Meta: Minimal Tx with ether + Minimal ERC20 interaction - Milestone-1

[CPerezz]

Goal

The final goal of the Milestone-1 is to have a ZKEVM PoC that is able to:

• Send a minimal transaction with ETH
• Be able to interact with a minimal ERC20 contract.

Relaxation

The following features are postponed to further milestones:

• EIP1559 dynamic block gas limit and basefee calculation
• EIP2930 tx level access list
• Tx Trie
• Receipt Trie.

There are also some pieces required for this PoC which are being currently implemented and will probably be mocked at the beginning until we can fully integrate them. They are marked with (*) in the list of tasks. For example:

• Keccak circuit + Padding + state incrementally update implementation
• MPT circuit + single-key update implementation
• ECDSA circuit
• Aggregator circuit

TO DO list:

• Circuit
  • ZKEVM circuit
    • EVM circuit
      • Execution result implementation
        • BeginTx: Implement ExecutionState::BeginTx #230
        • CALL: (spec: Spec ExecutionState::CALL zkevm-specs#82, circuit: Implementation ExecutionState::CALL #278)
        • EndTx (Specs: Spec ExecutionState::{EndTx,EndBlock} zkevm-specs#88) Implement ExecutionState::EndTx #312
        • STOP Execution of calling to account with empty code zkevm-specs#146 (spec PR, circuit PR)
        • RETURN (spec issue, circuit issue)
        • SHA3 (spec issue, circuit issue)
        • EndBlock (Currently we have a placeholder) (maybe this step can be generated in the circuit witness converter phase) (circuit issue)
        • CircuitInputBuilder: generate CircuitSteps not associated with GethExecSteps (
    • State circuit (@z2trillion and @DreamWuGit are working on this) (meta issue)
      • Consistency check implementation (Finish all target of read-write consistency check zkevm-specs#64)
      • Implement updated specs Redo spec of state circuit zkevm-specs#118
        • TxAccessListAccount good first issue
        • TxRefund good first issue
        • Account good first issue
        • CallContext bus-mapping: Implement CallContextOp #225 good first issue
        • Stack
        • Memory
        • Storage
      • (*) State trie incrementally update implementation (connection to MPT circuit) using https://github.com/miha-stopar/mpt
    • Bytecode circuit
      • Bytecode hash check implementation
    • Tx circuit (Specs needed: Transaction signature verification zkevm-specs#65)
      • (*) 0x32: ORIGIN: tx lookup, stack push ORIGIN opcode #360
      • (*) 0x3A: GASPRICE: tx lookup, stack push Implement Gasprice opcode and gadget #422
      • (*) Tx hash check implementation
      • Signature check implementation
    • (*) ECDSA circuit
      • ECDSA chip implementation for signature verification: https://github.com/appliedzkp/halo2wrong/blob/master/ecdsa/src/ecdsa.rs
    • (*) MPT circuit (@miha-stopar and @ChihChengLiang are working on this)
      • MPT single-key update implementation: [WIP] Merkle Patricia Trie #253
    • (*) Keccak256 circuit (@CPerezz and @ChihChengLiang are working on this)
      • Keccak state incrementally update implementation: Meta: Finish Keccak state incrementally update implementation #276
  • (*) Aggregation circuit (Pending to create a crate for it once ECDSA is finished). (@han0110 and @scroll-dev are working on this)
• Solidity verifier (@pinkiebell is working on this)
  • Aggregation circuit proof verification
  • circuit input generator
    • calldata
    • block constants
  • (*) Deposit
• Prover
  • Witness generation Meta: CircuitInputBuilder progress status #222
  • Prover benchmarking
• (*) Deposits / Withdraws (@pinkiebell is working on this)
• PublicInputs Circuit (@davidnevadoc is working on this) (spec PR, circuit issue)

First iteration

Milestone 0 will be the first iteration where we apply the relaxations mentioned above by mocking some modules.

Overview

• evm circuit
  • state circuit
    • mock mpt circuit
  • tx circuit
    • hashes not proved
    • mock signature circuit

Instead of aggregating all the circuits above with an aggregation circuit to generate a single proof, we consider the proof to be the list of circuit proofs, and its verification the verification of each proof individually.

Since we won't yet have smart contracts in L2, we skip the deposit/withdrawal functionality that moves ETH from L1 to L2. We can set some accounts with positive balance in the L2 genesis to test the transfers.

The L1 contract will receive the list of proofs for a block, prepare all the public inputs (and build necessary tables) and verify each proof. It will also calculate the hash for each tx to pass as public inputs.

[barryWhiteHat]

@ed255 can you confirm the tx circuit part is all done ? I marked them as finished just now ;)

[CPerezz]

@ed255 can you confirm the tx circuit part is all done ? I marked them as finished just now ;)

Lacks keccak integration for sure(has a placeholder now).
I think nothing else aside. But @ed255 can you confirm?

[ed255]

@ed255 can you confirm the tx circuit part is all done ? I marked them as finished just now ;)

That's correct! The Tx Circuit is done :)

As @CPerezz says, the Tx Circuit is currently not connected to the keccak; but I think this applies to all circuits that do lookups to other circuits, and I guess this will depend on the aggregation circuit.