https://github.com/oxarbitrage/pasta-formal
Formally verified Pasta curve definitions for Zcash in Lean 4
https://github.com/oxarbitrage/pasta-formal
Last synced: 19 days ago
JSON representation
Formally verified Pasta curve definitions for Zcash in Lean 4
- Host: GitHub
- URL: https://github.com/oxarbitrage/pasta-formal
- Owner: oxarbitrage
- License: mit
- Created: 2026-05-01T12:31:40.000Z (3 months ago)
- Default Branch: main
- Last Pushed: 2026-05-04T11:57:42.000Z (3 months ago)
- Last Synced: 2026-05-04T13:34:20.355Z (3 months ago)
- Language: Lean
- Homepage:
- Size: 20.5 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# pasta-formal
**Status:** Fully proven โ zero `sorry` statements.
Lean 4 formalization of the Pasta curves (Pallas and Vesta) used in Zcash's Halo 2 proving system.
## What's formalized
Both curves share the equation *y*ยฒ = *x*ยณ + 5, defined over distinct ~254-bit prime fields ๐ฝ_p (Pallas) and ๐ฝ_q (Vesta).
- **Primality** of both field moduli, via Lucas test with hierarchical Pratt certificates (28 intermediate primes, 4 levels).
- **`IsElliptic` instances** for both curves โ discriminant ฮ = โ10800 is a unit in both fields.
- **Cycle conjecture** (`Pasta/Cycle.lean`): `|Pallas(๐ฝ_p)| = q` and `|Vesta(๐ฝ_q)| = p` are stated as axioms. Proving these formally requires Schoof's point-counting algorithm, not yet available in Mathlib. The same result appears as `order_pallas` in [redpallas-formal](https://github.com/oxarbitrage/pasta-formal).
- **CompElliptic bridge** (`Pasta/Bridge.lean`): proves our Pratt-certified field primes equal the constants in [CompElliptic](https://github.com/daira/CompElliptic) (`PALLAS_BASE_CARD`, `PALLAS_SCALAR_CARD`). This enables composition with the [Ironwood](https://github.com/zcash/ironwood) balance proof and the [Clean](https://github.com/Verified-zkEVM/clean) circuit verification, which both use CompElliptic for their Pallas/Vesta types.
## Axioms
| Axiom | Justification |
|-------|--------------|
| `cycle_conjecture_pallas` | Requires Schoof's algorithm โ not in Mathlib |
| `cycle_conjecture_vesta` | Same |
## Build
```shell
lake build
```
## Dependencies
Lean 4 (`v4.30.0-rc2`), [Mathlib4](https://github.com/leanprover-community/mathlib4), [CompElliptic](https://github.com/daira/CompElliptic) (pinned to match [Ironwood](https://github.com/zcash/ironwood)).
## References
- [Zcash Protocol Spec ยง5.4.9.7](https://zips.z.cash/protocol/protocol.pdf)
- [Halo 2 book](https://zcash.github.io/halo2/)
- [pasta-hadeshash](https://github.com/zcash/pasta-hadeshash)
---
## Part of a series
Six repositories formally verifying the Zcash Orchard cryptographic stack:
| Layer | Repository |
|-------|-----------|
| Curves | [pasta-formal](https://github.com/oxarbitrage/pasta-formal) |
| Hash | [poseidon-formal](https://github.com/oxarbitrage/poseidon-formal) |
| Hash-to-curve | [sinsemilla-formal](https://github.com/oxarbitrage/sinsemilla-formal) |
| Signatures | [redpallas-formal](https://github.com/oxarbitrage/redpallas-formal) |
| Protocol | [orchard-formal](https://github.com/oxarbitrage/orchard-formal) |
| Proof system | [halo2-formal](https://github.com/oxarbitrage/halo2-formal) |