chore: respond to veridise findings (#287)

# Veridise audit response — barretenberg recursive verifiers

Addresses findings from the Veridise audit of barretenberg's recursive verifier
stack (sumcheck, Gemini/Shplonk/Shplemini, small-subgroup-IPA, ECCVM/translator,
pairing points). The changes are correctness hardening, defense-in-depth
assertions, dead-code removal, and documentation/comment fixes.

No proving behavior changes on valid inputs — the fixes are guards/asserts on
edge cases, comment corrections, and removal of unreachable code — so verification
keys are unaffected. The one behavioral change (1165) only affects malformed
mixed-infinity pairing accumulators that honest execution never produces.

A living tracking doc, `veridise-audit-issues.md`, records the per-finding and
per-sub-item disposition (fixed / won't-fix / N-A / open) with rationale.

## Correctness / hardening fixes
- **1212** — recursive verifier ctors guard against an empty/all-constant proof (`stdlib::Proof::get_context`).
- **1215** — reject empty `multivariate_challenge` in Shplemini / SmallSubgroupIPA.
- **1158** — skip G1 points at infinity (and their precomputed lines) in `reduced_ate_pairing_batch_precomputed`.
- **1165** — `PairingPoints::aggregate` rejects mixed-infinity accumulators instead of treating them as uninitialized.
- **1217** — remove the dead, argument-swapped `VKAndHash_` alias from the goblin recursive flavors.
- **1222** — enforce ZK-sumcheck API invariants (single callable `prove()` per flavor; side-effect-free ZK-correction handler).
- **1225** — remove the unreachable masking-tail machinery in the Gemini batcher (dead since masking moved to the trace top), eliminating a latent `add_scaled` precondition hazard.

## Umbrella findings
- **1219** (core primitive input/range/init checks) — **resolved**: 12 fixed, 4 won't-fix, 4 N-A. Notably, `SumcheckProverRound` now owns its round state: `round_size` is private and a `round_index`/`multivariate_d` pair (derived per round) drives a new `advance_round()`, letting `compute_virtual_contribution` assert `is_virtual_round()`. Deriving `multivariate_d` per round keeps this correct for the batched translator's two differently-sized rounds.
- **1220** (documentation/comment hygiene + magic literals) — 21 done, 1 won't-fix, 4 N-A. Comment/formula/doc corrections across sumcheck/relations/polynomials/PCS, plus centralizing the masking-length constant (`WITNESS_MASKING_TERM_LENGTH`) in `constants.hpp` (removing three duplicated copies that must agree).
- **1221** (code-quality / API-hygiene, defense-in-depth) — most items done: `[[nodiscard]]`s, a `BatchOpeningClaim` consistency assert, `ShplonkVerifier` `finalize`/`export` mutual-exclusion guard, `has_zk`-consistency check, single-use asserts in small-subgroup-IPA, null-SRS guards, and removal of the dead default ctor + `g1_identity` member on the recursive `VerifierCommitmentKey`.

## Accepted / won't-fix (with rationale in the doc)
- **1156** — verifier-internal IPA randomness is sound; the real gap was closed separately.
- **1159** — `handle_edge_cases=false` is safe (random challenges make collisions negligible); doc-only.
- **1214** — the fixed transcript layout gives positional binding in place of explicit label domain separation.
- **1223** — `compute_effective_round_size` invariants hold at the current commit; the hot-path hardening is deferred.

## Still open (decision needed)
- **1213** — whether to add a transcript-level "fully consumed" check (`num_frs_read == proof_data.size()`) or accept the existing msgpack trailing-data rejection as sufficient. (Finding 1221 #19 rides on this.)

## Cross-cutting decisions worth noting
- **Consistency over local "correctness"**: transcript labels kept hardcoded (1220 #15) since tests independently pin the wire strings; `serialize_from_buffer`/`read` names kept (1221 #1, 1219 #2/#3) as the codebase-wide serialization convention.
- **Assert-once vs. idempotency**: single-use small-subgroup-IPA builders assert at-most-once (fail loudly on a re-call) rather than silently recompute.
- **Post-rebase N-A**: two fixes (1220 #18 Shplonk reservation, 1221 #9 IPA `assert_consistent` call site) were dropped when rebasing onto `next`, which had since refactored the code they targeted; both are documented as N-A.
- Also includes a fix making the `gate_challenges.size()` sumcheck-prover assertion flavor-aware (zero for multilinear-batching flavors, `>= multivariate_d` otherwise).

---------

Co-authored-by: AztecBot <tech@aztec-labs.com>
Co-authored-by: federicobarbacovi <171914500+federicobarbacovi@users.noreply.github.com>
Co-authored-by: ledwards2225 <l.edwards.d@gmail.com>

Author: 4 people

INIT_3_HANDOFF.md

@@ -155,7 +155,7 @@ void BatchedHonkTranslatorProver::execute_joint_sumcheck_rounds()
         }
         zk_sumcheck_data.update_zk_sumcheck_data(u, round_idx);
         gate_sep.partially_evaluate(u);
-        translator_round.round_size >>= 1;
+        translator_round.advance_round();
     };
 
     // Per-round helper: compute U_joint = U_MZK + α^{K_H}·U_translator from given polynomial
@@ -215,7 +215,7 @@ void BatchedHonkTranslatorProver::execute_joint_sumcheck_rounds()
             }
         }
         rdp.update_evaluations(u, 0);
-        mega_zk_round.round_size >>= 1;
+        mega_zk_round.advance_round();
         mega_zk_round.excluded_head_size = 2; // After round 0, disabled zone collapses to 1 edge pair
         update_round_state(0, u);
     }
@@ -238,7 +238,7 @@ void BatchedHonkTranslatorProver::execute_joint_sumcheck_rounds()
             }
         }
         rdp.update_evaluations(u, round_idx);
-        mega_zk_round.round_size >>= 1;
+        mega_zk_round.advance_round();
         update_round_state(round_idx, u);
     }
 

barretenberg/cpp/src/barretenberg/chonk/batched_honk_translator/batched_honk_translator_prover.cpp

@@ -37,7 +37,7 @@ typename BatchedHonkTranslatorVerifier_<Curve>::OinkResult BatchedHonkTranslator
     transcript->load_proof(mega_zk_proof);
 
     if constexpr (IsRecursive) {
-        builder = mega_zk_proof.back().get_context();
+        builder = mega_zk_proof.get_context();
     }
 
     mega_zk_verifier_instance = std::make_shared<MegaZKVerifierInstance>(mega_zk_vk_and_hash);

barretenberg/cpp/src/barretenberg/chonk/batched_honk_translator/batched_honk_translator_verifier.cpp

@@ -67,7 +67,8 @@ template <typename Curve> class OpeningClaim {
 
     static constexpr bool IS_GRUMPKIN =
         std::is_same_v<Curve, curve::Grumpkin> || std::is_same_v<Curve, stdlib::grumpkin<UltraCircuitBuilder>>;
-    // Size of public inputs representation of an opening claim over Grumpkin: 2 * 4 + 2 = 10
+    // Size of public inputs representation of an opening claim over Grumpkin: challenge (2) + evaluation (2) +
+    // commitment (2) = 6
     static constexpr size_t PUBLIC_INPUTS_SIZE = IS_GRUMPKIN ? GRUMPKIN_OPENING_CLAIM_SIZE : INVALID_PUBLIC_INPUTS_SIZE;
 
     /**

barretenberg/cpp/src/barretenberg/commitment_schemes/claim.hpp

@@ -133,20 +133,10 @@ template <typename Curve> class GeminiProver_ {
         Polynomial batched_unshifted;            // linear combination of unshifted polynomials
         Polynomial batched_to_be_shifted_by_one; // linear combination of to-be-shifted polynomials
 
-        // Batched tails: small polynomials covering only the tail region (e.g. last NUM_MASKED_ROWS positions).
-        // Populated during compute_batched if tails are registered.
-        Polynomial batched_unshifted_tail_;
-        Polynomial batched_shifted_tail_;
-
       public:
         RefVector<Polynomial> unshifted;            // set of unshifted polynomials
         RefVector<Polynomial> to_be_shifted_by_one; // set of polynomials to be left shifted by 1
 
-        // Tails: small polynomials (e.g. masking values) to be batched with the same rho scalar
-        // as their corresponding base polynomial. Pairs of (index in unshifted/shifted list, tail poly).
-        std::vector<std::pair<size_t, Polynomial>> unshifted_tails_;
-        std::vector<std::pair<size_t, Polynomial>> shifted_tails_;
-
         PolynomialBatcher(const size_t full_batched_size, const size_t actual_data_size = 0)
             : full_batched_size(full_batched_size)
             , actual_data_size_(actual_data_size == 0 ? full_batched_size : actual_data_size)
@@ -161,15 +151,6 @@ template <typename Curve> class GeminiProver_ {
         void set_unshifted(RefVector<Polynomial> polynomials) { unshifted = polynomials; }
         void set_to_be_shifted_by_one(RefVector<Polynomial> polynomials) { to_be_shifted_by_one = polynomials; }
 
-        void add_unshifted_tail(size_t batcher_index, Polynomial&& tail)
-        {
-            unshifted_tails_.emplace_back(batcher_index, std::move(tail));
-        }
-        void add_shifted_tail(size_t batcher_index, Polynomial&& tail)
-        {
-            shifted_tails_.emplace_back(batcher_index, std::move(tail));
-        }
-
         /**
          * @brief Compute batched polynomial A₀ = F + G/X as the linear combination of all polynomials to be opened,
          * where F is the linear combination of the unshifted polynomials and G is the linear combination of the
@@ -200,41 +181,17 @@ template <typename Curve> class GeminiProver_ {
                     batched, std::span<const PolynomialSpan<const Fr>>(sources), std::span<const Fr>(scalars));
             };
 
-            // Batch tails into a small accumulator with the correct rho power per tail.
-            // Tails are small (e.g. 3 elements), kept separate to avoid extending the main batched
-            // poly to full_batched_size. Each tail's scalar is base_scalar * rho^idx.
-            auto batch_tails = [&](Polynomial& batched_tail,
-                                   const std::vector<std::pair<size_t, Polynomial>>& tail_list,
-                                   const Fr& base_scalar) {
-                for (const auto& [idx, tail] : tail_list) {
-                    if (batched_tail.is_empty()) {
-                        batched_tail = Polynomial(tail.size(), tail.virtual_size(), tail.start_index());
-                    }
-                    batched_tail.add_scaled(tail, base_scalar * challenge.pow(idx));
-                }
-            };
-
             Polynomial full_batched(full_batched_size);
 
-            Fr unshifted_base(1);
             if (has_unshifted()) {
                 batch(batched_unshifted, unshifted);
                 full_batched += batched_unshifted;
             }
-            batch_tails(batched_unshifted_tail_, unshifted_tails_, unshifted_base);
-            if (!batched_unshifted_tail_.is_empty()) {
-                full_batched += batched_unshifted_tail_;
-            }
 
-            Fr shifted_base = running_scalar;
             if (has_to_be_shifted_by_one()) {
                 batch(batched_to_be_shifted_by_one, to_be_shifted_by_one);
                 full_batched += batched_to_be_shifted_by_one.shifted();
             }
-            batch_tails(batched_shifted_tail_, shifted_tails_, shifted_base);
-            if (!batched_shifted_tail_.is_empty()) {
-                full_batched += batched_shifted_tail_.shifted();
-            }
 
             return full_batched;
         }
@@ -252,11 +209,6 @@ template <typename Curve> class GeminiProver_ {
             if (has_unshifted()) {
                 A_0_pos += batched_unshifted;
             }
-            if (!batched_unshifted_tail_.is_empty()) {
-                Polynomial A_0_extended(A_0_pos, full_batched_size - A_0_pos.start_index());
-                A_0_extended += batched_unshifted_tail_;
-                A_0_pos = std::move(A_0_extended);
-            }
 
             Polynomial A_0_neg = A_0_pos;
 
@@ -265,10 +217,6 @@ template <typename Curve> class GeminiProver_ {
                 A_0_pos.add_scaled(batched_to_be_shifted_by_one, r_inv);
                 A_0_neg.add_scaled(batched_to_be_shifted_by_one, -r_inv);
             }
-            if (!batched_shifted_tail_.is_empty()) {
-                A_0_pos.add_scaled(batched_shifted_tail_, r_inv);
-                A_0_neg.add_scaled(batched_shifted_tail_, -r_inv);
-            }
 
             return { A_0_pos, A_0_neg };
         };

barretenberg/cpp/src/barretenberg/commitment_schemes/gemini/gemini.hpp

@@ -70,10 +70,11 @@ std::vector<typename GeminiProver_<Curve>::Claim> GeminiProver_<Curve>::prove(
     // Construct the d-1 Gemini foldings of A₀(X)
     std::vector<Polynomial> fold_polynomials = compute_fold_polynomials(log_n, multilinear_challenge, A_0);
 
-    // If virtual_log_n >= log_n, pad the fold commitments with dummy group elements [1]_1.
+    // Commit to the virtual_log_n - 1 fold polynomials. When virtual_log_n > log_n, the trailing fold polynomials
+    // for the virtual rounds were appended as constant polynomials by compute_fold_polynomials; their commitments
+    // contribute nothing to the Shplonk quotient and are zeroed by the verifier.
     for (size_t l = 0; l < virtual_log_n - 1; l++) {
         std::string label = "Gemini:FOLD_" + std::to_string(l + 1);
-        // Virtual-round fold polynomials are constant; their commitments are zeroed by the verifier.
         transcript->send_to_verifier(label, commitment_key.commit(fold_polynomials[l]));
     }
     const Fr r_challenge = transcript->template get_challenge<Fr>("Gemini:r");
@@ -125,7 +126,7 @@ std::vector<typename GeminiProver_<Curve>::Polynomial> GeminiProver_<Curve>::com
     // At minimum, the disabled head region must be covered (masking values live at rows 1..3).
     size_t actual_size = std::max(A_0.end_index(), static_cast<size_t>(NUM_DISABLED_ROWS_IN_SUMCHECK));
 
-    // Reserve and allocate space for m-1 Fold polynomials, the foldings of the full batched polynomial A₀
+    // Reserve space for the virtual_log_n - 1 Fold polynomials, the foldings of the full batched polynomial A₀
     std::vector<Polynomial> fold_polynomials;
     fold_polynomials.reserve(virtual_log_n - 1);
     for (size_t l = 0; l < log_n - 1; ++l) {

barretenberg/cpp/src/barretenberg/commitment_schemes/gemini/gemini_impl.hpp

@@ -10,6 +10,7 @@
 #include "barretenberg/commitment_schemes/commitment_key.hpp"
 #include "barretenberg/commitment_schemes/pairing_points.hpp"
 #include "barretenberg/commitment_schemes/verification_key.hpp"
+#include "barretenberg/common/assert.hpp"
 #include "barretenberg/common/bb_bench.hpp"
 #include "barretenberg/stdlib/primitives/pairing_points.hpp"
 #include "barretenberg/transcript/transcript.hpp"
@@ -128,7 +129,7 @@ template <typename Curve_> class KZG {
      *         - \f$ P_1 = - [W(x)]_1 \f$
      */
     template <typename Transcript>
-    static PairingPointsType reduce_verify_batch_opening_claim(BatchOpeningClaim<Curve>&& batch_opening_claim,
+    static PairingPointsType reduce_verify_batch_opening_claim(BatchOpeningClaim<Curve> batch_opening_claim,
                                                                const std::shared_ptr<Transcript>& transcript,
                                                                const size_t expected_final_msm_size = 0)
     {
@@ -164,6 +165,9 @@ template <typename Curve_> class KZG {
         }
 
         // Compute C + [W]₁ ⋅ z
+        BB_ASSERT_EQ(batch_opening_claim.commitments.size(),
+                     batch_opening_claim.scalars.size(),
+                     "BatchOpeningClaim: commitments and scalars must have equal length");
         P_0 = GroupElement::batch_mul(batch_opening_claim.commitments,
                                       batch_opening_claim.scalars,
                                       /*max_num_bits=*/0,