Crate halo2_solana_verifier 

halo2-solana-verifier

Tight BN254-only KZG/SHPLONK verifier for PSE-Halo2 proofs, designed for the Solana BPF VM. Inspired by Light Protocol’s groth16-solana pattern: no generic Loader/CurveAffine abstraction, no halo2curves dependency — direct calls to solana_bn254 syscalls + arkworks types only.

Architecture (decided in research+pivot phase):

• On-chain: arkworks-bn254 for Fr/Fq arithmetic + alt_bn128 syscalls for G1/G2/pairing, Keccak transcript via sol_keccak256.
• Off-chain: same code paths with feature solana-syscalls off; the syscalls module falls back to host arkworks ops (used for unit tests and the prover-side reference verifier).

v1 targets devnet (SIMD-0284 LE byte order, SIMD-0302 G2 syscalls active). v1.5 will add a mainnet fallback path that emulates G2 ops in pure BPF.

See vendor/snark-verifier/ (gitignored) for the upstream reference implementation we cross-check against.

Re-exports

pub use plonk::proof_reader;

pub use error::Error;

Modules

curve

BN254 G1/G2 affine points + the Solana syscall bridge.

error

field

BN254 scalar (Fr) helpers.

gate_compat

Solana feature-gate compatibility shim.

kzg

KZG polynomial commitment scheme on BN254 + the SHPLONK (BDFG21) batched multi-opening protocol used by PSE-Halo2 by default.

pairing

Final BN254 pairing check.

plonk

PSE-Halo2 PLONKish protocol — flat on-chain VK + proof structs and the main verifier entry point.

proof

On-chain proof byte format for PSE-Halo2 KZG/SHPLONK.

stage_state

2-tx split: the intermediate state passed from STAGE1 to STAGE2.

syscalls

Thin wrappers around Solana’s alt_bn128 and keccak256 syscalls.

transcript

Keccak Fiat–Shamir transcript.

vk

On-chain VerifyingKey byte format (v2.0).

Functions

verify

Verify a Halo2-PSE (BN254/KZG/SHPLONK) proof against the flat on-chain VK bytes and a list of public inputs.