{"id":21524512,"url":"https://github.com/tokamak-network/DEPRECATED-circom-ethereum-opcodes","last_synced_at":"2025-10-05T11:31:15.619Z","repository":{"id":49764621,"uuid":"517937800","full_name":"tokamak-network/DEPRECATED-circom-ethereum-opcodes","owner":"tokamak-network","description":"Circom circuits of Ethereum arithmetic and bitwise operators","archived":true,"fork":false,"pushed_at":"2025-02-01T10:25:57.000Z","size":1666,"stargazers_count":20,"open_issues_count":3,"forks_count":8,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-05-26T19:06:20.541Z","etag":null,"topics":["circom","ethereum-assembly","zero-knowledge"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tokamak-network.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-07-26T06:18:47.000Z","updated_at":"2025-05-02T10:44:35.000Z","dependencies_parsed_at":"2024-03-11T03:26:43.029Z","dependency_job_id":"6a30bc65-393d-41b2-b9e6-eb1a963080cb","html_url":"https://github.com/tokamak-network/DEPRECATED-circom-ethereum-opcodes","commit_stats":null,"previous_names":["tokamak-network/deprecated-circom-ethereum-opcodes"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/tokamak-network/DEPRECATED-circom-ethereum-opcodes","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tokamak-network%2FDEPRECATED-circom-ethereum-opcodes","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tokamak-network%2FDEPRECATED-circom-ethereum-opcodes/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tokamak-network%2FDEPRECATED-circom-ethereum-opcodes/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tokamak-network%2FDEPRECATED-circom-ethereum-opcodes/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tokamak-network","download_url":"https://codeload.github.com/tokamak-network/DEPRECATED-circom-ethereum-opcodes/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tokamak-network%2FDEPRECATED-circom-ethereum-opcodes/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278445706,"owners_count":25988037,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-05T02:00:06.059Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["circom","ethereum-assembly","zero-knowledge"],"created_at":"2024-11-24T01:27:17.608Z","updated_at":"2025-10-05T11:31:15.612Z","avatar_url":"https://github.com/tokamak-network.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Deprecated\nThere will be no update on this repository. Go to [qap-compiler](https://github.com/tokamak-network/Tokamak-zk-EVM/tree/main/packages/frontend/qap-compiler). \n# circom-ethereum-opcodes\n\nCircom circuit set of the Ethereum opcodes\n\n## Goal\n\nTokamak team is working toward a zk-EVM which is capable to execute EVM bytecode and generate a zk-SNARK proof based on our SNARK paper \"[An Efficient SNARK for Field-Programmable and RAM Circuits\n](https://eprint.iacr.org/2024/507)\".\nThe original Groth16 requires high cost \"setup\" for every single transaction since it is a circuit-speicific SNARK. On the other hand, universal SNARKs such as Plonk would be enough with just a single setup but the existing protocols cause humongous computation overhead in proving and verifying algorithm.\n\nEvery transaction might execute different functions with different arguments but all the execution steps can be broken down into the EVM opcode set; the executed opcodes should be in the EVM instruction set even though the order of opcode execution would be different.\n\nOur approach is to take advantage of those two different types of SNARK protocols by assembling each EVM opcode circuit in the order of executions by a transaction; it would be fast to prove and verify like circuit-speicific SNARKs and require only a single setup phase similar to universal SNARKs. It is enough to make setups for the EVM opcode circuits, rather than you need setups everytime transaction occurs. This allows us to make all transactions zk-provable after a single of the setup phase, using [Tokamak-ZkEVM](https://github.com/tokamak-network/Tokamak-ZkEVM) without any huge sacrifice in terms of cost to prove or verify.\n\nThis repository aims to implement zk-SNARK provable circuits of the EVM instruction set along Tokamak zk-EVM plan.\n\n## Directory tree\n\n```text\ncircuits\n├── templates\n│   ├── 128bit\n│   │   ├── adder.circom\n│   │   ├── divider.circom\n│   │   ├── exp.circom\n│   │   └── multiplier.circom\n│   ├── arithmetic_func.circom\n│   ├── bit_extractor.circom\n│   ├── comparators.circom\n│   ├── divider.circom\n│   └── two_to_the_power_of_n.circom\n├── add.circom\n├── addmod.circom\n├── and.circom\n├── byte.circom\n├── div.circom\n├── eq.circom\n├── exp.circom\n├── gt.circom\n├── iszero.circom\n├── load.circom\n├── lt.circom\n├── mod.circom\n├── mul.circom\n├── mulmod.circom\n├── not.circom\n├── or.circom\n├── sar.circom\n├── sdiv.circom\n├── sgt.circom\n├── sha3.circom\n├── shl.circom\n├── shr.circom\n├── signextend.circom\n├── slt.circom\n├── smod.circom\n├── sub.circom\n└── xor.circom\n```\n\n- `templates`: The set of circuits and functions frequently used by the sub-circuits. The circuits under `128bit` assume to take 128-bit length values.\n\n## Circuit design\n\nThe circuits are implemented following the instruction definitions in Ethereum yellow paper.\n\nTo learn more about Circom, please check [the official document](https://docs.circom.io/).\n\n### Input\n\nThe circuits take one or multiple input signals such as \"`in1`\" or \"`in2`\".\n\nDue to limitation where the Circom's finite field prime (BN128) is 254-bit sized value, each circuit takes two 128-bit length values to be compatible with 32-byte words.\n\nSigned integers are represented as two's complements.\n\n### Output\n\nAll the opcode circuits return a single output except `load` for a special use.\n\nThe circuits returns two 128-bit values as output signals.\n\n### Number of constraints per opcode\n|Arithmetic Opcode|0x01 ADD|0x02 MUL|0x03 SUB|0x04 DIV|0x05 SDIV|0x06 MOD|0x07 SMOD|0x08 ADDMOD|0x09 MULMOD|0x0A EXP|0x0B SIGNEXTEND|\n|---|---|---|---|---|---|---|---|---|---|---|---|\n|Constraints|256|522|256|1054|*4155|1054|*4155|*1445|*2239|🚧 WIP|*2823|\n\n|Comparators Opcode|0x10 LT|0x11 GT|0x12 SLT|0x13 SGT|0x14 EQ|0x15 ISZERO|\n|---|---|---|---|---|---|---|\n|Constraints|262|262|520|520|5|5|\n\n|Bitwise Opcode|0x16 AND|0x17 OR|0x18 XOR|0x19 NOT|0x1A BYTE|0x1B SHL|0x1C SHR|0x1D SAR|\n|---|---|---|---|---|---|---|---|---|\n|Constraints|768|768|768|256|308|326|325|1063\n\n*: Improvement is required to be used in products.\n\nMost Cost is the range check cost. For future research on optimization, please check [Further Research](#further-research) below.\n\n### Our SNARK Primitive - Subcircuit library\nRefer to [our SNARK paper](https://eprint.iacr.org/2024/507.pdf) \"3 Front-end preprocess: System of constraints and setup algorithm\"\n\n### Our Limitation\n- EXP\n\n    As the exponent range is [0,2**256), if an EXP circuit is implemented, it will be the most expensive among the above opcodes. In other words, including an EXP single circuit in the subcircuit library has the disadvantage of being expensive. One good approach is to implement the EXP operation using the MUL opcode circuit already in the subcircuit library.\n\n- SHA3\n\n    [Keccak256](https://github.com/vocdoni/keccak256-circom) hash function is implemented in Circom by [Vocdoni](https://github.com/vocdoni). However, it needs around 151k constraints by Keccak's zk-unfriendliness. It is too expensive to put it in a subcircuit library.\n\n\n## Further Research\n\nHow to reduce range check constraints\n\n- About R1CS range check : [Simple R1CS range check and truncation](https://hackmd.io/@7dpNYqjKQGeYC7wMlPxHtQ/B1w_9nq2Y)\n\nCan we Use Lookup?\n\n- [GroLup: Plookup for R1CS](https://ethresear.ch/t/grolup-plookup-for-r1cs/14307)\n\n- [Can Groth16 support lookups?](https://hackmd.io/@Merlin404/SJmtF_k-2)\n\nOptimize our zk-EVM Subcircuit library\n\n- Splitting opcode operations. (e.g. SDIV =\u003e sign_bit extraction circuit + subcircuit already in subcircuit library)\n    - [Using lazy loading for duplicate subcircuit constraints](https://hackmd.io/@JIJKVPoYSZaHxu42ObOitQ/SJDZWE-Gh)\n- Combine opposing opcodes into one subcircuit. (e.g. \u003c0x10 LT, 0x11 GT\u003e,\u003c0x12 SLT, 0x13 SGT\u003e)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftokamak-network%2FDEPRECATED-circom-ethereum-opcodes","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftokamak-network%2FDEPRECATED-circom-ethereum-opcodes","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftokamak-network%2FDEPRECATED-circom-ethereum-opcodes/lists"}