial(std::vector<FF>{ 2 });
             auto result = prover.compute_combiner(instances, pow_polynomial);
-            auto expected_result = Univariate<FF, 13>(std::array<FF, 13>{ 87706,
+            auto expected_result = Univariate<FF, 12>(std::array<FF, 12>{ 87706,
                                                                           13644570,
                                                                           76451738,
                                                                           226257946,
@@ -65,7 +65,7 @@ TEST(Protogalaxy, CombinerOn2Instances)
                                                                           static_cast<uint64_t>(5066004250),
                                                                           static_cast<uint64_t>(6881768346),
                                                                           static_cast<uint64_t>(9086521370),
-                                                                          static_cast<uint64_t>(11718012058) });
+                                                                          /*static_cast<uint64_t>(11718012058)*/ });
             EXPECT_EQ(result, expected_result);
         } else {
             std::vector<std::shared_ptr<ProverInstance>> instance_data(NUM_INSTANCES);
@@ -82,7 +82,7 @@ TEST(Protogalaxy, CombinerOn2Instances)
             }
 
             ProverInstances instances{ instance_data };
-            instances.alphas.fill(bb::Univariate<FF, 13>(FF(0))); // focus on the arithmetic relation only
+            instances.alphas.fill(bb::Univariate<FF, 12>(FF(0))); // focus on the arithmetic relation only
 
             const auto create_add_gate = [](auto& polys, const size_t idx, FF w_l, FF w_r) {
                 polys.w_l[idx] = w_l;
@@ -131,7 +131,7 @@ TEST(Protogalaxy, CombinerOn2Instances)
             auto pow_polynomial = PowPolynomial(std::vector<FF>{ 2 });
             auto result = prover.compute_combiner(instances, pow_polynomial);
             auto expected_result =
-                Univariate<FF, 13>(std::array<FF, 13>{ 0, 0, 12, 36, 72, 120, 180, 252, 336, 432, 540, 660, 792 });
+                Univariate<FF, 12>(std::array<FF, 12>{ 0, 0, 12, 36, 72, 120, 180, 252, 336, 432, 540, 660 /*, 792*/ });
 
             EXPECT_EQ(result, expected_result);
         }
@@ -172,7 +172,7 @@ TEST(Protogalaxy, CombinerOn4Instances)
         }
 
         ProverInstances instances{ instance_data };
-        instances.alphas.fill(bb::Univariate<FF, 43>(FF(0))); // focus on the arithmetic relation only
+        instances.alphas.fill(bb::Univariate<FF, 40>(FF(0))); // focus on the arithmetic relation only
 
         zero_all_selectors(instances[0]->prover_polynomials);
         zero_all_selectors(instances[1]->prover_polynomials);
@@ -181,9 +181,9 @@ TEST(Protogalaxy, CombinerOn4Instances)
 
         auto pow_polynomial = PowPolynomial(std::vector<FF>{ 2 });
         auto result = prover.compute_combiner(instances, pow_polynomial);
-        std::array<FF, 43> zeroes;
+        std::array<FF, 40> zeroes;
         std::fill(zeroes.begin(), zeroes.end(), 0);
-        auto expected_result = Univariate<FF, 43>(zeroes);
+        auto expected_result = Univariate<FF, 40>(zeroes);
         EXPECT_EQ(result, expected_result);
     };
     run_test();

barretenberg/cpp/src/barretenberg/protogalaxy/protogalaxy_prover.cpp

@@ -55,8 +55,9 @@ void ProtoGalaxyProver_<ProverInstances>::finalise_and_send_instance(std::shared
                                      instance->witness_commitments.calldata_read_counts);
     }
 
-    auto eta = transcript->template get_challenge<FF>(domain_separator + "_eta");
-    instance->compute_sorted_accumulator_polynomials(eta);
+    auto [eta, eta_two, eta_three] = transcript->template get_challenges<FF>(
+        domain_separator + "_eta", domain_separator + "_eta_two", domain_separator + "_eta_three");
+    instance->compute_sorted_accumulator_polynomials(eta, eta_two, eta_three);
 
     // Commit to the sorted withness-table accumulator and the finalized (i.e. with memory records) fourth wire
     // polynomial
@@ -253,6 +254,8 @@ std::shared_ptr<typename ProverInstances::Instance> ProtoGalaxyProver_<ProverIns
     auto& combined_relation_parameters = instances.relation_parameters;
     auto folded_relation_parameters = bb::RelationParameters<FF>{
         combined_relation_parameters.eta.evaluate(challenge),
+        combined_relation_parameters.eta_two.evaluate(challenge),
+        combined_relation_parameters.eta_three.evaluate(challenge),
         combined_relation_parameters.beta.evaluate(challenge),
         combined_relation_parameters.gamma.evaluate(challenge),
         combined_relation_parameters.public_input_delta.evaluate(challenge),

barretenberg/cpp/src/barretenberg/protogalaxy/protogalaxy_verifier.cpp

@@ -45,7 +45,8 @@ void ProtoGalaxyVerifier_<VerifierInstances>::receive_and_finalise_instance(cons
     }
 
     // Get challenge for sorted list batching and wire four memory records commitment
-    auto eta = transcript->template get_challenge<FF>(domain_separator + "_eta");
+    auto [eta, eta_two, eta_three] = transcript->template get_challenges<FF>(
+        domain_separator + "_eta", domain_separator + "_eta_two", domain_separator + "_eta_three");
     witness_commitments.sorted_accum =
         transcript->template receive_from_prover<Commitment>(domain_separator + "_" + labels.sorted_accum);
     witness_commitments.w_4 = transcript->template receive_from_prover<Commitment>(domain_separator + "_" + labels.w_4);
@@ -70,7 +71,7 @@ void ProtoGalaxyVerifier_<VerifierInstances>::receive_and_finalise_instance(cons
         inst->public_inputs, beta, gamma, inst->instance_size, inst->pub_inputs_offset);
     const FF lookup_grand_product_delta = compute_lookup_grand_product_delta<FF>(beta, gamma, inst->instance_size);
     inst->relation_parameters =
-        RelationParameters<FF>{ eta, beta, gamma, public_input_delta, lookup_grand_product_delta };
+        RelationParameters<FF>{ eta, eta_two, eta_three, beta, gamma, public_input_delta, lookup_grand_product_delta };
 
     // Get the relation separation challenges
     for (size_t idx = 0; idx < NUM_SUBRELATIONS - 1; idx++) {
@@ -200,6 +201,8 @@ std::shared_ptr<typename VerifierInstances::Instance> ProtoGalaxyVerifier_<Verif
     for (size_t inst_idx = 0; inst_idx < VerifierInstances::NUM; inst_idx++) {
         auto instance = instances[inst_idx];
         expected_parameters.eta += instance->relation_parameters.eta * lagranges[inst_idx];
+        expected_parameters.eta_two += instance->relation_parameters.eta_two * lagranges[inst_idx];
+        expected_parameters.eta_three += instance->relation_parameters.eta_three * lagranges[inst_idx];
         expected_parameters.beta += instance->relation_parameters.beta * lagranges[inst_idx];
         expected_parameters.gamma += instance->relation_parameters.gamma * lagranges[inst_idx];
         expected_parameters.public_input_delta +=